fireandblast.

com

UKOOA / HSE

Fire and explosion guidance

Part 2: Avoidance and mitigation of fires
FINAL DRAFT

Main comment review completed

Document number 152-RP-48

Revision Date Reason for Issue
A 1 Mar 05 Initial build
B 21 Jun. 05 All received material to date
0 3 July 05 Issued for comment to sponsors, authors and peer review
1 02 Feb 06 Issued following review of main comments
2 06 Feb 06 Issued for use

fireandblast.com ltd +44 (0)1561-378383

8-10 High Street admin@fireandblast.com
Laurencekirk http://www.fireandblast.com
Scotland AB30 1AE
fireandblast.com

Foreword
This document has been prepared by fireandblast.com limited by compiling contributions from a
selection of industry experts in various aspects of fires on offshore installations.

This document has been prepared by fireandblast.com limited under a joint industry project
sponsored by UKOOA and the UK HSE. The production of the initial text was undertaken by a
number of organizations and individuals, principally:

David Galbraith and Ed Terry fireandblast.com

Steve Walker MSL Engineering
Barbara Lowesmith Loughborough University
Terry Roberts, Stefan Ledin and Stuart Jagger Health and Safety Laboratory
Bassam Burgan Steel Construction Institute
John Gregory Risk Management Decisions
Theresa Roper Aker Kværner
Bob Brewerton Natabelle Technology
Graham Dalzell TBS cubed
Denis Krahn Mustang Associates

This document is part of a series being produced by UKOOA and HSE on fires and explosions, the
full series being:

Part 0 Hazard management (formerly FEHM)

Part 1 Avoidance and mitigation of explosions

Part 2 Avoidance and mitigation of fires

Part 3 Detailed design and assessment guidance

152-RP-48 Rev 02, Feb 2006 Page 2 of 261

fireandblast.com

Contents
1. Introduction 5
1.1 History ................................................................................................................................. 5
1.2 Objectives ........................................................................................................................... 6
1.3 Fire and explosion hazard management............................................................................. 7
1.4 Overview of the guidance.................................................................................................... 8
2. Fire hazard management philosophy 10
2.1 Overview ........................................................................................................................... 10
2.2 Understanding the fire hazard........................................................................................... 13
2.3 Hazard management principles ........................................................................................ 24
2.4 Hazard management systems .......................................................................................... 25
2.5 Legislation, standards and guidance in the UK................................................................. 28
2.6 Inherently safer design...................................................................................................... 31
2.7 Risk screening................................................................................................................... 38
2.8 Risk reduction ................................................................................................................... 41
2.9 Human factors................................................................................................................... 43
3. Fires on offshore installations 44
3.1 Introduction ....................................................................................................................... 44
3.2 Fire types and scenarios ................................................................................................... 44
3.3 Fire prevention methods ................................................................................................... 47
3.4 Gas and fire detection and control methods ..................................................................... 50
3.5 Methods for mitigating the effects of fires ......................................................................... 60
3.6 Performance standards..................................................................................................... 66
3.7 Methods and approaches to structural analysis................................................................ 69
3.8 Particular considerations for floating structures, storage and offloading systems ............ 78
3.9 Particular considerations for mobile offshore units ........................................................... 82
3.10 Particular considerations for existing installations............................................................. 90
3.11 Particular considerations for accommodation and other areas for personnel ................... 95
4. Interaction with explosion hazard management 96
4.1 General ............................................................................................................................. 96
4.2 Fire and explosion prevention methods ............................................................................ 97
4.3 Fire and explosion detection and control methods............................................................ 98
4.4 Fire and explosion mitigation methods............................................................................ 101
4.5 Combined fire and explosion analysis............................................................................. 106
4.6 Safety conflicts ................................................................................................................ 108
4.7 Fire and explosion walls.................................................................................................. 110
4.8 Decks .............................................................................................................................. 111
4.9 Feedback from explosion testing at Spadeadam ............................................................ 112
5. Derivation of fire loadings and heat transfer 113
5.1 Introduction ..................................................................................................................... 113
5.2 Fire characteristics and combustion effects .................................................................... 113
5.3 Fire and smoke loading................................................................................................... 123

152-RP-48 Rev 02, Feb 2006 Page 3 of 261

fireandblast.com

5.4 Estimating fire and smoke loadings ................................................................................ 127

5.5 Heat transfer ................................................................................................................... 136
6. Response to fires 154
6.1 Properties of common materials in use offshore............................................................. 154
6.2 Effects of fire and nature of failures ................................................................................ 156
6.3 Acceptance criteria.......................................................................................................... 164
6.4 Methods of assessment .................................................................................................. 166
6.5 Attachments and coat-back............................................................................................. 172
6.6 Process responses.......................................................................................................... 173
6.7 Personnel ........................................................................................................................ 180
7. Detailed design guidance for fire resistance 194
7.1 General ........................................................................................................................... 194
7.2 The design sequence – minimising fire hazards throughout the design ......................... 195
7.3 Best practice for fire protection systems ......................................................................... 207
7.4 Human factors – man / machine interface ...................................................................... 219
7.5 Industry & regulatory authority initiatives ........................................................................ 222
8. References 225
8.1 Section 1 ......................................................................................................................... 225
8.2 Section 2 ......................................................................................................................... 225
8.3 Section 3 ......................................................................................................................... 225
8.4 Section 4 ......................................................................................................................... 225
8.5 Section 5 ......................................................................................................................... 225
8.6 Section 6 ......................................................................................................................... 225
8.7 Section 7 ......................................................................................................................... 225
Annex A Acronyms, abbreviations etc. 226
Annex B Glossary 227
Annex C Details on legislation, standards and guidance 247
Annex D Review of models 252
Annex E Checklists 261

152-RP-48 Rev 02, Feb 2006 Page 4 of 261

fireandblast.com

1. Introduction

1.1 History
Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire Engineering
for Topsides Structures (Phase 1)’ was carried out between May 1990 and July 1991. The main
deliverable from this project was the Interim Guidance Notes (IGNs) [1.1] and 26 background
reports [1.2 to 1.27] written by the participants and published by the Steel Construction Institute
(SCI) in November 1991. These background reports are available as free downloads from the HSE
web site [1.28].

The development of the Interim Guidance Notes was a major step forward which consolidated the
then existing knowledge of fire and explosion hazards. At about this time the Fire and Blast
Information Group (FABIG) was set up and has subsequently issued a number of Technical notes
on specific aspects of fire and explosion engineering [1.29 to 1.36], of the eight published
Technical Notes, five deal with fire hazard issues.

The hazards, characteristics and physical properties of hydrocarbon jet fires were appraised in the
Phase 1 reports of the Joint Industry Project on ‘Blast and Fire Engineering of Topside Structures’
(OTI 92 596/597/598) [1.37]. The main source of detailed information on the characteristics of jet
fires covered in the reports on the programme of jet-fire research was co-funded by the European
Community. This programme studied single fuel natural gas and propane jet fires (Bennett et al,
1990) [1.38]. A further project funded by the CEC, looked at the hazardous consequences of Jet
Fire Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale
natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet flame
impingement trials are reported in OTO 2000 051 [1.39].

Phase I of the JIP (OTI 92 596/597/598) [1.40, 1.41, 1.42] also included a review of open
hydrocarbon pool fire models. Three types of model (current at the time) were evaluated, semi-
empirical proprietary models, field models (e.g. CFD models) and integral models (falling between
semi-empirical and field models). Compartment fire modelling looked at two types of code, zone
models and field models. At that time, the zone models (typically used for modelling fires within
buildings) encountered severe limitations in the modelling of large offshore compartment fires.

Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994 to
2001, Phase 2 [1.43], Phase 3a and Phase 3b [1.44] consisted mainly of experiments to define and
determine explosion overpressure load characteristics under a range of conditions and to provide a
basis against which load simulation software may be validated. However, Phase 2 did produce
notable gains in knowledge in the area of unconfined crude oil jet fires and confined jet fires
(compartment fires). Two other separate but widely supported JIPs were also conducted around
this period which focussed on offshore fire hazards. One studied the effectiveness of water deluge
on jet and pool fires and the second JIP studied jet fires involving ‘live’ crude containing dissolved
gas and water.

The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and mixtures
of stabilised light crude oil with natural gas and the main findings are listed below.
• The free flame releases, of crude oil only, were not able to sustain a stable flame
and one of the mixed fuel releases was also unstable.
• All the flames were particularly luminous compared with purely gaseous jet flames
and generated large quantities of thick black smoke, mainly towards the tail of the
flame.
• All the flames were highly radiative, with maximum time averaged surface emissive
powers (SEPs, heat radiated outwards per unit surface area of the flame) ranging
between 200 kWm-2 to 400 kWm-2.

152-RP-48 Rev 02, Feb 2006 Page 5 of 261

fireandblast.com

• The incident total heat fluxes (radiative and convective) measured on the pipe target
were significantly higher for the mixed fuel tests than for the crude oil only tests, by a
factor of two in many cases. Typical values were in the range 50 kWm-2 to
400 kWm-2.

Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire
scenarios, but no pool-fire scenarios. However it did generate high quality data that were
considered suitable for future pool fire model evaluation.

Other valuable work, mostly executed in Norway and following the probabilistic approach, has
resulted in the NORSOK guidance documents [1.45, 1.46]. Both references were among the
source documents for Part 1 of this Guidance, it can be seen that the guidelines for risk and
emergency preparedness will support emergency response for fire hazards as well.

1.2 Objectives
The primary objective of this document is to offer guidance on practices and methodologies which
can lead to a reduction in risk to life, the environment and the integrity of offshore facilities exposed
to fire hazards.

Risk is defined as the likelihood of a specified undesired event occurring within a specified period
or resulting from specified circumstances.

Preventative measures are the most effective means of minimising the probability of an event and
its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are central to the
approach described in this document both for modifications of existing structures and new designs.

This document consolidates the R&D effort from 1988 to the present day, integrates fire type and
scenario definition, fire loading and response development and provides a rational design
approach to be used as a basis for design of new facilities and the assessment of existing
installations.

This Guidance is intended to assist designers and duty holders during the design of, and in making
operational modifications to, offshore installations in order to optimise and prioritise expenditure
where it has most safety benefit.

An additional intent of this Guidance is to move the decision-making processes within the fire and
explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’ as
defined in UKOOA’s document on decision-making, the key figure of which is illustrated in Figure
1-1 below [1.47]. Due to the nature in which fire and explosion hazards are closely linked,
reference should be made to Part 1 of this guidance when developing concepts and solutions to a
“Type A” decision.

152-RP-48 Rev 02, Feb 2006 Page 6 of 261

fireandblast.com

Figure 1-1 The UKOOA decision making framework

The framework in Figure 1-1 defines the weight given to various factors within the decision making
process, ranging from those decisions that are dominated by purely engineering matters to those
where company and societal values predominate.

A substantial number of installations will lie in Areas A or B of the chart resulting in an approach
which involves codes and guidance based on experience and ‘best practice’ (as described in this
document) and supplemented by risk based arguments where required.

This Guidance will look to build past experience of the development of fire scenarios and the
prediction of design fire load cases and their timelines as part of the “Type A” approach.

1.3 Fire and explosion hazard management

A thorough understanding of all hazards and hazardous events, including fires and explosions, is
at the heart of the Safety Management System (SMS) and it should be proactive to reduce risks. A
commonly adopted overall process is outlined in the OGP “Guidelines for the Development and
Application of Health Safety and Environment Management Systems”. This Guidance adds more
detail to this process and applies it to fires and explosions. For these hazardous events the
management process is given below:
• identification of the hazardous events (coarse assessment);
• analysis and assessment of the hazardous events (type, areas affected, magnitude
of the consequences, duration, likelihood, etc.);
• reduction of the risks from fires and explosions through inherently safer design;
• design to reduce the likelihood, scale, intensity, duration and effects of each
hazardous event;
• identification and specification of the particular prevention, detection, control and
mitigation measures needed for each hazardous event;
• confirmation of the suitability and effectiveness of each of the measures selected;

152-RP-48 Rev 02, Feb 2006 Page 7 of 261

fireandblast.com

• specification of the measures adopted;

• communication and implementation;
• verification;
• documentation.

The hazard management process should be employed in a timely manner and in accordance with
the type, severity and likelihood of each hazardous event, that is, it should be a risk-based
process. Therefore, in order to obtain most benefit, the hazard management process should start
in the feasibility study phase It is essential that all parties who can contribute to the reduction of
hazards particularly design engineering disciplines and those who will have to operate and
maintain the plant, understand the hazards and are involved during the appropriate stages of the
lifecycle.

The lifecycle approach shows how to prepare and implement a strategy for the management of fire
and explosion on an offshore installation throughout its life, i.e. from design through commissioning
and operations to decommissioning. This is developed firstly by inherently safer design (elimination
of hazards), followed by prevention of identified fire and explosion hazardous events and then by
the selection of detection, control and mitigation measures. The fire and explosion assessment
process is used in the lifecycle to provide information on which to base decisions and the design of
systems. Thereafter, it is used to assess these arrangements to make sure that the high level
performance standards have been achieved.

The FEHM process can be applied to new or existing installations.

• For new installations it should start during feasibility studies and be fully developed
during detail design. The results should then be communicated to personnel
operating the installation to ensure that they know the purpose and capability of all
the systems, can operate them properly and that adequate maintenance schemes
are in place;
• For an existing installation the process should be applied to current arrangements
and modifications. These should be assessed to determine if the high level
performance standards are achieved and that risks are as low as is reasonably
practicable.

The management of hazards to reduce the risks involves many interests which may often appear
to conflict with each other. The process is a multi-disciplinary activity, involving all levels of
personnel from senior management to junior staff from a number of different organisations. It is
important that the input and activities of these personnel are fully coordinated and managed. The
SMS of each organisation should identify the relevant roles and responsibilities.

A more comprehensive and homogeneous view of the role of fire and explosion hazard
management within the overall Hazard Management System (HMS) can be found in Part 0 of this
Guidance, “Part 0 Fire and explosion hazard management”.

More information on specifically the philosophy of fire hazard management can also be found in
Section 2 of this Part 2 of the Guidance.

1.4 Overview of the guidance

Generally, the Guidance has been developed to consolidate current best practice in the industry
and research community and sets out to present this information in a coherent manner of use to
industry practitioners. The collation of existing information and the endeavour to relate the
information into the form of “Type A” decisions (see Section 1.2), is intended to assist practitioners
by providing a set of “Rules of Thumb” by which to carry out work effectively and quickly.

152-RP-48 Rev 02, Feb 2006 Page 8 of 261

fireandblast.com

Section 2, ‘Fire hazard management philosophy’, describes the steps to be taken and the base
information to be considered in understanding fire hazards and outlining some of the key
considerations in managing them. This section sets out the principles, the process and the
implementation steps required when deciding what has to be done in any particular context and the
factors that have to be taken into account. The principles of ‘Inherent Safety’ are presented.

Section 3, ‘Fires on offshore installations' discusses the various scenarios that can occur in
hydrocarbon installations and provides assistance on the prevention, control and mitigation
measures available to combat them. The appropriate methods of analysis dependent on the
expected risk level are introduced. The tasks identified are linked with the relevant phase of a
design project or the stage in the life of the installation. This section also gives .particular
considerations for particular installations and parts of installations

Section 4, ‘Interaction with explosion hazard management’, identifies situations where fires may
precede or follow an explosion and deals with common areas of fire and explosion management,
potential conflict between the management of these hazardous events and potential areas of
combined analyses.

Section 5, ‘Derivation of fire loadings and heat transfer’ describes how appropriate design thermal
and smoke loads are derived. The section discusses eight fire types and the impacts of the
associated heat transfer and considers the manner in which loadings are estimated for the
purposes of use within a QRA.

Section 6, ‘Response to fires’ discusses the effects of fire and the manner in which structures fail
and links these concepts to definitions of acceptance criteria from national and international
standards. The section also reviews potential failure definitions and failure modes of process
equipment and impact effects on personnel.

Section 7, ‘Detailed design guidance for fire resistance’, brings together the approaches identified
in the other sections and incorporates additional design and operations experience to provide
guidance on methods of detailed design. The guidance is presented in the context of best practice
and identifies other industry initiatives which have generated detailed design and operating
practice guidance. The subject area will be revisited in more detail in Part 3 of the guidance.

The annexes provide summary and supplementary material.

152-RP-48 Rev 02, Feb 2006 Page 9 of 261

fireandblast.com

2. Fire hazard management philosophy

2.1 Overview
2.1.1 General

In general terms a release of hydrocarbon with immediate ignition will result in a fire; release of an
inflammable vapour or gaseous mixture followed by later ignition (i.e. when the cloud of vapour or
gas is adequately large) may result in an explosion. Consequently some of the probabilities,
causes, methods of prevention and control of releases are identical for both the fire and explosion
hazard. Indeed, many of the hazard management principles and practices apply to both hazards.
This aspect is explored more in Section 4.

2.1.2 Hazard philosophy

In this, the second part of the Guidance, goals which should be achieved in designing for and
managing the fire hazard are identified. The legislative basis is reviewed and some high level
performance standards are given.

The features of an effective Safety Management System (SMS) are identified and the choice and
management of detection, control and mitigation systems is discussed. The main characteristics of
the fire hazard are also identified. The techniques of inherently safer design described in
Section 2.6 are fundamental to the most effective approach to eliminate, prevent and mitigate the
fire hazard particularly for new designs.

The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures, systems
or human intervention to protect personnel.

In order to focus effort where it is most needed, a risk screening method is described in
Section 2.7.4 which classifies installations and compartments according to the level of their fire
risk. The measures for frequency and consequence severity are based on process complexity and
the exposure potential for people on board. These measures are combined in a risk matrix to give
low, medium and high risk categories. The risk level is an indication of the level of sophistication to
be used in the fire assessment process.

Nominal loads for jet and pool fires have been available since the publication of the Interim
Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions. A
number of alternative values have since been published including nominal fire loads for confined
and ventilation controlled fires [2.2, 2.3]. Updated guidance on the selection of fire loads is given in
Section 5.4 with recommendations on the limits of applicability.

The overriding requirements for hazard management philosophy are to:

• protect personnel in the TR;

• minimise injuries and fatalities from the initial event;

• provide escape to TR and other means of escape/evacuation.

152-RP-48 Rev 02, Feb 2006 Page 10 of 261

fireandblast.com

The philosophy should ensure that:

• the hazard scenarios are addressed;

• suitable accidental loads are developed (either risk based and/or prescriptive);

• plant and equipment minimises escalation, personnel within the TR do not continue to be
threatened by the incident, until such time as the hazard has dissipated to a safe level via
shutdown, blow down, or other means;

• personnel are able to escape to a safe location away from the hazard.

The identification of key SCE’s and corresponding Performance Standards provide the
demonstration that such a philosophy has been met.

2.1.3 Prescriptive vs. Performance based design

Prescriptive design against the fire hazard can be a valid alternative, for example for low risk
installations. This method is based on standardized guidance or requirements, without recognition
of site-specific factors. The size of the facility, hazards posed or specific water demand is not
considered. Prescriptive approaches to fire design generally are a result of compliance with
regulations, insurance requirements, industry practices, or company procedures. These are
generalized approaches largely based on past incidents.

Performance or scenario based design adopts an objective based approach to provide a desired
level of fire and explosion performance. The performance based approach presents a more
specific prediction of potential fire hazards for a given system or process. This approach provides
solutions based on performance measured against established goals or performance standards
rather than on prescriptive requirements with implied goals. Solutions are supported by a Fire
Hazard Analysis (FHA) or, in some cases, a fire risk assessment.

2.1.4 Hazard management

A fire risk assessment takes account of more than just the consequences, and includes the
likelihood or frequency of the fire and explosion scenarios occurring. A performance based
approach looks at determining the need for fire and explosion design on a holistic basis.

Performance objectives and measures allow the designer of fire systems more flexibility in meeting
requirements and can result in significant cost-savings as compared with the prescriptive
approach. Conversely, for small projects, the cost of performance based design may not be cost-
effective.

In a scenario or performance based approach release scenarios are postulated and their
consequences and probabilities of occurrence determined. For existing installations, reliable
estimates of fire loads, extents and durations may be available from previous assessments.

The most severe fires from the point of view of initial rate of release may be less frequent and less
durable than fires of lesser severity and hence may present a smaller risk. Although the initial
extent of the engulfed region may be greater, the lower duration may result in lower quantities of
heat being delivered to those equipment items and structural members within the affected region.
However, it is important to account for apparently small fires that on initial evaluation do not appear
to have the potential for escalation. Dismissing such ‘small events’ can distort the Installation’s risk
profile.

The scenarios considered, should be sufficiently varied to cover the following:

152-RP-48 Rev 02, Feb 2006 Page 11 of 261

fireandblast.com

• severe, but unlikely cases which give short duration fires with the potential for the maximum
number of immediate fatalities

• small long duration scenarios which still have sufficient size to cause local escalation.

• intermediate scenarios which have the greatest potential for escalation or platform impact
whilst lasting long enough to realise this potential.

Design or Dimensioning fire scenarios are selected on the basis of the risk they present and should
be accommodated by the safety critical elements (SCEs) of the installation which will include parts
of the structure, piping and equipment.

It will be necessary to consider the effect of non-availability of mitigation measures such as shut
down, blow down, venting, deluge or barriers in the construction of design scenarios. Some
scenarios may also assume a prior explosion has occurred with fire being an escalation event. The
identification of the common-cause failure modes that may defeat several mitigation measures
should needs to be carried out in a rigorous manner. Multiple or coincidental failures can lead to
events moving from Minor or Controllable to Extreme (see Section 2.2.2); for example, fires that
disrupt the UPS or auxiliary power supplies or common Installation air supplies.

It is suggested in this guidance, that the number of SCEs which need to be considered in detail is
reduced by classification into criticality categories with respect to the fire hazard.

The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage of
access ways by radiation or the development of a hot gas layer, smoke and fume generation,
structural weakening and possible collapse. Further escalation through subsequent release of
inventory may occur.

The consequence measures of relevance to fires are:

• intensity, that is heat flux and temperature;

• extent, that is the area or volume occupied by flame, affected by radiation or by combustion
products;

• duration;

• frequency, that is the probability of occurrence depending on the probability of immediate or

delayed ignition;

• mitigation effectiveness will depend on detection, inventory isolation and deluge activation
together with the probabilities that these measures will be initiated;

• radiation thresholds for personnel safety and escape, the integrity of equipment and
supporting structure.

Reducing risks to ALARP must be demonstrated in all cases, both through the justification of the
choice of design scenarios and from a determination of the impairment frequency of the SCEs
under the fire loads.

An acceptable level of risk can be identified within the ALARP framework, which identifies the
acceptable frequency of exceedance of the severity of the design or dimensioning scenarios.
Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the
risk to people on board, the impact on the SCEs and the overall individual risk including that from
other hazards.

Following NORSOK [2.4], ISO [2.5] uses a threshold probability of exceedance level (10-4 per year)
below which individual contributing scenarios may be eliminated from further consideration if the
152-RP-48 Rev 02, Feb 2006 Page 12 of 261
fireandblast.com

impact on personnel is low enough (i.e. numbers of personnel affected). Events with probabilities
above this level are considered to be ‘dimensioning’, and require further analysis to determine the
size and extent of the resulting loading and subsequent effects.

The UKOOA Part 1 document [2.6] proposes a similar approach, albeit couched in different terms.
An (explosion) event will be considered depending on whether the event impinges directly on the
Temporary Refuge with probability of exceedance > 10-5 per year. Events directly affecting other
regions where a barrier may be present to prevent impingement on the TR are considered if the
probability of exceedance is greater than 10-4 per year.

2.2 Understanding the fire hazard

2.2.1 General

Understanding the risks from fire hazards is the key to their minimisation. This applies at all levels
of an organisation from the directors to those designing and operating the facilities. This knowledge
should be used to inform people making critical decisions both in design and operation. It should
not be acquired after these decisions have been made in order to retrospectively justify them. In
other words, the knowledge should be used proactively to reduce risk. The type of understanding
differs according to the level of people in the organisation and the responsibilities that they hold.

• Senior Management: They need to know the overall level of risk for the facilities to decide if
the design is viable or if existing operations may continue.

• Project or Facilities Management: They need to know the pattern of risk by facility and the
proportion of that risk which comes from different hazards such as fire. This will allow them
to decide how the facilities are to be designed and operated. It will also allow them to
provide sufficient resources.

• Discipline Engineering and the Supervision of Operations: They need an overall

understanding of all the hazards for which they have responsibility. The understanding of
the causes, severity and consequences will allow them to decide how each of the hazards
will be managed and the measures needed to do so.

• Designers, Operators and Technicians: They need to understand the hazard characteristics
so that they may design, operate and maintain critical elements to suit the needs of the
hazards.

It is essential that the information gained from hazard and risk studies is distilled, documented and
communicated so that every level and person is kept informed. It must also be kept up to date. It is
a living picture which becomes progressively more detailed and accurate as the design
progresses. It also changes throughout the life of the facilities as different activities take place and
the fields mature.

2.2.2 Classification of fire hazards

It may be helpful to classify fire hazards according to their potential for harm. This may be done by
assessing what is in place either in a design or an existing facility and determining the
classification. It is preferable to actively manage the fire hazards such that steps are taken to
actively lower their classification by reducing the severity of the effects. This may be done by
following the principles for inherently safer design (see Section 2.6) or by applying or optimising
hazard management measures to minimise the size of releases, their location, effects on the
facility, the rate of release and the duration. One method of classification follows.

152-RP-48 Rev 02, Feb 2006 Page 13 of 261

fireandblast.com

• Catastrophic: As the name suggests, these events would overwhelm an installation and it
would be impractical to counteract the effects such that the lives of those on board could be
saved. This type of event should be designed out or very high integrity preventative
measures provided such that the likelihood is minimised.

• Evacuation/Extreme: This type of event would have a major impact upon a large part of the
installation such that the effects upon people, both physical and psychological, would be
such that evacuation would be necessary. It would also apply to those events where the
potential for escalation is widespread including structural, process, safety systems or the
impairment of muster and escape routes. Typically these events are those which would
give prolonged effects beyond the source module, in particular external flaming and dense
smoke effects. In some cases it may be possible to suppress the widespread effects of
these fires reducing the categorisation to the lower, controllable, level. If not, the effects
must be fully understood and premature catastrophic escalation delayed, and personnel
protected from smoke and heat until evacuation has been completed. By their nature these
are inherently low frequency events, requiring a significant sized release from a major
inventory and/or its combination with safety system failures such as ESD.

• Controllable: These events have the potential for local fatalities and may also be capable of
escalation to a scale requiring evacuation. However, the moderate scale of the effects
should allow these events to be controlled such that further escalation is prevented and
evacuation is not essential to preserve life. Typically, the prolonged effects of these events
will be limited to one module or process area and will be of finite duration. They would be
associated with smaller releases from moderate inventories. In these cases effective
control of the source inventory and the prevention of escalation will be critical. It may be
practical to extinguish some of these events but in other cases, this may not be possible or
may be dangerous in which case, they should burn out under controlled conditions.

• Minor: These events are of a very small scale. They may cause local injuries but would not
have either the scale or duration to cause critical escalation. They may lead to damage to
plant causing financial loss but not major loss of life. These events can be managed by
limiting the size of the event and allowing it to burn out. Protection would only be needed for
asset protection.

2.2.3 Causes and likelihood of hydrocarbon releases

The causes of hydrocarbon releases are numerous and it is essential that a full causation is carried
out so that effective preventative measures can be put in place. These causes can generally be
broken down into three categories:

• human or procedural error;

• plant or equipment failure;

• systemic failure; i.e. inherent weaknesses in the business processes and infrastructure
supporting design and operation.

Lack of maintenance, particularly over long periods may distort the understanding of the underlying
causes of failures. Effective maintenance regimes are essential to determining the likelihood of
plant failures.

The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of the
fluids, the number of times containment is deliberately breached or the number of weak points
such as flanges or tappings. It is also a function of the understanding of those causes and the
effectiveness of measures which are put in place to manage them. Statistical data is a good start
point from which to list causes and to determine likelihood. This should then be augmented with
the knowledge of engineers, technicians and operators to give a more accurate picture for each

152-RP-48 Rev 02, Feb 2006 Page 14 of 261

fireandblast.com

facility. HAZOP procedures will give a rigorous identification of process causes but the overall
examination should be sufficiently broad to address external and human effects. This examination
should be fully documented so that there can be assurances that preventative measures are
suitable and sufficient.

For statistical data, the most frequent sources of the hazard as given by the history of releases
experienced to date are documented as follows.

The HSE document OTO 2001 055 [2.7 states that for the UK sector of the North Sea:

61 % of all releases are from pipework systems

11 % of all releases are from small bore piping

15 % of all releases are from flanges

14 % of all releases are from seals and packing

Of the causes;

11 % are due to incorrect installation

26 % from degradation of materials (excluding corrosion and erosion)

11 % of all releases are due to vibration/fatigue

19 % of all releases are due to corrosion and erosion

It is considered that 40 % of equipment related releases are attributable to poor design and 38 %
to inadequate inspection and condition monitoring.

Avoidance of potential leak sources in design therefore needs to consider these above issues in
particular. The importance of operational aspects is also shown in proportion of leaks attributable
to poor inspection and monitoring.

Sources of release data include WOAD [2.8], OREDA [2.9] release statistics published annually by
the HSE [2.10] and the HSE/UKOOA publication on the subject [2.11]. The Minerals Management
Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico [2.12]

2.2.4 Ignition causes and probability

The probability of ignition will depend upon the following factors.

• The rate and duration of the release and the size of the consequent gas cloud

• The location of the release

• The type of fuel and the proportion of gas or volatile vapours which is generated in the short
term

• The nature of the release; whether high or lower pressure. The turbulence caused by high
pressure gas releases will cause effective mixing with the air to give a well defined
flammable cloud. High pressure liquid releases will encourage fine droplet formation and
increase the vaporisation of any light ends.

152-RP-48 Rev 02, Feb 2006 Page 15 of 261

fireandblast.com

• The flammability characteristics of the gases and vapours. Each different gas or vapour has
a specific flammability range, from a lower flammability limit; through stoichiometric and
rising to a higher limit above which ignition should not occur. Very large releases may have
a non flammable rich core but will be surrounded by a flammable region which may engulf
ignition sources as it spreads away from the point of release. Each gas or vapour will also
have a specific auto ignition temperature ranging from 200 – 550 °C. such that contact with
hot surfaces such as an exhaust turbocharger would cause ignition

• The dispersion characteristics; whether there are heavy vapours which will descend or
lighter gases which should rise.

• The confinement of the escaping vapours and gases by floors, ceilings or walls. These may
also cause flammable gases to be directed towards areas without flameproof equipment

• The ventilation characteristics in the areas, whether forced or natural and the variation of
those characteristics with wind strength and direction

• The characteristics of the fluid and its release, where this might build up static

• The presence of sulphurous impurities in the fluids which might lead to the formation of
pyrophoric scale

• The number of fixed ignition sources and the standard of their maintenance, if designed for
use in flammable atmospheres, including the presence or not of Ex equipment.

• The proximity of the release to areas which are classified as “safe” and therefore are not
fitted with flameproof equipment.

• The gas detection philosophy and the local and wider shutdown of ignition sources upon
detection

• The detection of gas ingress at the air intakes to enclosures such as accommodation or
equipment rooms and the closure of dampers.

• The hot work philosophy on the facility, the number of these activities and the effectiveness
of their control.

• The possibility of ignition being caused by the action of personnel carrying out emergency
response actions such as plant shutdown causing sparks at electrical breakers.

Ignition probabilities have been widely studied and this work is summarised in recent work for
UKOOA studying ignition probabilities [2.13]. The probability of ignition should be determined using
that guidance together with an assessment of the characteristics listed above. As with the
likelihood of release, it is possible to influence the probability of ignition by design, good
maintenance and operational controls.

2.2.5 Fire hazards: Understanding the source

2.2.5.1 General

It is essential that the source of the hydrocarbons is examined and fully understood in order to
examine the fire hazard effects resulting from a release.

Key parameters would include the range of release rates and characteristics which can originate
from any part of the plant. Each parameter would be associated with a failure causing a specific
hole size. The release rate would then vary with time depending upon the source conditions of
fluid, pressure, inventory, location within the hydrocarbon system and the functional characteristics

152-RP-48 Rev 02, Feb 2006 Page 16 of 261

fireandblast.com

(or the failure) of control systems such as ESD, depressurisation, and drainage. A detailed picture
of the source terms from each inventory will allow the identification of the cases requiring analysis
of the fire characteristics. If hazards are being classified as described above, it will give an initial
indication which hazards fall into each category. It would show for example the process events
which simply do not have sufficient inventory to realistically cause escalation, those which should
be controllable and the events which require evacuation. For individual hazardous inventories, it
would show the approximate conditions of hole size and control system operation which would
determine whether it was controllable or require evacuation.

2.2.5.2 Reservoir hazards

Direct releases from the reservoir may occur due to well intervention such as drilling or workover.
In these cases the releases are likely to occur within the drilling facilities; typically at the bell nipple.
These are likely to be of indefinite duration if the primary well control and blowout prevention
systems have failed. Such releases may also contain drilling fluids, cuttings and other debris. In the
case of blowouts from an oil reservoir with delayed ignition, the oil may build up over much of the
top deck leading to a particularly hazardous and unpredictable situation when it ignites. Reservoir
and drilling engineers should be consulted to identify the fluid composition and calculate the
realistic flow rates. In most cases, the releases should be near the top of the platform with the
flames rising above it. This will lead to rapid collapse of the derrick and severe radiation onto the
top deck. It the release is below the drilling rig structure, this may collapse onto the wells leading to
progressive escalation. A shallow gas blowout is another case in which a pocket of shallow gas is
controlled by venting through a diverter. Diverters can fail due to erosion giving a large gas release
of prolonged but finite duration within or below the drilling facilities with possible escalation as
described above. Again drilling and reservoir engineers should be consulted to determine the
possible flowrates and their likelihood.

Large continuous releases from the Christmas Trees are much less likely due to the multiple valve
isolation. They may occur during wire lining but only if there are multiple failures of the barriers. A
more realistic scenario is a release from the lubricator via leakage through the valves and wireline
BOP. In gas-lifted wells, it is possible that the gas within the annulus could backflow into the
wellbay with typical inventories and pressures of up to 10 tonnes and up to 130 bar. The potential
for escalation to other wells should be examined but is unlikely if they are fitted with effective
downhole isolation or have a heavy-duty integrated Christmas Tree valve assembly. Flowline
releases are considered to be part of the process hazards as they are downstream of the well
isolation valves.

Completion failures may result in leakage from the reservoir into the well annuli or around the
cement such that oil or gas may surface round the outside of the well at the seabed. This may
arise during the initial completion of the well. It may also arise in later life due to seismic action or
the deterioration of the well bore, for example by corrosion. Well completion engineers should be
consulted about the possibility of this occurrence, the potential flow rates and the locations at
which hydrocarbons may be released. The effects of fires on or under the sea are discussed in
Sections 5.2.5 and 5.2.6

2.2.5.3 Process hazards

The process plant can have up to 40 sections which are segregated by ESD valves. Each of these
is a source with individual characteristics of the fluids, pressures and volumes. Typically, the
processing will include;

152-RP-48 Rev 02, Feb 2006 Page 17 of 261

fireandblast.com

• Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the
wells via the flowlines, mix the fluids and direct them to the appropriate separators. They
contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and
other materials such as sand. The inventory will be based on the combined volumes of
these pipes. It will range from less than 500 kg in a mature, low pressure gas field up to 5
tonnes of oil for a new field. In oil facilities running at low pressures or using gas lift, the
fluid can be three phase with a relatively low density. It may also have a high water cut
giving small inventories which may not have the potential for escalation if rapidly isolated.
The process conditions, aggressive nature of the fluids and the complexity of the piping
give a relatively high probability of a release, particularly large bore flowline failures which
may be caused by corrosion or erosion. Potential process backflows of gas and 2-phase
fluids from the gas lift inventories into topside blowdown systems also needs to be
addressed when analysing topside hazards.

• Water, gas and oil/condensate separation: This takes place in large vessels, generally over
2 – 3 stages. The liquids have a 3 – 10 minute residence time. Typically, these vessels
have total volumes up to 100 m3 and operate at pressures from 70 down to 3 bar. The
flammable liquid inventories can be up to 30 tonnes but this may be divided in half by weirs
which can reduce the amount which can realistically be released by half. There are
relatively few release points providing that there is effective isolation at the outlet. Typically
these are tappings for instruments and the possibility of corrosion in the body or welds of
the separator vessel. These liquid inventories have the potential to overwhelm a moderate
sized platform with a large fire lasting long enough to cause major escalation, particularly if
the separators are located lower down in the topsides. They may have less of an impact if
located on an open deck such as an F(P)SO as the smoke and flames can freely rise
above the rest of the facility. The potential for harm is governed by the release pressure;
see below under liquid fires. If these vessels are depressurised, the fires become much
more controllable and the time to depressurise is critical. If they can brought below this
pressure before escalation can occur or evacuation is required, this may reduce the
classification of these hazards to the controllable level, at least for moderate sized holes.

The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a very
high pressure vessel with high molecular weight gas. Typically it will be in the 1000 – 2000 kg
range. However this may be doubled by additional gas released from the liquids as the vessel
depressurises. This inventory has the potential to cause local escalation but is unlikely to
overwhelm a medium sized facility. Its potential for harm may be minimised by depressurisation.

• Stabilisation and final dewatering: Some oil production platforms have a final stage of
stabilisation or dewatering. These require large vessels which are filled with virtually stable
oil plus a small quantity of water in the bottom. They operate at 2 – 6 bar and can contain
up to 200 tonnes of oil. These lower pressures would result in a pool fire which would only
be a threat to the platform if there were no arrangements to bund the release, minimising
the size of the fire and further arrangements dispose of the oil and firewater.

• Oil/condensate pressurisation for export: Export pump arrangements may use one or two
pumps in series. These pumps are usually duplicated with manifold arrangements. These
complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field
with large throughput. The most likely releases are at the pumps themselves but the study
of available inventory should carefully examine how much could realistically be released,
taking into account the operating philosophy standby arrangements for off line pumps and
the provision of valves and check valves. The pump pressures will range from 40 – 120 bar
depending upon the pressures within the pipeline infrastructures. Transfer pumps to export
tankers will run at much lower pressures. These pressures will drop to the vapour pressure
of the oil on shutdown, giving a continuous rate of release until the available inventory is
exhausted. The pump seals and the complex jointed piping leak to a high likelihood of a
release. The inherent design of the plant requires the pumps to be located close to the
lowest level of the platform, often beneath the separators. This will lead to a low level

152-RP-48 Rev 02, Feb 2006 Page 18 of 261

fireandblast.com

source with the potential for low level external flaming, smoke affecting most of the
topsides and escalation to the inventories above. Shutdown of the pumps and careful
management of the inventory which can be released will help to reduce the impact but it
may still require evacuation in some cases.

• Gas compression including gas liquids condensing and knockout. Gas from the various
stages of separation is progressively compressed and cooled allowing liquids such as
ethane, propane, butane and water to be condensed and returned to the liquids system.
Typically several compressors will be required with the final discharge pressures of 50 – 60
bar. It is likely that the compressor sections and their associated condensers and knockout
pots will be sectionalised with ESD valves. This reduces the gas inventories to 1000 –
2000 kg. As with separation, this has limited potential for local escalation and this can be
minimised with depressurisation. The major risk is that to personnel in the immediate area
from flash fires or from explosions if the area is congested. There is a moderately high
possibility of a gas leak arising from the compressors and associated vibration.

The liquids which are condensed and collected in the gas knockout pots may be either liquefied
gases or water. The gas-liquid inventories should be less than 2 tonnes and in many cases, just a
few hundred kg. Only the larger inventories will have the potential for escalation. However, there is
a major exposure to flash fires or explosions as these liquids are very reactive, will have a high
release rate and the vapours may not disperse easily. The likelihood of release should be low as
there are few release points in the liquid sections of these process plants.

• Gas drying: This will use either glycol units or molecular sieves and can operate at up to 60
bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this
has a limited potential for local escalation and can be minimised using depressurisation.

• High pressure export, gas lift and reinjection compression: A typical pressure for these
systems is 150 bar. However it can be as high as 400 bar for some reinjection
requirements. Again, the inventories will be moderate; typically 1 – 3 tonnes with the
potential for local escalation. However, the high pressures can give high release rates from
moderate hole sizes, increasing the risks from flash fires and explosions.

• Oil and gas metering: Metering is generally carried out using inline flowmeters. From a
hazard’s point of view, they are equivalent to piping with additional potential release sites
at the instruments. The hazards are similar to the export pumping and compression
respectively and may be part of the same inventory.

Identification of the inventory of each process section should be carried out to determine the
conditions and inventory during operation and immediately after shutdown. The behaviour of each
section should be modelled using simple calculations to determine the gas and liquid release
characteristics from a range of hole sizes. The intent is to build up a picture of the types of events
that can occur in each part of the platform. These scenarios and associated hole sizes should
reflect the failures which have been identified during the causation analysis. They should be
sufficiently varied to cover the following; those large but unlikely cases which give short duration
fires with the potential for the maximum number of immediate fatalities; those small long duration
cases which still have sufficient size to cause local escalation; and those intermediate cases which
have the greatest potential for escalation or platform impact whilst still lasting long enough to
realise these effects – typically a 10 minute duration.

2.2.5.4 Import and export risers

Risers may contain any of the fluids mentioned above, from well fluids to stabilised oil or dry clean
gas. They may be connected to a major pipeline infrastructure or be small infield flow lines from
satellite wells or for gas lift. The risers may be rigid steel or flexible. The releases may range from
pinholes due to corrosion up to a full shear. The location of a release may be as follows:

152-RP-48 Rev 02, Feb 2006 Page 19 of 261

fireandblast.com

• Immediately under the platform;

• Closer to sea level where they may be exposed to ship damage or chafing and corrosion;

• Sub sea or at the sea bed where it may be subject to internal corrosion.

The location will affect the release characteristics and the ignition probability. Release rates from
these pipelines may initially be modelled using simple calculations [2.14], the Sintef and
Scandpower fire calculations for the process industry or using more sophisticated methods. They
should be based upon the hole sizes which could realistically occur as identified in the causation
analysis. The modelling should cover cases with and without the operation of subsea isolation
valves or confirm where these are fitted or considered. They should take into account time delays
in the operation of ESD valves and their operability with a high differential pressure following a
major riser failure. Data such as valve closure times and internal leak rates should be derived from
platform specific datasets. Information from incoming ESD valve trips, routine tests and
maintenance will give a more accurate picture of equipment performance than generic information
from generally available databases. ESD valves would not respond quickly enough to prevent the
immediate fatalities rising from a major gas riser failure unless there was delayed ignition. The
characteristics of pipeline releases from two phase fluids or liquids with dissolved gases should
take into account the variation in release characteristics caused by; gas and liquids separation,
slug flow, the elevation of the release point relative to the main inventory on the sea bed, and
effervescence as gas separates carrying with it liquids in aerosol form. In some cases such as
subsea releases, the fires may burn on the sea surface, see Section 5.2.6.

2.2.6 Types of fire hazard: - Liquids

Liquid fires generally have a greater potential for harm than gas fires for the following reasons:

• They have greater isolated process inventories arising from the higher densities of between
600 and 850 kg/m3. Typically these can be up to 20-30 tonnes in separators.

• The release rates will be much greater than gases for the same hole sizes and pressures.

• The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids,
particularly with dissolved gas can give the same or greater radiative heat flux.

• A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and
this has the potential to completely engulf a medium sized process module and cause
some external flaming. A 20 tonne inventory would sustain this fire for 30 minutes
assuming a constant release rate.

• This confinement with a roof and/or walls will also cause high radiative heat fluxes, even
with pool fires.

• Liquid fires can also be the source of overwhelming quantities of smoke.

• Liquids tend to be located at the lower levels of a platform which causes the fire source to
have a greater impact on the facility, engulfing the levels above and to the sides in flames
and smoke and also leading to the exposure of structures, people and plant above it.

• Liquid releases can be difficult to detect if there is only a small gas content and this can
lead to a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This
can exacerbate the effects by increasing the total fuel quantity, the initial fire size and its
spread into more vulnerable locations.

152-RP-48 Rev 02, Feb 2006 Page 20 of 261

fireandblast.com

• The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards
should be considered carefully to avoid over-conservatism in the fire risk analysis. For
example, some researchers consider that water cuts above 60% make the oil very difficult
to ignite.

These potential effects can give liquids the potential to overwhelm a platform giving many cases
which could be classified as evacuation/extreme, even with moderate pressures and hole sizes on
a poorly laid out facility.

The fire characteristics will vary according to the release pressures and the fuel type. Most oil is
only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also be
pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised gases
above the liquid as in separators; or through pumping. The pressure will determine the release rate
and the management of that pressure after the fire is detected is a key component of managing
these hazards. This may be achieved by isolating the pumps or by depressurisation. The release
rate is proportional to the square root of the pressure and will reduce as these actions come into
effect. Equations for calculating release rates are given in the Handbook for Fire Calculations and
risk assessment in the process industry, by Sintef and Scandpower [2.16], reference should also
be made to the Phase 2 Blast and Fire Engineering for Topside Structures [2.17]. The pressure will
also determine how the liquid will burn, for example, as a spray or a pool. The heat fluxes will drop
with the pressures and this allows deluge systems to become more effective both in protecting
exposed plant and in suppressing the fire itself. This is discussed in Section 7. Lighter liquids such
as condensate will have lower transition pressure. Gas liquids; ethane, propane and butane will be
pressurised and it is unlikely that their operating temperatures will ever be low enough to allow
them to burn as a pool. They are only likely to be found in moderate quantities of 1 – 2 tonnes
within the gas compression and drying facilities. An additional issue to be considered is the
potential escalating effect of flaming “rain out”; this can occur at ambient temperatures, especially
with butane (also propane) and especially for the scenario of jet flame impingement on an
obstruction, Section .2.2.7 discusses further detail of jet fires.

2.2.7 Types of fire hazard: Gas jet fires

Gases will give rise to an intense jet flame with high localised convective and radiative heat fluxes.
The radiative content will increase both with the molecular weight and as the jet encounters
obstructions. They are generally not large enough or sustained by a sufficiently large inventory to
be significantly affected by confinement within a roofed module except where they directly impact
the ceilings or walls. This makes their potential for escalation highly directional and this is likely
only to affect a small number of critical items such as a single structural member, part of a vessel
or some piping. Only very large inventories would have the potential for more widespread
simultaneous failure. These large inventories require both high pressures and large volumes within
the process plant or an isolation failure to a primary source such as a riser or well. Gas jets have
moderate release rates unless there are very large hole sizes and/or high pressures. A 20 mm hole
at 20 barg would give a methane jet of approximately 10 – 12 m and a flame volume of 100 m3.
With a source of 40 m3 in volume, typical of the gas content in a separator, this would reduce to a
jet of 7-8m and a flame volume of 25 m3 within 10 minutes of the ESD operating. If the separator
was depressurised, this would decay even faster but this may be offset by the disassociation of
dissolved gas in the oil.

2.2.8 Types of fire hazard: Confinement and ventilation control

The presence of walls, ceilings, floors and obstructions will significantly affect the way in which air
can mix with the fuel. They will also affect the flame shape. These two factors will change the heat
fluxes, the efficiency of combustion and the density of smoke.

The air requirements for stoichiometric burning of hydrocarbon fires are between 15 and 17 times
the mass burn rate of the fuel. In most cases, this is the release rate unless there is containment of
a pool fire to reduce the burn rate. Most modules have good ventilation and venting to minimise

152-RP-48 Rev 02, Feb 2006 Page 21 of 261

fireandblast.com

gas build-up and explosion overpressures respectively. The air input rate through a single opening
in a wall is calculated using the formula Ma = ½A √H where Ma is the air input rate in kg/sec, A is
the area of the opening in m2 and H is the height of the opening in m. With openings in the floors
and ceilings or multiple openings in the walls of different heights, this becomes a complex
calculation. Typically the fuel burn rate that can be sustained by a module with one open wall of
30m by 8m is 21kg s-1. It is unlikely that severe ventilation limitation will occur unless there is a
very high release rate and this is sustained for several minutes. If it does occur it is likely to involve
a major liquid inventory rather than gas fires. If the ventilation is severely limited, then the
combustion characteristics within the modules will be affected with reduction in heat fluxes,
reduced liquid vaporisation rates, combustion instability, very dense smoke with high
concentrations of carbon monoxide. Unburnt vapours may also burn as they leave the module
giving the external flaming described below. It can take a few minutes before the fire becomes
ventilation controlled as the air inside is used up.

It is more likely that a large fire will not be ventilation controlled but that its size will simply exceed
that of the module. Once the flame volume reaches 1/3 of the free volume in a module (i.e. that
volume up to the top of the highest opening and excluding the volume in between the ceiling
beams), then the flames will spread across the ceiling and begin to extend beyond the module. In
the initial stages of these fires, the flames build up across the ceilings with a hot flame layer slowly
descending across the whole module. This is the neutral plane at which air entering the module
mixes with the vapours. This can descend to 2/3 of the way down the openings in the walls with
significant flame velocities as they travel towards the openings. These areas will have high
radiative and moderately high convective heat fluxes. These will be highest near to or above the
source of the fire but will provide a relatively uniform heating of all structures, piping and upper
parts of vessels above the neutral plane. This is likely to lead to multiple failure of this equipment.
These high fluxes will occur both with pool and spray fires but gas jets are less likely to develop
this module engulfment for the reasons described above. The area between the ceiling beams
becomes stagnant with high radiative but lower convective heat fluxes.

It either the fire is ventilation controlled or the fire size reaches that described above, then external
flaming will occur. With large external flame volumes the width of the base of the flame can be
much wider than the opening. If it originates from the lower modules, it can engulf the whole side of
the platform with wind causing it to tilt, possibly towards the accommodation or TR. This effect is
graphically illustrated in Ref Piper Alpha Inquiry Report part 2 plates14b through to 18a [2.18]. This
will have a major impact upon the whole installation and it is likely to require evacuation if it is
sustained for more than a few minutes. There is only limited understanding of this external flaming
and there are few if any predictive tools to quantify it accurately. Its characteristics may be similar
to a large pool fire, with the flames subject to tilt in high winds [2.16].

2.2.9 Fires on the sea

Fires on the sea will be affected by a number of factors; the fuel, release characteristics, release
rate, the sea and weather conditions. It requires a fairly large release and benign sea and weather
conditions before the fire has a major impact on the facility. This could lead to structural or riser
failure, smoke engulfment of the topsides or the impairment of evacuation. All of the contributing
factors must be examined to determine the risk of failures and benign conditions occurring
simultaneously. This may be very low in the North Sea but not in other parts of the world.

Some development information was prepared in 1992 for the HSE and amongst the treatment of
other fire types; a review of pool fires on liquid was undertaken [2.19].

2.2.10 Consequences

This guidance will generally consider both consequences and impacts, where;

Consequences are the outcome of an accident expressed in physical phenomena such as gas
concentration, thermal radiation level, explosion overpressure, and impacts are the effect of
152-RP-48 Rev 02, Feb 2006 Page 22 of 261
fireandblast.com

accidents on people, structures and equipment. They are undoubtedly linked and the terms may be
occasionally interchangeable.

Fires may result in any of the following consequences and impacts:

• Direct injury or loss of life to personnel exposed to the immediate effects of fire, particularly
flash fire effects;

• The impairment of the ability of people to make rational decisions and to preserve their own
lives, either through the effects of smoke or the psychological effects of the incident;

• Impairment of escape routes and entrapment of personnel so that they cannot return to a
refuge;

• Impairment of the accommodation or temporary refuge;

• Impairment of critical control and communication centres;

• Impairment of evacuation routes and means of evacuation or escape from the platform;

• Further escalation through the failure of process plant, well containment or risers;

• Catastrophic rupture of pressure vessels or containers, both containing flammable and non
flammable fluids;

• The release of toxic materials and the generation of toxic fumes through their combustion;

• The loss of critical safety and communication systems;

• Weakening of the primary structure leading to progressive structural collapse;

• Weakening of secondary structures leading to any of the hardware failures listed above;

The probability and timing of these failures is dependent upon the following:

• The intensity of the exposure. Greater heat fluxes or more dense smoke concentrations will
lead to more rapid failures;

• The degree of exposure: Localised exposure rather than complete engulfment will reduce
the probability and increase the time to failure. The time dependent size of fires such as
decaying gas jets should be taken into account when making this assessment;

• The duration of the exposure;

• The inherent mass, strength and stresses on exposed plant;

• The presence of any protection or insulation which could realistically reduce the rate of heat
transfer;

2.2.11 Developing a set of representative scenarios

There is an almost infinite range of events which can occur on an offshore facility. A representative
selection of scenarios should be selected from each of the hazards which are considered to have
the potential for a major accident. An initial hazard identification and expert judgement will identify
those hydrocarbon sources with the greatest potential for harm and those with a high probability.
These should be subject to more intense scrutiny than lesser risks and any modelling should be

152-RP-48 Rev 02, Feb 2006 Page 23 of 261

fireandblast.com

based on platform specific parameters not generic fire scenarios with particular attention paid to
the uncertainty surrounding two-phase releases.

The events chosen for analysis should reflect the installation’s design features as much as
possible and encompass the following cases

• Those with the greatest potential for escalation; i.e. the largest events with sufficient
duration to cause failure

• Those events which could realistically occur; i.e. those with clearly identified causes giving
failures of an identified maximum size; e.g. the largest tapping size or the dimensions of
typical corrosion failures

• Those events of a critical duration such as the time to cause evacuation

• The characteristics of the events whenever critical control systems such as ESD fail to
operate

The examination of these hazards should be used to build up a complete picture of all of the
hazards; their causes and probability, the range of sizes, location and duration, the possible rates
and timings to escalation and the effects when such escalation does occur. This should be
documented so that everyone with a part to play in their management can see the whole picture.
Once it is in place, the effectiveness of systems to counteract the effects can be assessed and the
future management of these hazards can be planned as described in Section 2.4.3. The analysis is
a living process and should be capable of future use to examine different cases or the optimisation
of control systems such as depressurisation both during design and operation.

2.3 Hazard management principles

• Management responsibilities need to be accurately defined and clear boundaries for roles
and responsibilities set out.

• All fire hazards shall be identified, analysed and understood by everyone with a part to play
in their management.

• Every opportunity to minimise fire risks at source shall be identified, considered and where
practicable, implemented. This shall cover minimising the likelihood, severity and the
exposure of people and plant.

• A practical strategy to manage each of the hazards shall be identified, documented and
implemented.

• An appropriate combination of prevention, detection, control and mitigation measures shall

be put in place to implement the chosen strategies.

• A strategy should take account of sensitivity of the installation’s overall risk profile to fire
hazards and should weight the mitigation and control measures accordingly.

• All of these measures, including people, processes and plant shall be documented, have
clear ownership and shall have minimum performance standards

• All causes shall be identified, understood and sufficient effective prevention measures shall
be implemented. Where the effects of failure could require evacuation of overwhelm the
installation, these measures shall be specifically identified and shall be of high integrity.

152-RP-48 Rev 02, Feb 2006 Page 24 of 261

fireandblast.com

• The operating limits for the whole facility shall be identified and clear instructions as to the
continued operation of the facility or use of additional controls whenever they are
exceeded.

• The systems provided to detect fires shall be suitable for the hazard types and the
environmental conditions. They shall provide sufficient information to warn personnel and
to allow an assessment of the hazards to be undertaken without hazardous personnel
exposure.

• There shall be effective isolation of all major external sources of hydrocarbons including
pipelines and the reservoir. This isolation shall be designed to survive all reasonably
foreseeable fire hazards on the facility.

• The characteristics of those hazards which may require evacuation shall be carefully
studied so that the severity and potential for escalation may be reduced, thereby
minimising the need to evacuate.

• Personnel shall be located so that their exposure to fire hazards is minimised

• The systems provided to protect personnel, plant, structures and safety system shall be
suitable for the fire hazard effects.

• Areas required to shelter personnel from fire effects and their supports shall remain viable
until either the incidents have been brought under control or full controlled evacuation has
taken place.

• A minimum provision of routes, systems and arrangements to allow evacuation shall remain
viable under the effects of every incident which may require them

• All reasonably practical steps to reduce the risks from fires shall be taken, concentrating
first on prevention and thereafter in descending order on control, the prevention of
escalation and evacuation.

2.4 Hazard management systems

2.4.1 General

A structured approach to the management of fire hazards shall be put in place by all organisations
responsible for the design or operation of offshore facilities. This shall ensure that the principles
outlined in Section 2.3. are implemented throughout the lifecycle. It shall fit within the overall safety
management system for that company and shall show the company safety policy is to be
implemented.

The management of fire hazards is a complex process: It requires contributions from a very wide
range of people, plant and processes. These may be required to prevent, detect control, protect or
evacuate. It is not acceptable simply to manage each one in isolation to default standards and to
presume that this will give an effective hazard management system. It in necessary to have a fully
integrated process that ensures that all hazards have the necessary components in place and that
they all work together effectively.

This may be based upon the generic frameworks outlined in HSG 65 [2.20], API RP 75 [2.21] or
ISO 14001 [2.22]. These all use the 5 step process as described in Sections 2.4.2 to 2.4.6.

All of these elements need to be underpinned by a commitment to safety from the organization’s
management at the highest level, with effective leadership to ensure that the above elements are
diligently carried out. The management needs to be aware of the safety policy and aims and
provide the necessary resources to ensure that these aims are fulfilled.
152-RP-48 Rev 02, Feb 2006 Page 25 of 261
fireandblast.com

2.4.2 Policy

Each company should have a coordinated set of policies which cover the principles listed above
and the means by which they are implemented and assured. Policies may be considered at four
levels of increasing detail and specific application:

• Corporate policies: These should set the overall ethos of the company, its overall stance
with respect to HSE and its public expression of commitment to the protection of its
personnel and those with whom it interacts. It should set an overall standard of risk
tolerability. This may be an expression of individual risk covering all types of exposure
including occupational and major hazards risk. The organisation may also choose to set
tolerable risk criteria for major hazards which may result in multiple fatalities. Most
organisations should also demonstrate a commitment to continuous improvement.
Corporate goals may also be set stating how the business should be organised and run in
pursuance of their risk criteria. It may also set minimum standards relating to design and
operations such as the requirements for the use of codes and standards.

• Regional or business policies: These should apply the overall corporate criteria to that
business or region and set minimum standards. This will relate to the development of risk
assessment processes and the criteria for acceptance in a wide range of activities from
discipline engineering applications such as structural assessments and instrument
criticalities to operational criteria such as SIMOPs or task risk assessments. They should
also set the framework for management systems, and set the minimum technical and
operational standards which apply across that whole region of business.

• Facility: Specific policies and standards may be required for an individual facility. This
would result from the assessment of the facility and would apply controls or set minimum
technical requirements so that the risks are kept within the criteria. This may apply to
operational or technical limits

• Specific requirements: These would be the minimum standards for specific items of plant,
competence, or any systems needed to manage hazards effectively.

2.4.3 Planning

Planning covers five specific items and these apply both in design and in operation;

• Identification of the hazards and the analysis to give the understanding outlined in the
principles listed in Section 2.3;

• The development of strategies to manage each of the hazards, identification of the people,
plant and procedures needed to manage them and the setting or confirmation of the
minimum standards for those elements;

• The assessment of the risks from the hazards based on the chosen strategies and the
performance of the elements chosen to reduce risks to ALARP;

• The assessment of the business infrastructure and resources needed to implement the
strategies both initially and thereafter to maintain them;

• The documentation and communication of the hazard knowledge, the strategies and the
measures needed to implement them;

The planning process itself needs to be organised so that the requisite information is available to
promote proactive hazard management; i.e. the understanding of hazards needs to be in place
before key decisions are made rather than using it to retrospectively justify them. In design, this
requires the early development and resourcing of the risk assessment and management process

152-RP-48 Rev 02, Feb 2006 Page 26 of 261

fireandblast.com

through the use of an HSE plan. It also needs commitment from the project managers to ensure
that this proactive culture flourishes and that everyone uses this information to optimise the design.
This includes the discipline engineers, particularly process and layout who have the greatest
opportunities to maximise the inherent safety. The specialist risk and safety engineers should act in
support of these disciplines in furtherance of a safer design rather than as a discrete and
independent group providing data for regulatory compliance. Operations should be well
represented both to provide their knowledge of the causes and risks and to agree the hazard
strategies.

Typically the HSE plan will include each of the following activities for each of the project stages:

Concept development and selection:

• Identification of the primary generic risk drivers; i.e. those that will apply whichever concept
is chosen;

• Identification of different viable concepts;

• Hazard identification and qualitative risk ranking;

• Comparison and selection of the concept.

Front end engineering design, (FEED):

• Update and more thorough hazard identification;

• Initial characterisation of the hazards; cause severity, consequence and escalation;

• Use of the hazard knowledge to optimise the inherent safety during the early process and
layout design;

• Selection of the strategy and primary systems to manage each hazard;

• Selection of scenarios and detailed hazard characterisation (HAZOP, fire analysis,

escalation analysis, vulnerability studies, evacuation and emergency response analysis);

• Setting of the performance standards for each system;

• Risk assessment (This may be quantitative where required but is not essential).

Detail design:

• Design of the systems to meet the performance standards;

• Preparation of the operational procedures.

2.4.4 Implementation

This is the process of putting the hazard decisions into practice and maintaining the minimum
standards throughout the lifecycle. It requires the provision of a business infrastructure both within
direct operations control and to support these operations. This may include but not be limited to
design engineering, integrity management, procurement, HSE, training, emergency response.
Each part of the organisation will make specific contributions to the management of each hazard.
The requirements arising from the planning process should be embedded into each of these
business processes. This should include the identification or cross referencing of critical elements
to the hazards and the assurance that the required performance is correctly documented.

152-RP-48 Rev 02, Feb 2006 Page 27 of 261

fireandblast.com

The operational procedures and controls should be fully developed in conjunction with the
operators. This should cover both procedures to prevent accidents and those to manage the
incidents if they should occur. The emergency response plans should be written in the full
knowledge of the hazards and the timeline of their development.

2.4.5 Measurement

Measurement covers a range of activities. At the higher level, it is the verification that the hazard
identification, analysis and management process is thorough, complete and is of adequate quality.
Thereafter, there should be confirmation that it is working; i.e. that there is a widespread
understanding of risks and hazards, that the linkages between hazards and critical elements are in
place and that the resourcing and infrastructure is sufficient. At a more detailed level it is the
confirmation that the design of the plant is adequate and that the minimum standards of
performance for people, processes and plant are being met.

2.4.6 Review and improvement

Periodic review should examine trends from the measurement processes. It should be carried out
at the levels described, from considering how the overall risks are changing down to the specific
performance history of plant or changes in personnel and their competence. It should then give
structured proposals for investment in future risk reduction.

2.5 Legislation, standards and guidance in the UK

2.5.1 General framework

This section details the major legislation covering risks arising due to fire related hazards. It is not
exhaustive as any legislation covering general safety or requiring a safety risk assessment to be
performed, will be relevant where the potential for a fire exists. Legislation may be added or
amended during the lifetime of this Guidance.

The primary UK legislation governing safety in the workplace is the ‘Health and Safety at Work Etc.
Act 1974’ (HSAWA) [2.23], this imposes a responsibility on the employer to ensure the safety at
work for all employees. Employers have to take reasonable steps to ensure the health, safety and
welfare of their employees.

Various regulations are enacted under the HSAWA. These include the ‘Management of Health and
Safety at Work Regulations 1999’ [2.24], which places an obligation on the employer to actively
carry out a risk assessment of the workplace and act accordingly. Risks assessed will include
those from fire and explosion. It should be noted that the Management of Health and Safety at
Work Regulations were amended at the start of 2005 to address issues of employee consultation
and are now referred to as SI 2005 [2.25] Management of Health and Safety at Work and Health
and Safety (Consultation with Employees) (Amendment) Regulations 2005 [2.26]. All technical
issues relating to hazard management are unchanged within the regulations.

2.5.2 Offshore regulations

More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and
Emergency Response on offshore installations (PFEER) [2.27] regulations which place on the Duty
Holder the requirement to take appropriate measures to protect persons from major hazards
including fires and explosions. These measures include identification of fire and explosion hazards
and the evaluation of their consequences and likelihood (Regulation 5). Regulations 9 to 12 specify
the types of measures which are required for prevention, detection, communication and control of
emergencies. The regulations also require mitigating measures to be specified and put in place
and for performance standards to be set for safety critical measures to prevent, control and
mitigate explosion hazards.

152-RP-48 Rev 02, Feb 2006 Page 28 of 261

fireandblast.com

The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur in
the case of an explosion event (Regulations 14 to 17).

The Safety Case Regulations (SCR) [2.28] require all installations in UK waters to have an
acceptable Safety Case. Information regarding the following issues is required to be addressed in
the Safety Case:

• Identification of major hazards;

• Evaluation of risks associated with the identified hazards;

• Details of appropriate measures taken to reduce these risks to as low a level as is

reasonably practicable;

• Details of the Duty Holder’s (Safety) Management Systems.

The Design and Construction Regulations DCR [2.29] amended the SCR by placing a
responsibility on duty holders to prepare a suitable verification scheme for their installations to
ensure independent and competent evaluation of those elements of the installation which are
critical to safety (known as safety-critical elements, SCEs). Performance standards are used to
define the functionality and integrity of these safety critical elements. They will define how these
SCEs are expected to function during and after explosion events.

2.5.3 APOSC

The ‘Assessment Principles for Offshore Safety Cases’ document (APOSC) [2.30] provides open
guidance for Duty Holders on the basis by which HSE inspectors would assess safety cases. The
APOSC provides clarifications on issues which may not have been clear from the regulations and
associated ACOP where available. The APOSC document advises that the following should be
demonstrated for Major Accident Hazard assessments to an HSE inspector’s satisfaction:

Acceptable safety cases will demonstrate that a structured approach has been taken which:

• Identifies all major accident hazards (paragraphs 38-48);

• Evaluates the risks from the identified major accident hazards (paragraphs 49-74);

• Describes how any quantified risk assessment (QRA) has been used and how uncertainties
have been taken into account (paragraphs 75-82);

• Identifies and describes the implementation of the risk reduction measures

(paragraphs 83-89);

• Describes how major accident risks are managed (paragraphs 90-112);

• Describes the evacuation, escape and rescue arrangements (paragraphs 113-144).

The structured approach listed above is generic, so that there are no specific requirements for how
an assessment of fire hazards should be carried out.

2.5.4 Fire and explosion strategy

The HSE have recently compiled and published issue 1 of a Fire and Explosion Strategy [2.31] to
illustrate their approach. The overall objective of the document is to identify the areas which OSD
has identified as requiring possible future work to address significant areas of uncertainty in fire
and explosion issues on offshore installations. The document covers a number of areas of
relevance to this guidance, the topics covered briefly in the strategy document are:

152-RP-48 Rev 02, Feb 2006 Page 29 of 261

fireandblast.com

• Fluid characteristics (often referred to as “Source Terms”);

• Ignition;

• Fire and gas detection;

• Dispersion and ventilation;

• Fire and explosion hazard assessment;

• Fire and explosion consequence assessment;

• Prevention, control and mitigation of fires and explosion.

The more detailed scope covered by the strategy document is as follows:

• Provide an introduction to each topic area, e.g. describing the scope of the review, the
nature of the hazard etc (as appropriate to the topic area);

• Describe the significance of the topic with regard to the risk of major accidents on offshore
installations;

• Summarise current knowledge of the topic (i.e. reference to completed and on-going
research, standards, codes of practice, design guidance etc);

• Summarise existing modelling capabilities (as appropriate to the topic area);

• Based on the results of the knowledge summary and the model capabilities above, identify
areas of uncertainty;

• Summarise current industry practice (i.e. reference to approaches taken in Safety Cases,
extent of implementation of existing codes, guidance etc, awareness of issues);

• Summarise areas identified to potentially be carried forward as part of OSD 3’s strategy
development.

The strategy document emphasises that individual topics are subject to continuous change and
their priority is not addressed in the strategy document.

2.5.5 Codes, standards and guidance

Guidance documents are available from the Health and Safety Executive for the legislation
mentioned above. However there is little guidance, apart from ISO 13702 [2.5] and PFEER [2.27],
relating specifically to the design of installations against fire hazard events. The most relevant are
the Interim Guidance Notes (IGN) [2.1]] for which this Guidance represents an updated publication.
Various codes, standards and guidance are available covering elements related to the fire hazards,
(it should be noted that explosion incidents will often be followed by fire, hence the guidance below
incorporates some references to explosion hazards as well). Some of the widely used standards
are listed below.

For ignition prevention and Hazardous Area Classification:

• Institute of Petroleum, ‘Area Classification Code for installations handling flammable fluids’,
August 2002, (IP15) [2.32];

152-RP-48 Rev 02, Feb 2006 Page 30 of 261

fireandblast.com

• The ATEX (Atmospheric Explosion) Directives 94/9/EC [2.33] and 1999/92/EC [2.34]cover
electrical and mechanical equipment and protective systems, which may be used in
potentially explosive atmospheres;

• BS EN 60079-10. ‘Electrical apparatus for explosive gas atmospheres Part 10.

Classification of hazardous areas’, [2.35];

• For equipment in hazardous areas ‘BS EN 1127-1: 1998 Explosive atmospheres [2.36].

• BS 5958: 1991 ‘Code of practice for control of undesirable static electricity’, [2.37].

These documents only cover operational leaks rather than accidental releases. They do not define
the extent of hazardous areas from the point of view of explosion and fire risk.

Alongside UK legislation, EN ISO 13702 [2.5] also addresses the need to develop a fire and
explosion strategy (FES) which describes the role, essential elements and performance standards
for each of the systems required to manage possible hazardous events on the installation.

Guidance on the demonstration of ALARP is available throughout this Guidance and from the
following sources:

• Policy and Guidance on reducing risks to ALARP in Design [2.38],

http://www.hse.gov.uk/dst/alarp1.htm;

• Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced
Risk as Low as Reasonably Practicable [2.39]. http://www.hse.gov.uk/hid/spc/perm12.htm:

HSE Books have published a guide which sets out an overall framework for decision taking by the
HSE (“Reducing Risks, Protecting People”), which is available in hard copy form [2.40] and as a
free download from http://www.hsr.gov.uk/dst/r2p2.pdf:

HSE guidance relating to Gas Turbine enclosures is relevant as the principles mentioned are
applicable to explosions in general:

• ‘Control of Risks at Gas Turbines Used for Power Generation’, Guidance Note PM84 HSE,
[2.41].

Further details on legislation, standards and guidance can be found in Annex C.

2.6 Inherently safer design

2.6.1 Introduction

Having determined the installation concept it is necessary to manage fire and explosion risk within
the constraints imposed by the subsequent offshore layout.

The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures, systems
or human intervention to protect personnel.

All control systems have the potential for failure to operate as intended – generally expressed as
the probability of failure on demand. Critical loops are designed according to their criticality in
mitigating personal, environmental or commercial risk by setting a Safety Integrity Level (SIL). In
setting a SIL it is acknowledged that there is failure potential although this is designed to be
inversely proportional to the importance of the loop in risk mitigation.

152-RP-48 Rev 02, Feb 2006 Page 31 of 261

fireandblast.com

There is always the potential for the systems to be damaged in a hazardous event. Inherent safety
avoids this potential by aiming for prevention rather than protection and the preference for passive
protection over active systems.

It is particularly important to follow Inherently Safer Design principles where the consequences of
process release or system failure are high. Where it is possible to reduce the reliance on
engineered (active or passive) safety systems or operational procedures this should be done.

The Inherently safer design approach is contrasted with the process design spiral in Figure 2-1 .
The result of the application of the Inherently Safer Design approach is reduced complexity and a
reduced requirement for human intervention, resulting in a simpler more robust system.

152-RP-48 Rev 02, Feb 2006 Page 32 of 261

fireandblast.com

Enhanced
Monitoring Requirement

More Complexity
More Maintenance
more leak sources
Intervention

Duplication to increase
redundancy More Instrumentation
Automation

More Safety
Systems

Process Design Spiral

Reduced Monitoring
Requirement

Less instrumentation
Less Automation
Reduced Complexity
fewer leak sources

Reduction
reduced inventories

Less Maintenance
Less Intervention

Attenuation
Substitution

Increased
Robustness

Inherently safer
Design Cycle

Figure 2-1 Comparison between the process design spiral and the inherently safer design
cycle

2.6.2 Goals of inherently safer design

The goals of inherently safer design [2.42] are to avoid the hazard and maintain safe conditions
through inherent and, where appropriate, passive design features; and to minimise the sensitivity
of the plant to potential faults as far as can be reasonably achieved.

152-RP-48 Rev 02, Feb 2006 Page 33 of 261

fireandblast.com

This implies that the plant response to the fault should satisfy the following criteria in order:

• The response produces no operational response or results in a move to a safer condition;

• Passive or engineered safeguards should be continuously available and should make the
plant safe;

• Active engineered safeguards activated in response to the fault should make the plant safe.

2.6.3 Approaches to achieve the goals of inherently safer design

In Inherently Safer Design the following processes are commonly employed [2.43]:

• Reduction – reducing the hazardous inventories or the frequency or duration of exposure;

• Substitution – substituting hazardous materials with less hazardous ones;

• Attenuation – using the hazardous materials or processes in a way that limits their hazard
potential, e.g. storage at lower temperature or pressure;

• Simplification – making the plant and process simpler to design, build and operate hence
less prone to equipment, control failure and human error.

The application of the above principles should result in:

• Fewer and smaller hazards;

• Fewer causes;

• Reduced severity;

• Fewer consequences;

• More effective management of residual risk.

In order to implement the principles, contributions will be required from all levels of the project
team. Managers should show leadership in the focus on safety, discipline engineers will be
involved in concept choice, plant layout, and engineering detail and safety specialists must make
the options visible and available to designers and document the process.

152-RP-48 Rev 02, Feb 2006 Page 34 of 261

fireandblast.com
Table 2-1 summarizes the major ‘inherent safety’ and control features necessary to achieve the
goals stated above:
Table 2-1 Inherent safety features to achieve goals
Goal to minimise fire risk
Benefits of good layout (including
partitioning effects or not)
Minimisation of Potential Leak
Sources/Release potential
Minimisation of Ignition Potential
Minimisation of POB Exposure to
Fire Effects
Minimisation of Hazardous
Inventory
152-RP-48 Rev 02, Feb 2006
Inherent safety features to achieve goal
• place equipment, utilities and personnel areas along a clear
hazard gradient
• where possible use as much segregation as possible to limit
escalation
• avoid congestion in process areas
• place safety critical equipment in uncongested areas where
possible (limits vulnerability to high explosion loads)
• use height between floors to provide ventilation space (cheap
volume)
• identify measures required by fire and explosions and balance
benefits from measures for each hazard category
• minimise number of pipe joints
• maximise welded pipe joints
• minimise invasive instrumentation
• eliminate/minimise small bore pipework
• minimise offshore processing and process complexity
• minimise vibration
• minimise corrosion/erosion
• ensure effective inspection
• ensure there are no naked flames in live plant
• audit and review safety management system with respect to
hot work procedures
• insulate hot surfaces (where inspection is not critical)
• ensure effective earth bonding
• implement hazardous area zoning (area classification)
• ensure an effective maintenance regime
• separate quarters and non-operational personnel from process
areas
• minimise maintenance requirements
• remote operation of processes
• simplify the offshore process
• introduce separate accommodation platforms
• use fully rated fire barriers and protect non-redundant primary
structure
• provide multiple escape routes from each hazardous area
• introduce structural redundancy
• simplification/minimisation of offshore processing
• use of small isolatable inventories
• effect isolation from large inventories upon gas/leak detection
• ensure effective blowdown of inventories
Page 35 of 261
fireandblast.com

Goal to minimise fire risk Inherent safety features to achieve goal

Minimisation of potential release
mass and severity of
consequences
Monitoring and maintenance of
SCE integrity/functionality
Maintain Effective Management of
residual risk
• minimise inventory pressure and potential leak rate
• minimise hazardous inventory
• minimise module size, segregation of release sites from
ignition sources and personnel – compartmentalisation
• Minimise congestion and the possibility of obstructed fires
• Improve natural ventilation (to reduce ignition probability, avoid
re-circulation and external flaming)
• Consider the use of subsea completions
• implement an effective inspection programme
• introduce effective maintenance procedures
• minimise the exposure of the TR and SCEs to smoke and heat
• improve SCEs resistance to thermal effects
• protect SCEs from severe vibration effects
• protect SCEs from structural displacement effects
• separate process areas from critical non-hazardous areas
• safety leadership and focus
• implement an effective safety management system
• pursue prevention rather than protection
• use passive systems of control and mitigation in preference to
active systems

The above table details inherent safety and control features that minimise the potential for fires to
occur, or if a fire should occur, that minimise the consequences and risk to personnel. These
features should ideally be built into the early design of the installation, rather than being included
as mitigation measures at a later date.

Inherent safety practices must be maintained throughout the life of the installation continuing
through the operational phase by adherence to effective inspection and maintenance regimes and
by ensuring that management systems and related procedures are followed.

The benefits of the inherently safer design approach are that hazards and risks are tackled at
source. There is an opportunity for cost effective risk reduction (at an early project phase). The
approach will normally result in easier and more reliable plant and often results in reduced through
life costs.

2.6.4 Effective management of residual risk

The risk which cannot be eliminated or prevented by the application of inherent safety methods is
referred to as residual risk. Inherent safety methods can also be applied to the management of the
residual risk by consideration of the general principles indicated below:

CONTROL is better than

MITIGATION is better than
EMERGENCY RESPONSE.

As regards systems to reduce risk;

PASSIVE systems are more reliable than

ACTIVE systems are more reliable than
OPERATIONAL systems are more dependable than
EXTERNAL systems

152-RP-48 Rev 02, Feb 2006 Page 36 of 261

fireandblast.com

This indicates that the use of passive rather than active control and mitigation systems is preferred
and that reliance should not be placed on personnel to prevent, control or mitigate hazards if
avoidable.

This process is illustrated in Figure 2 - 2 below.

Understand Cause &

Severity Escalation Exposure
Hazards Likelihood

M inimise each at source

Strategy
Prevent
? Control
M itigate
Evacuate

System
Passive
Choice? Active
Operational
External

System
Role, Functionality, Criticality, Survivability
Performance?

Risk

No
Is it good
enough?

Yes
Proceed with
Detailed Design

Figure 2 - 2 Risk Reduction Flowchart

2.6.5 Constraints and limitations of inherent safety

Ideally the inherently safer design approach should be applied throughout the project duration and
continue throughout the life of the installation.

At the concept choice stage the selection of a safer concept should be paramount. At the
preliminary engineering phase layout should be designed with the intention of reducing the severity
and consequences of major hazards. At the detailed engineering stage systems should be
designed to reduce the likelihood and severity of the hazard.

If the method is not applied from the start then it may not be possible, cost effective or effective in
risk reduction terms to modify the plant to conform to the ideals of inherently safer design.
Intervention may give rise to an additional hazard which must be assessed and should not
compromise the gains to be achieved by the modifications.

152-RP-48 Rev 02, Feb 2006 Page 37 of 261

fireandblast.com

It may not be reasonably practicable to apply retrospectively to existing plant, what may be
demanded by reducing risks to ALARP for a new plant and what may have become good practice
for every new plant.

The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still be
less than 10-3 per year. If risks are in this intolerable region then risk reduction measures must be
implemented, irrespective of cost.

There may be some conflict between the various approaches employed to improve inherent safety.
For example, increased compartmentalisation will generally reduce the size of a potential ignitable
gas cloud and the number of potential ignition sources, however this may decrease the potential
for natural ventilation, increase confinement and give rise to obstructed or ventilation limited fires.
The balance between such features needs to be considered.

Corrosion under insulation is a major cause of line failure and high operational cost; hence
insulation may be inappropriate as an ignition source reduction measure and as a process
protection measure. Insulation may actually increase the temperature of enclosed inventory or the
surfaces being protected.

There will also be a balance to be struck between reduced complexity and redundancy/duplication
of systems. Economic requirements may make such duplication necessary and may actually
reduce the required intervention.

Whilst it is generally beneficial to reduce in-line instrumentation, instrumentation associated with

autonomous systems such as deluge and leak detection systems should not contribute to the
likelihood of a release and hence this instrumentation is bound to be beneficial, unless the
maintenance requirements and instrumentation failure consequences increase the risk. A strict
adherence to the principles of inherently safer design may, in some circumstances, increase the
overall risk.

2.7 Risk screening

2.7.1 General

The higher the life safety risk (or risk to life) on an installation or within a compartment/module the
greater should be the rigor that is employed to understand and reduce that risk.

Where the risk associated with an outcome is low, any inaccuracies in determining that risk will
also be low in absolute terms. The effort expended should be proportional to the risk. It is important
therefore to have a means of early estimation of the risk level of an installation to determine the
appropriate approach to be used in installation fire assessment.

The approach to fire assessment needs to be decided early in the design process when absolute
values for release frequency and detailed consequence analysis are not available.

Risk is the product of consequence and frequency of occurrence. This risk can be calculated as a
numerical value expressed as individual risk (IR) or in terms of a value for the installation such as
Potential Loss of Life (PLL). Where quantitative values are not available a qualitative measure of
risk can be estimated to a degree of accuracy sufficient to make a decision on the assessment
approach to be adopted.

Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.

At a later stage in a design project a 5 x 5 risk matrix may be appropriate for risk acceptance.
However at an early project phase the increased number of boundaries between consequence and
likelihood classes may be difficult to identify and assign.

152-RP-48 Rev 02, Feb 2006 Page 38 of 261

fireandblast.com

A simple approach which is frequently adopted for qualitative risk assessment uses a 3 x 3 matrix
of potential consequence versus likelihood of a fire event is described in this section.

2.7.2 Consequence severity

The consequence side of the matrix comprises an assessment of the effects of credible fire
scenarios including escalation.

A major risk lies in effects such as oxygen depletion and radiation from flames and the emission of
hot gases. It is more likely that the major consequences will involve escalation, such as:

• Fires resulting from loss of inventory from damaged equipment, supports, pipework and
vessels;

• Structural failure;

• Inaccessibility of means of escape and/or evacuation.

For a long duration fire there is a risk to those who attempt to tackle the fire.

For the installation under consideration the direct and indirect effects of fires should be identified.
This should be achieved by assessing parameters such as:

• The vulnerability of Safety Critical Elements to thermal loads;

• Occupancy of the area immediately affected;

• Vulnerability of people in adjacent areas;

• The relative location of the TR;

• The suitability of the layout;

• Hazardous inventories, both isolatable and non-isolatable;

• The operating and control philosophy influences the extent of operator intervention and the
potential for human error and inventory loss.

Low consequence outcomes would be predicted where the radiation levels are predicted to be
relatively low and immediate and delayed consequences are also low. The fire extent and duration
may also be predicted to be small. The equipment count would probably be low, being limited to
wellheads and manifold with no vessels (i.e. no associated process pipework) resulting in low
inventory and congestion. Segregation should separate release sites, people and ignition sources
with low confinement and good access. Manning would be consistent with a normally unattended
installation with a low attendance frequency, for example, visiting less frequently than 6-week
intervals, such visiting intervals by maintenance or intervention crews, results in an occupancy rate
of about 1 %.

A medium consequence installation would be typically a platform or compartment which is well

segregated with a low manning level consistent with a normally unattended installation.
Congestion, typified by the amount of equipment installed, will be greater than for the low
consequence case. Manning would be consistent with a normally unattended installation with a
moderate attendance frequency, more frequent than 6-weekly. Alternatively, a medium
consequence installation may be a processing platform necessitating permanent manning but with
low escalation potential to quarters, utilities and control areas which are located on a separate
structure.

152-RP-48 Rev 02, Feb 2006 Page 39 of 261

fireandblast.com

A high consequence installation would encompass remaining installations and compartments

where there is significant processing on board leading to significant congestion (high equipment
count) and potential confinement with populated areas within the consequence range of escalation
scenarios. This may typically be characterised by a PDUQ/PUQ installation (jacket, semi-sub,
jack-up or F(P)SO) with quarters on the same structure as the process.

Where there is doubt regarding the category into which an installation should fall, it is
recommended that the category with next higher consequence is used.

2.7.3 Likelihood

The likelihood of a significant fire will depend upon the likelihood of occurrence of a large release
and ignition. The following parameters will influence the potential likelihood of a fire:

• Hazardous inventory complexity, i.e. the number of flanges, valves, compressors and other
potential leak sources;

• The type of flanges, valves or pipework. Some generic types of flange tend to have lower
leak frequencies associated with them, e.g. hub type flanges;

• The number of ignition sources within the flammable region of a potential spray release,
gas or vapour cloud;

• The ventilation regime;

• The equipment reliability and the maintenance philosophy.

The likelihood considerations tend to align closely with the consequence factors in that the low
consequence installations will tend to be small and therefore less complex. Large installations will
have more potential leak and ignition sources and therefore a greater requirement for intervention
and maintenance.

Low event-likelihood installations and compartments will have a low equipment count. The
frequency intervention period of 6 weeks or more is also recommended as a criterion as this will be
a surrogate for equipment count and reliability as well as a measure of maintenance risk with
respect to an ignited release.

Medium event-likelihood is suggested by an NUI with equipment count greater than for the ‘low’
case. Similarly, where the planned frequency of maintenance/intervention is greater than a 6-
weekly basis then this suggests a higher or less reliable class of equipment with medium level of
potential for an ignited release.

Where the complexity of the process in a compartment requires a permanently manned installation
this suggests a high equipment level, high congestion and therefore potentially a fire event of high
likelihood, a large number of potential leak sources and high ignition potential.

Where there is doubt regarding the category into which an installation should fall, it is
recommended the category with next higher likelihood is used.

2.7.4 The risk matrix

Continuing with the Low, Medium and High basis, the risk categories can be assigned for the
installation is assigned using a 3 x 3 risk matrix, as shown below:

152-RP-48 Rev 02, Feb 2006 Page 40 of 261

fireandblast.com

Consequence
Low Medium High
High Medium risk High risk High risk
Frequency/ Medium Low risk Medium risk High risk
Likelihood
Low Low risk Low risk Medium risk

Figure 2-3 Risk matrix – determination of risk category

The risk category determines the level of sophistication required for the assessment (low, medium
or high). Levels of structural analysis are discussed in Section 3.7.

The level of risk screening discussed above is scenario independent. The risk level for each
scenario may be made using the risk matrix if representative ranges of frequency and severity can
be attached to the likelihood and consequence categories.

2.8 Risk reduction

Risk management and reduction is an integral part of the Health, Safety and Environmental
Management System (HSEMS) of any organisation or project. The HSEMS provides the overall
framework within which all risks (not just fire related) should be managed.

To assess and manage the risks arising from a specific operation especially with respect to a
specific hazard category it is necessary to recognise the requirements of the HSEMS on the risk
management process (e.g. in determining acceptable levels of risk) and to implement the
processes that contribute to the risk management.

As part of the processes contributing to risk management, an assessment and implementation

programme for dealing with risk reduction measures should be in place. The risk reduction
measures include preventative measures (i.e. likelihood reducing) and mitigation measures (i.e.
consequence reducing). The detailed definition and specification of these measures form
significant components of design codes and standards. Where appropriate, risks can also be
significantly reduced by the adoption of inherently safe designs as discussed in Section 2.6.

In identifying candidate risk reduction measures, consideration should be given to the full range of
measures involving inherently safer design, prevention, detection, control and mitigation.

The risk reduction measures considered may range from items of equipment and physical systems
through to operational procedures, managerial structures and planning.

It is worth emphasising that the UK regulator will expect to see the following demonstrations for
risks lying below the maximum tolerable, but above the broadly acceptable level:

• That the nature and level of the risks are properly assessed and the results used to
determine control measures;

• That residual risks are not unduly high and have been kept ALARP;

• That the risks are periodically reviewed to ensure that they still meet the ALARP criteria.

Duty holders should not assume that if risks are below the maximum tolerable level, they are also
ALARP. This should be demonstrated through the application of relevant good practice and sound
engineering judgement; and the consideration of further measures that can be adopted to reduce
risks to ALARP. The degree of rigour of the ALARP demonstration should also be proportionate to
the level of risk associated with that hazard category on that installation.

152-RP-48 Rev 02, Feb 2006 Page 41 of 261

fireandblast.com

A number of example risk reduction measures that have been used in submitted safety cases (data
collected up to 2001) has been tabulated in the HSE publication, “Fire, Explosion and Risk
Assessment Topic Guidance”, Issue 1, February 2003. This table is reproduced below.

For full document see http://www.hse.gov.uk/foi/internalops/hid/manuals/pmtech12.pdf

Table 2-2 Examples of risk reduction measures implemented on existing installations

Type of measure Description of measure

Prevention (i.e. Leak prevention

reduction of 1. Removal or strengthening of small bore pipework connections
likelihood) 2. Isolation of disused wells at production header as well as Xmas tree and venting
of flow lines back to tree
3. Decommissioning of redundant equipment
4. Improvements to systems of work
5. Implementation of competence management and assurance system
6. Improvements to PTW system
7. Improvements in integrity assurance
Ventilation
8. Removal of wind walls
9. Enhancement of HVAC in process modules
Ignition control
10. Monitoring of gas turbine exhaust system temperature
Detection (i.e. Gas detection
transmission of 11. Installation of ultrasonic leak detectors
information to 12. Installation of additional IR beam detectors
control point)
Fire detection
13. Installation of additional fire detectors
Control (i.e. Emergency shutdown (ESD) systems
limitation of scale, 14. Installation of high integrity check valve on gas re-injection header
intensity and
duration) Blowdown and flare systems
15. Installation of additional blowdown valves
Explosion control
16. Initiation of water deluge on detection of gas
17. Removal of redundant equipment
Mitigation (i.e. Active fire protection
protection from – Replacement of deluge system piping
effects)
Passive fire protection
– Uprating of fire walls
Blast protection
– Uprating of blast walls
Temporary Refuge
– Re-location of Main Control Room to TR
– Re-definition of TR
– Enhancement of mustering facilities
– Protection of external staircase
– Provision of airlock doors
– Provision of dedicated HVAC system for TR
Evacuation and escape
– Installation of additional emergency lighting on escape route
– Provision and maintenance of proper training in the use of evacuation and escape facilities
– Provision of alternative escape routes

152-RP-48 Rev 02, Feb 2006 Page 42 of 261

fireandblast.com

Type of measure Description of measure

Mitigation (i.e. Fire-fighting equipment

protection from – Installation of new foam monitors
effects) Manning
contd. – Reduction of POB

2.9 Human factors

The influence of Human Factors in the control of and response to fire hazards and fire hazard
management systems is significant and must be considered in the assessment of hazards and the
design of control and mitigation systems.

The Human Factors issues covered within this guidance document summarise two areas of
application; reference should be made to Section 6.7 “Personnel”, covering the impact of fires on
people and Section 7.4 for “Human Factors - Man/Machine Interface”.

The response of personnel to fires covers the effects of heat, radiation, smoke and other toxic or
debilitating products of combustion. These issues are discussed in detail in Section 6.7 along with
a summary of the timeline of the harm criteria that develop along with the escalating hazard.

The ability of the workforce to safely and effectively manage and maintain the detection and
mitigation systems for fire hazards is described in more detail in Section 7.4. The considered
design of the man machine interface for these safety critical systems is a major contributor to
success in meeting a hazard. The issues of ergonomics, working environment and clarity of
supplied information are discussed along with some indications of appropriate analysis techniques
to assist the designers and operators.

152-RP-48 Rev 02, Feb 2006 Page 43 of 261

fireandblast.com

3. Fires on offshore installations

3.1 Introduction
In order to successfully implement the appropriate protective mechanisms for fire hazards, it is
essential (and obvious) to understand what element or area is being protected and what event the
designer is protecting against. Therefore, the protective measures can only ever be effective when
an assessment is carried out of the potential fire hazards. This step is required by the fire and
explosion risk analyses (FERA).

Some preliminary guidance on describing the unfolding scenarios is given in the following sections.

3.2 Fire types and scenarios

3.2.1 Release events

To establish which fire scenarios should be considered as part of a QRA of an installation, it is first
necessary to consider the range of incidents that may lead to an uncontrolled release of flammable
material which, if ignited, would give rise to a fire. In this context, relevant questions concerning
potential release scenarios are:

• WHY did the release occur?

• WHAT is released?

• WHERE did it occur?

The answers to these questions combine to determine the type of fire that may result, the likely
size of the fire and its potential impact on people and the installation. Considering each in turn:

WHY: The answer to this question will establish the size of the leak and influence the likelihood of
ignition. For example, has the leak occurred due to a leaking flange joint or as a result of a
preceding explosion event? A range of sizes should be considered from small leaks at flanges and
fittings up to major failures of vessels and risers which result in very high release rates. The leak
rate may also change with time and may have a limited duration. Failure frequencies for different
sizes of event should be taken into account; generally small leaks will be the most common.
Release failures should be based on platform specific information where possible, and Duty
Holders are encouraged to collect, analyse and use failure rate data based on their own
maintenance systems and practices. The reason why a failure is being considered may also
influence the likelihood of ignition, for example, if a vessel failure is being considered as a result of
a preceding explosion or fire attack then ignition is almost certain, whereas a small leak of high
pressure gas generated as a result of a leaking flange may not interact with a potential ignition
source. Ignition probabilities also depend on fuel type, for example, a spillage of diesel onto a cold
surface is not readily ignited.

WHAT: The nature of substance being released will also influence the type of fire that results. A
non-volatile liquid spillage may result in a pool fire whereas a high pressure gas release may
produce a jet fire. Apart from process fluids, other flammable substances are likely to be stored
and used on an installation for use in service roles. Potential fluids to be considered are:

• Natural Gas – dry or containing condensate and/or water;

• Condensate – unstable or stabilized;

• Live crude –possible including a significant amount of water;

152-RP-48 Rev 02, Feb 2006 Page 44 of 261
fireandblast.com

• Transport fuels - Aviation fuel, Diesel;

• Process fluids – Methanol, Ethylene Glycol;

• Lubricants and hydraulic fluids.

In addition, some of the gas and oil streams may include hydrogen sulphide, which may require
special consideration because of its potential to produce toxic products or be toxic if unignited.

WHERE: Where the leak occurs will also influence the type of fire that results. In particular, is the
fire likely to be in an open or confined area and what is the potential for the fire to impact onto
pipework or vessels that may also contain flammable material, or indeed other critical targets (e.g.
other safety critical elements, control systems etc.)? The latter question is important with regard to
the potential for incident escalation. Some fires may occur at a location away from the source of
the leak, for example, liquid spills which may spread to other areas or even spill onto the sea. The
location of the fire will also influence its likely consequences; hence fire scenarios at a range of key
locations should be addressed in the QRA. In particular, fires that are close to where people work,
which could affect escape routes, Safety Critical Equipment, the Temporary Refuge or key
structural components.

Having selected and defined a release event giving rise to a fire, this fire and its effects may well
change and develop with time depending on the prevailing circumstances. The following factors
may affect fire behaviour and/or the consequences:

• ESD: Assuming the ESD operates the volume of the isolatable volumes will affect the
duration of the larger leak scenarios and result in a transient fire size, reducing with time.

• Blow-down: Similar to ESD operation, this could result in a transient release rate.
Additionally, blow-down may reduce the consequences of the fire scenario by
depressurising a vessel or pipework onto which a fire is impacting, thereby preventing
escalation.

• Confinement: Fires in confined areas with limited ventilation may change over time, for
example, become progressively more severe as ‘external flaming’ occurs, when the fire
moves through the ventilation openings.

• PFP: The use of passive fire protection may not affect the nature of the fire but will affect
the response of objects subjected to fire attack and delay or prevent incident escalation.

• Deluge: Depending on the fire type, active water deluge systems (area and dedicated) may
affect both the nature of fire and the thermal loading to engulfed objects and in most cases
will be beneficial to escaping personnel.

3.2.2 Ignition

The likelihood of ignition is clearly an important factor to consider for any QRA and will also be
dependent on the answers to the WHY, WHAT, WHERE questions above. Some fuels are more
easily ignited than others and the manner of spillage may affect its flammability (for example oil
spills onto the sea are often not readily ignitable and additionally are likely to be distant from
common ignition sources on an offshore installation.

Ignition sources such as electrical fault, electrical arcs (for example across switch contacts),
sparks, high temperature surfaces, flames and electrostatic discharge should be considered and
the proximity of such sources will vary at different locations on an installation (see also
Section 2.2.4)

152-RP-48 Rev 02, Feb 2006 Page 45 of 261

fireandblast.com

3.2.3 Fire scenarios

Given that ignition has occurred, the answers to the WHY, WHAT, WHERE questions above also
determine the nature of the initial fire and how the fire may subsequently develop. Typical answers
to these questions include:

WHY WHAT WHERE

1. Leaking
In open module in open
flange, small High pressure gas
area or congested region
fitting or valve
2. Pipework
failure from
impact or
Pressurised volatile liquid In confined area
corrosion or
preceding
event
3. Equipment Pressurised gas/liquid
Spillage onto sea
failure mixture
4. Vessel
rupture or
collapse
following Non pressurised,
From subsea source
explosion, non volatile liquid
structural
collapse or
fire event

By considering combinations of these answers the fire type can be determined. Further detail of
this interrogation process can be found in Sections 2.2.3 and 2.2.5. Three examples are as follows:

WHY WHAT WHERE FIRE TYPE

Jet fire with
High pressure In an open sided potential impact
1 Leaking flange joint
natural gas module onto pipework and
vessels
Fire attack on
Gas and volatile
2 pressurised vessel On the installation BLEVE - fireball
liquids
leading to failure
On the installation
Storage vessel Potential pool fire
3 Non-volatile liquid but liquid spills onto
failure on the sea
sea

Considering a range of generic cases, such as those above, the following six fire types are
proposed:
1. Gas Jet Fire – originating from a pressurised gas release on the installation.
2. Two-Phase Jet Fire – originating from a pressurised release of a flashing liquid or a
gas/liquid mixture on the installation.
3. Pool Fire on the Installation – originating from a liquid spillage. May be static or running
depending on the drainage paths or bunding around the source.
4. Pool Fires on the Sea – originating from a spillage on the installation falling onto the sea,
or failure of a sub-sea liquid pipeline.

152-RP-48 Rev 02, Feb 2006 Page 46 of 261

fireandblast.com

5. Gas Fires on the Sea – originating from failure of a sub-sea gas pipeline.
6. BLEVE – originating as a result of catastrophic failure of a pressurised vessel containing a
volatile liquid.

It should be noted that the behaviour of these fires may change with time as noted in Section 3.2,
for example, due to the effect of ESD, confinement or deluge. The nature of these fires and their
behaviour when interacting with confinement and/or deluge is considered in further detail in
Section 5.2 “Fire characteristics and combustion effects”.

The fire and smoke loadings, issues concerning heat transfer and other details more detail of the
fire types are discussed in Section 5.3, 5.4 and 5.5.

3.2.4 Transition between fire scenarios

As discussed above, some fire scenarios may change with time, for example, a fire occurring in a
confined space may lead to increasing fire severity with time and the movement of the flame
through the vent may produce external flaming. Similarly, some fire scenarios may lead to incident
escalation and result in a different fire event occurring as a direct consequence, for example, a jet
fire impacting onto a pressurised vessel may lead to vessel failure and a BLEVE fireball event. A
liquid spillage may start as a pool fire on the installation but drainage of the spill may ultimately
lead to a pool fire on the sea. Therefore, it is important that a QRA considers the potential
sequence of fire events and that a fully representative set of events is analysed. The QRA should
be supported by a thorough HAZID with input from people with experience of the existing or similar
plant or processes.

3.3 Fire prevention methods

3.3.1 General

The principals of Fire Hazard Management promote a four-part strategy for dealing with the fire
hazard, when that hazard cannot be eliminated by inherent safety approaches (see Section 2.6). In
order of priority, the remaining steps of the strategy seek to:

5. Prevent or minimise fires at source

6. Detect fires early

7. Control fires

8. Mitigate against effect of fires

Sections 3.3 to 3.5 give an outline of the methods available in each of these four categories. In
reality almost every offshore installation employs a mixture of all four methods. Good design seeks
out the best mix of prevention, detection, control and mitigation methodologies for the specific fire
scenarios associated with an installation.

There are opportunities throughout the design of any installation to minimise the fire hazard using
the four strategies above. Every engineering discipline involved in the design process should be
aware of the interaction between their specific discipline input and the fire hazard management for
the installation. It is the responsibility of the safety engineer in conjunction with the project manager
to engage all the engineers in discussion of fire hazards from an early stage so that no cost-
effective opportunities for improvement are missed.

This section outlines the options available for preventing or minimising the fire event at source.
Sections 3.4 and 3.5 cover the various options for detection, control and mitigation of fire events
once they have already occurred.

152-RP-48 Rev 02, Feb 2006 Page 47 of 261

fireandblast.com

3.3.2 Methods of fire prevention or minimisation at source

Given that the principal role of oil and gas installations is to produce large quantities of
hydrocarbons, complete removal of the fuel source not an option. However there are opportunities
for the designers to minimise the potential for large releases of fuel. These are described in the
following sections.

3.3.3 Minimise inventories

The biggest inventories are in the reservoir, the pipelines attached to the installations and the
process vessels. Engineers need to be briefed to consider minimisation of release potential in
addition to consideration of production maximisation and cost. They should aim to:
• Minimise inventories between the wellhead and downhole valves;
• Provide suitably located topsides and subsea isolation valves on all import and
export pipelines. Any non-provision of subsea isolation must be thoroughly justified.
Justifications must consider all lifecycle phases (especially for NUIs);
• Size pipelines, vessels and other process equipment to minimise inventory loss in a
leak situation as well as meet process requirements;
• Provide adequate automatic isolation throughout the process system, backed up
where necessary with accessible manual isolation valves;
• Minimise on-platform storage wherever feasible.

3.3.4 Optimise layout

Good layout is essential to the overall safety of the installation. Where separation of people from
hazardous areas is not possible, provide protection by segregation behind firewalls and attention to
escape/egress routes. Key points are:
• Keep living quarters and evacuation facilities away from the process;
• Provide diverse egress routes from modules and access platforms/decks back to the
TR or provide a suitable protected muster point (PMP);
• Provide grated deck in process areas to reduce pool fire risks;
• Wherever possible hydrocarbon containing vessels should be bunded and
connected to hazardous drains or vents or flare systems designed to remove
flammable liquids from the vessel;
• Ensure that the hazardous drain arrangements are capable of handling releases
from the single largest vessel or source based on the range of reasonably
foreseeable events;
• Locate risers as far as possible from the TR & evacuation point;
• Locate risers and riser valves where other fires or fire escalation cannot affect them;
• Review the locations and orientations of flanged joints to minimise the location of
targets (SCEs or other flammable inventories) within the range of small and
escalating jet fires;
• Small platforms such as Southern North Sea gas platforms cannot provide
separation by distance therefore immediate safe egress/escape provision plus
sheltered evacuation points are crucial for safety of personnel.

3.3.5 Minimise the potential for loss of containment events

• Minimise the number of potential leak points in the design, particularly flanges and
instrumentation connections. However enough valves need to be left to provide for

152-RP-48 Rev 02, Feb 2006 Page 48 of 261

fireandblast.com

safe isolation for intrusive maintenance. Use of newer design of equipment such as
high integrity flanges, valves with integral block and bleed and inherently safer
wellheads should be considered.
• Design for future sand erosion and corrosion by providing for ease of detection,
monitoring and replacement.
• Where facilities and access for routine test and maintenance are not provided on the
understanding that such work will only be done during shutdowns, this should be
highlighted on drawings and in manuals.
• Where emergency manual isolation is provided, make sure it is documented in
emergency response plans, unambiguously labelled in the field and accessible in
the relevant fire scenarios.

3.3.6 Providing an inert or non-flammable environment

• Determine the degree of containment to confirm whether an inert atmosphere is

achievable in the specific application, for example:
o Completely contained within a pressurised vessel;
o Completely contained but within an open vented atmospheric vessel/tank.

• Determine the required supply of inerting medium, e.g. the degree of inflow and outflow
required for all operating conditions, for example offloading requirements or inerting an
area with opening/closing doors (such as filling a Temporary Refuge with lower oxygen
content media, see next bullet point).

• Review the non-flammable media available for application, considering the use of the
areas and volumetric flow rate requirements, the media may include:
o Nitrogen;
o Over-rich (i.e. above Upper Flammable Limit) fuel gas;
o Cleaned combustion gas;
o Low oxygen content media (such as Inergen, a proprietary product with insufficient
oxygen to support combustion but adequate oxygen content to maintain life);
o Carbon dioxide.

• Consider the preferred delivery option, whether the media can be generated on the
installation (e.g. Nitrogen Generator) or whether it is desirable to be brought on board.

• Review the media for their own hazardous effects in the context of the potential
applications. Avoid all but the lower oxygen content media in areas where personnel
without breathing apparatus may be, ensuring that the lower oxygen content media are
suitable for occupied areas. Identify any time limits on occupancy or minimum health
and fitness criteria with the media supplier.

• Confirm that the layout does not contribute to or exacerbate migration of the media to
sensitive areas, for example carbon dioxide being heavier than air will flow down hill,
therefore, recessed areas for valve or equipment access could capture the CO2,
especially where personnel could access as part of recovery work after the emergency.

3.3.7 Minimise the time to ESD and blowdown

• ESD should be designed to occur immediately on detection of a release event. ESD
should move the plant to a safer state. Designers need to check whether the ESDV
locations minimise ignited release consequences rather than just reducing leak size.

152-RP-48 Rev 02, Feb 2006 Page 49 of 261

fireandblast.com

• Rapid blowdown or draining of topsides process inventories in order to prevent

escalation of a fire situation should be provided - unless there are specific good
reasons for not doing so (e.g. very small topsides process).
• The code-based design approach of providing blowdown to 7 barg or half design
pressure in 15 minutes should no longer be automatically assumed adequate.
Blowdown should be designed in the light of the specific escalation times for each
fire scenario and generally be as fast as feasible once activated, (see Sections 6.6.4
and 6.6.5 for more details on blowdown systems).
• Where only a manual blowdown capability has been used – the designer and Duty
Holder must justify the choice of system with respect to the identified major accident
hazards, the design and operating philosophy must be clearly recorded for the
intended user and all operational and maintenance details must be documented or
referred to in the emergency response instructions for the installation.
• Blowdown must be to a safe location with respect to personnel, bearing in mind the
likelihood of spurious blowdown events as well as real emergency events, and
designed such that the heat radiation for maximum foreseeable flaring (or ignited
venting) rate does not pose a hazard to escape and evacuation.

3.3.8 Minimise ignition sources.

• All electrical equipment in hazardous areas shall be certified. This is to cater for
‘fugitive’ leaks in accordance with hazardous area design codes.
• The dispersion distances for such leaks, from which the hazardous zones are
calculated, do not cater for major accident releases.
• A gas cloud from a medium or large leak can, and will, drift outside hazardous area
limits. Therefore caution must be exercised in locating unclassified equipment such
as generator sets, temporary pump skids, heating equipment etc in ‘safe’ open
locations around the installation.
• The ignition-prevention philosophy for the platform should explain how the ignition
risk is minimised.
• Plant should be suitably earthed and all operators trained in awareness of offshore
static spark risks (a recurring cause of fires).
• Equipment which provides an ignition source and is unacceptably close to release
sources should either be located inside an enclosure with ventilation ducts that close
off automatically on detection of gas, or be provided with some alternative form of
protection.

Certified electro-mechanical equipment (e.g. diesel generators) requires careful maintenance in

order to retain its certification and is a significant operating expense.

3.4 Gas and fire detection and control methods

3.4.1 Detection of loss of containment events

3.4.1.1 Overview of gas detection options

Early detection of loss of containment events is crucial. Detection should always trigger limitation of
the leak by rapid automatic isolation it should simultaneously alert personnel to the danger. Since it
is difficult to automatically detect liquid oil leaks (although oil mist detectors can detect higher
pressure liquid leaks), historically reliance has been placed on detection of the associated gas.

Most installations have hundreds of sensitive detectors in place. In order to prevent spurious
shutdowns and un-necessary platform alerts, most installations have a two-tier alert system.
152-RP-48 Rev 02, Feb 2006 Page 50 of 261
fireandblast.com

Typically, under this system, a single low-gas-level alarm alerts staff in the control room to a
potential problem, which is immediately investigated but no shutdown or general alarm is initiated.
One single low level gas detection is more likely to be a false alarm than a real gas release. If a
second alarm in the same area then occurs or if a high-gas-level alarm goes off, then this is
indicative of a real release rather than a false alarm. The fire and gas system voting interprets 2 or
more low-level or 1 or more high-level alarms as ‘confirmed’ gas releases. This automatically
initiates platform alarms and shutdowns.

Confirmed gas detection should always initiate immediate, appropriate executive action in the form
of shutdowns and, where applicable, blowdown. Most platforms have between 2 and 5 levels of
shutdown, depending on the extent of the detected release. A system which requires operations
personnel to walk into a gas-release scenario in order to investigate before initiating shut down of
the process system is potentially dangerous and no longer acceptable. Personnel should never be
asked to enter a gas-cloud for the purposes of investigation or manual action – they may be
rendered unconscious by the un-ignited gas or be engulfed in flame if the cloud suddenly ignites.
Where one person is missing, more people are exposed through search and rescues attempts and
the evacuation process becomes delayed. The detection system should instead be designed to
give remote indication of the development and/or migration of the release thus allowing personnel
to stay well away from danger. Once the fire and gas panel shows the situation is sufficiently under
control then cautious, upwind approach from a position of safety can be attempted.

There are many different types of gas detector available. All have their strengths and weaknesses
which are explored in the table below. All installations, modern and old, use a combination of
different methods in order to cover the range of duties necessary.

The approach to the detection of flammable gas has moved away from trying to detect all leaks
and now concentrates mostly on the following three distinct criteria:-

1. The detection of gas clouds of a specific size and LEL (i.e. 5 metres, 50% LEL cloud)

2. The detection of gas leaks also of a specific size (i.e. 0.1kg s-1 to 2.5 kg s-1)

3. The detection of gas at the HVAC intakes to areas containing potential sources of
ignition (TR, turbine enclosures, etc)

The basis for the specific cloud size and gas leak size are established by specialist
analysis/modelling of the areas. The systems are generally not concerned with the detection of
fugitive gas leaks, except in some special cases.

Performance standards are used to set the initial design conditions to be met by the various
detectors (see Section 3.6).

152-RP-48 Rev 02, Feb 2006 Page 51 of 261

fireandblast.com

Table 3-1 Summary of methods of gas detection

Method of Gas Detection Strengths Weaknesses

Single point Pellistors
These detect the presence
of gas when it reaches a
detector head. They are
good at detecting
accumulations of gas.
Well-understood item. Good
designs should allow gas
clouds to be tracked, as they
drift through areas of plant,
from the safety of the control
room.
Susceptible to ‘poisoning’ of the catalyst by
oil-spray and contact with other chemicals.
Always check proposed site and
contamination issues with manufacturer.
They generally require a high level of
maintenance due to drift, and recalibration
due to poisoning, as these detectors do not
automatically provide indication of a faulty
pellistor.
Very large numbers are required to
adequately cover a typical fire zone
Not preferred on new or upgraded
installations.

Have historically been used for Location in an air intake duct is an arduous
detection of gas in air supply duty for this type of detector Executive
ducts to enclosed areas action occurs on 2oo3 voting. Access for
containing unclassified frequent maintenance and testing is
electrical equipment or other essential. I/R point detector with duct probe
potential sources of ignition or I/R open path detector are now available,
but not recommended now IR, and better, for this service.
beam detectors available.
Not very effective for small leaks in open
areas. In this situation use in conjunction
with acoustic detectors.
Susceptible to drifting if not regularly
checked and maintained, leading to
unnecessary shut-downs.
Unless the gas comes into direct contact
with the detector head it will not operate so
numerous detectors, suitably located are
required. Vapours heavier than air require
detector location at floor level. For natural
gas releases, detectors need a high level
location.
Must be calibrated and located
appropriately for the vapours they are
designed to detect. Calibration settings for
LNG (methane), LPG (propane),
condensate and hydrogen are all different.
Heavier or lighter than air gases require
increased numbers of detectors and
present difficulties positioning to avoid
damage at low level and maintenance
access at high level.
Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should
be given to setting the devices to give initial (low level) alarm at a levels just above the anticipated drift
range of the device and high level alarm slightly above that. Operators have found that alarm at 10 to 20%
LEL and executive action at 25 to 40% is feasible for a well maintained system. This gives an added
margin of safety while avoiding nuisance alarms. Different set points will be necessary for different
applications. The suitability of the set point each application should be documented, and not automatically
assumed to be 20% LEL for low level and 60% for high level alarm.

152-RP-48 Rev 02, Feb 2006 Page 52 of 261

fireandblast.com

Method of Gas Detection Strengths Weaknesses

IR point detectors Very good at detecting Not good as the prime detector type for
flammable gases at potentially open process areas as large numbers of
known locations. Very little detectors would be required.
maintenance or calibration
required during the life of the
detector (in excess of 5 years).
These detectors are least
sensitive to methane, so when
calibrated for methane will also
detect other gases i.e.
propane, butane etc more
readily. This type of detector is
good for confined areas, ducts
etc (with a duct probe unit).
IR Beam (open path) Very good at detecting gas Some early versions could be activated by
detectors. clouds in open process areas, adverse weather, especially rain and fog
These detect the presence effectively taking the place of and vibration
of a cloud of hydrocarbon numerous point detectors.
gas between a detector Very little maintenance
head and its reflector necessary, but this can be
achieved by one man with an
interrogator tool. Not
susceptible to poisoning.
Detectors can be sited at the
boundaries of modules of fire
zones to provide economic
coverage of large areas,
providing good information on
gas migration.
Care should be taken when
subsequent work is being
carried out on the installation,
when there might be the
potential for blocking beams
by scaffolding, sheeting for
weather protection or painting.
Leak detectors (acoustic) Will detect any significant leak Area mapping of background noise is
These detect the noise in vicinity without contact with necessary to enable the correct alarm
made by any significant gas therefore large numbers of setting to be established. These detectors
leakage from a high detectors not necessary. need to be located with easy access for
pressure gas (whether Usually only two or three routine testing.
flammable, toxic or inert) detectors are required in a These detectors will detect a high pressure
system. typical process area. leak of any gas, whether hydrocarbon, air,
N2, CO2 etc. Hence caution is necessary
when arranging the shutdown logic and
when placing the detectors, with respect to
any regular discharges of air (such as near
air compressors). Discussions with
equipment vendors should be initiated to
understand the frequency range over which
the detectors will work.

152-RP-48 Rev 02, Feb 2006 Page 53 of 261

fireandblast.com

Method of Gas Detection Strengths Weaknesses

Note: There has been
reluctance by the industry
to embrace acoustic
detection. It is still regarded
with suspicion as ‘new
technology’ despite nearly
ten years of successful use
in the Southern North Sea.
Manual
CCTV (see under CCTV in
Table 3-2 )
Concerns about spurious
activations by background
noise can be averted by
designing in recognition of
other noise signature in vicinity
and possible use of pre-set
time delays before alarm
initiation. Initial calibration of
detectors in their designated
location is essential.
Personnel should always be
vigilant and report small leaks
for Investigation, repair and
monitoring. Most small leaks
are still detected manually
especially on open design
platforms
Cheaper and readily fitted Visibility of large gas releases depends on
especially on large numerous process, release and
installations or on extensive atmospheric variables. Small gas releases
process areas. Allows operator would not generally be picked up.
judgement on how to deal with
the situation.

3.4.1.2 Additional notes on detector types

3.4.1.2.1 Infrared detectors

An infrared gas detector consists of an infrared source and an infrared detector. When flammable
gas passes between the source and detector, the gas absorbs infrared radiation and lower
radiation intensity is registered at the detector. Specific gases are detected by measuring the
amount of absorbed infrared radiation at specific wavelengths; the difference is related to the
concentration of gas present.

Infrared detectors will not “poison” and can operate in inert atmospheres. They can be used in
confined spaces where oxygen depletion might have otherwise limited the effectiveness of a
pellistor detector. Infrared detectors are fail-safe, a detector that is obscured or has failed registers
zero infrared radiation and the alarm signal is activated. IR detectors are available in either a fixed-
point format, in which the gas diffuses into the detector or in an open-path format where the source
and detector are separated (thus a line of sight detector).

3.4.1.2.2 Pellistor detectors

A pellistor detector consists of a matched pair of elements, one of which is an active catalytic
detector and the other an inactive compensating element. Flammable gas contacting the catalytic
surface of the detecting element is oxidised causing a rise in temperature of the active element,
this rising temperature increases the resistance of the active element. There is no such change in
the compensating element and the output signal of the detector is based on the imbalance
between the two resistances.

Pellistor sensors can give accurate readings under adverse environmental conditions as changes
in ambient temperature, humidity or pressure will impact both elements. Pellistors can be poisoned
or inhibited by silicones, sulphides, chlorine, lead and halogenated hydrocarbons. The detectors
require regular cleaning and calibration, (with an impact on maintenance costs). Pellistor sensors
also require the presence of oxygen in order to operate.

152-RP-48 Rev 02, Feb 2006 Page 54 of 261

fireandblast.com

3.4.2 Detection of fire events

Early detection of fire is crucial. The earlier a fire can be detected the earlier personnel can be
warned and steps taken, both automatic and manual for containment and control. There are many
types of fire detection device available on the market. No one device covers every fire situation.
The uses, locations, strengths and weaknesses of the most common types are outlined below

Table 3-2 Summary of methods of fire detection

Methods of Fire
Strengths Weaknesses
Detection
Smoke Detection:
Ionisation Smoke Widespread use in enclosed areas such Not effective in open modules, as the
detectors detect the as accommodation ceiling voids, electrical smoke is usually dispersed before
visible and invisible equipment and control rooms. The reaching detector.
products of detectors can be wired in series with up to Not advised for use in areas where
combustion as they 20 detectors on one loop. These some smoke is expected in normal
come into contact with detectors have a high resistance to operation e.g. above cookers.
the detector. contamination and corrosion. They are
Care is needed with disposal since
available in a wide range of versions to
they contain a minute radioactive
suit different needs.
source
Optical Smoke Widespread use in enclosed areas such Not advised for use in areas where
detectors detect only as accommodation modules. The some smoke is expected in normal
visible smoke and rely detectors can be wired in series with up to operation e.g. above cookers.
on the ‘light scatter’ 20 detectors on one loop. These
principle detectors have a high resistance to
contamination and corrosion and are
available in a wide range of versions to
suit different needs.
VESDA (Very Early
Smoke Detection
Alarm) or HSSD (High
Sensitivity Smoke
Detection)
These pull air samples Alert personnel to the incipient These are being widely used to
from areas susceptible development of a fire situation e.g. behind replace Halon systems removed from
to electrical fires to a instrument panels, especially in control rooms, MCC or switchrooms.
small analyser and unmanned control rooms or in cable They can be alarm only, or wired to
check for smoke or routes. These detectors are particularly the F&G control panel for executive
pre-combustion suitable in areas with high air flow actions and/or shutdowns. These
vapours. ventilation. systems are relatively high unit cost
The very early warning allows personnel and there are additional maintenance
to enter the room to investigate and/or requirements for checking and
isolate power supplies without undue keeping air-sampling tubes clear.
exposure to risk.

152-RP-48 Rev 02, Feb 2006 Page 55 of 261

fireandblast.com
Methods of Fire
Strengths
Detection
Flame Detection
IR flame detection Widely used and well understood. Used to
detect the infra-red wavelengths of
hydrocarbon flames. Typically 4 to 16
detectors would be needed to cover a
module depending on module congestion
and dimension.
UV flame detection Widely used and well understood. Used to
detect the Ultra-violet wavelength of a
flame spectrum. Typically installed under
turbine/compressor hoods.
Video flame detector Very good at detecting flaming fires.
(makes use of Sophisticated versions can be set up to
specialist flame mask out known flame sources e.g.
imaging technology) platform flare. These can provide
conventional alarm signals plus a video
image if required. Possibly the way
forward for ‘Greenfield’ projects.
Fusible bulbs These bulbs break at a pre-defined
temperature and raise an alarm/ESD.
They also usually either release water
directly or release air to activate deluge
systems. This system does not rely on
electrical power for satisfactory operation
and deluge release.
Fusible links These melt at pre-defined temperatures to
raise an alarm/ESD by breaking a circuit.
Some directly initiate release of hydraulic
fluids to close safety valves on wells or
risers.
Fusible plugs These melt in fire situations to send an
alarm signal and release hydraulic fluids
thus closing well and riser safety valves.
152-RP-48 Rev 02, Feb 2006
Weaknesses
Detect ‘yellow’ flames, but weak on
bluer flames (e.g. methanol fires).
Vision of units can be obscured by
smoke or equipment (especially
forgotten ‘temporary’ items). Often
used in combination with UV detectors
where several types of fire can occur
in one module. Generally specialist
mapping techniques are used to
optimise detection and ensure
adequate coverage is achieved. To
avoid spurious alarms higher numbers
of detectors are required to provide
voted logic. Spurious alarms may
occur from other, non-fire IR sources,
so not suitable in areas where ‘black
body radiation’ occurs.
Detect the bluer flame types. As for
the infra red detectors, solid objects or
smoke will obscure the cone of vision,
reducing the effectiveness of the
detector. The lens of each detection
unit needs regular checking for dirt
build-up which prevents effective
operations of the device.
Unit cost may be high but fewer units
required to cover a typical process
area.
A these devices require a heating
effect that causes failure, dependent
upon their relative location with
respect to the fire, they may take
significant time to detect a fire (for
example compared with optical
(IR/UV) detectors). By the time the
bulbs operate, significant damage may
have been done.
The bulbs may also subject to physical
damage and corrosion which could
lead to false alarms. An extensive pipe
network is required (linking the bulbs
to the detection system) to provide
coverage of full module.
As above for fusible bulbs.
As above for fusible bulbs.
Page 56 of 261
fireandblast.com

Methods of Fire
Strengths Weaknesses
Detection
Rate of heat rise Detects rapid temperature change. Useful
in areas with temperature fluctuations.
Highly reliable as a single detector,
confirmed fire signal.
Rate of heat rise Detects temperature change. Highly Not as fast reacting as the rate-of-rise
- Rate Compensated reliable as a single detector, confirmed detectors.
fire signal
Fixed Detects a pre-set high temperature.
Based on thermocouple design. Highly
reliable as a single detector, confirmed
fire signal.
Gaining in popularity and reducing in price Systems with good coverage can be
with time. expensive to install and maintain.
Particularly good for checking alarms in
Conventional CCTV remote areas such as column bases on
used to supplement semi-subs.
traditional fire and gas
detection devices Allows escape routes from TR to
evacuation points to be checked and state
of fire development in process areas
without exposing emergency response
personnel to danger.

The reliability of the fire and gas detection system needs to be designed in at the outset of design
and then maintained at a high level of reliability and availability throughout the platform’s
operational phase. Best practice for new designs relies on good levels of redundancy in the
electronic system architecture (usually dual or triple redundancy) and will include the following
characteristics:
• Electrical fault monitoring to detect any electrical discontinuity faults which have occurred
in the system. Fault alarms should not be cleared until the fault is investigated and
removed;
• Significant redundancy in field devices;
• Fire and explosion survivability for detectors and cabling;
• Uninterruptible power supply.

The required target reliability of the Fire and Gas detection system must be specified by the Project
team to the manufacturer at the outset of the system design (if not already specified in the
invitations to tender). It will be difficult (and extremely expensive) for anyone but the manufacturer
to produce the reliability figures once the system is already built.

As part of the current application of IEC 61508 [3.1] or IEC 61511 [3.2] (the latter being the
requirements and assessments of safety instrumented systems in the process industries sector),
the reliability and failure modes of instrumented safety systems must be considered along with
hazard probabilities and demand rates. Guidance on assessment techniques and avoidance of
failure modes can be found in this document.

3.4.3 Control methods

Where fires cannot be prevented, they can be controlled (once detected) to reduce the size,
duration, and escalation potential of the fire.

The following control methods are commonly in use offshore. All platforms are different, but many
of these control methods will be relevant to most installations. Note that extinguishants and manual
152-RP-48 Rev 02, Feb 2006 Page 57 of 261
fireandblast.com

firefighting are considered below as control methods. Deluge systems and passive fire protection
methods are classed as mitigation methods because they generally protect against the impact of
an existing fire rather than working to control the fire itself. The mitigation methods are addressed
in Section 3.5.

Some typical fire related operational and design considerations are provided for each control
method in Table 3-3 below.

Table 3-3 Summary of methods of fire detection

Control Method Control Mechanism Fire Related Design Considerations

Process Automatic - Reduces inventory Ease of testing and maintenance. Regular test of
Emergency Shut available to leak or fire by process ESDVs often neglected.
Down Valves isolating process into separate, Specify and justify test interval and acceptable leak
(ESDVs) smaller, segments. rate as part of design. Record in performance
standard documentation
In fire situations several ESDVs plus adjacent
pipework may be engulfed at one time, releasing
several inventories to prolong fire.
ESDVs are frequently used at module boundaries to
prevent inventories from one module feeding a fire in
another, these divisions then match the designated
fire areas and their associated firewater coverage.
Where no such boundary isolations are in place, it
becomes possible for hydrocarbon which is stored in
one module to be released into another module and
fuel escalation of further fires..
Riser ESDVs – Automatic - Isolates platform Topsides valves to fail close
(Topsides and from pipeline inventories at the Locate away from process fire areas wherever
subsea) topsides. possible.
Note that riser ESDVs are a Protect valve and exposed riser sections against
requirement in the UK foreseeable fire scenarios
Continental Shelf under the
Always consider benefits of subsea pipeline isolation,
Pipeline Safety Regulations.
even a simple NRV may provide significant risk
reduction. Justify and record basis of decision.
Sub-sea Isolation Automatic - Isolates platform Topsides valves to fail close
Valves (SSIVs) from pipeline inventories at a Locate away from supply vessel routes, incoming
defined distance. jack-ups and other potential sources of dropped
objects or dragging anchors. Locate the valve such
that uncontrolled events just the far side of the SSIV
will not pose a radiation problem for the installation,
distances are often of the order of about 250-350m.
Well head and Automatic - Isolates platform Surface and downhole valves to fail close on
downhole from reservoir inventories confirmed fire or gas release event.
isolation valves
General Platform Automatic - Removes people to Any prolonged fire necessitates evacuation as a
Alarm (GPA) place of relative safety precaution
OIM and deputies must understand escalation
mechanisms and timeframes for all emergency
scenarios in order to be able to make competent
decisions.

152-RP-48 Rev 02, Feb 2006 Page 58 of 261

fireandblast.com

Control Method Control Mechanism Fire Related Design Considerations

Blowdown and Automatic or manual - BDVs to be fail-open, unless this endangers

blowdown valves Removes gases to flare or cold helicopter operations and pre-warning not feasible.
(BDVs) vent Automatic facility recommended. Any manual
See also Section 6.6 for a arrangements need clear and detailed instructions for
general review of Process operation to offshore staff.
Responses Appropriate blowdown time to be developed from
See also Sections 5.5.3.3/4/5 escalation scenarios
and 6.6.2/3/4/5 for details on
how the approach described in
API 521 impacts blow down
rates and subsequent
consequences.
Process drain Automatic or Manual - Usually manual facility
facility Removes main liquid Consider vulnerability of dump line route
inventories from vicinity of fire
Consider time required for draining
to a safer location (e.g. cellar
deck surge tanks)
Manual fire Manual fire intervention with Appropriate for very small fires - Immediate
fighting hydrants, fire hoses, foam intervention on discovery of small fire can prevent fire
monitors, extinguishers etc taking hold. All personnel trained for small fire
intervention.
Fire fighting, equipment cooling and helideck fire
control only possible where trained fire teams
available. Effectiveness depends on understanding of
installation-specific fire and escalation scenarios and
plus realistic offshore exercises.
Note that even with training, fire fighting teams that
remain to fight a fire will be at greater risk.
Comparative risk issues must be understood and
precise criteria defined to limit fire fighting team’s
exposure.
Remote manual Initiation of fixed or oscillating Often used on helideck or open upper or weather
fire fighting fire monitors, with or without decks. May be affected by strong winds.
foam.
Inerting agents Prevents fire from Useful in enclosed, remote spaces difficult to access
starting/taking holds by in fire situations (e.g. pump rooms in semi sub or ship
rendering the atmosphere inert hulls)
– Inergen ©, CO2 etc. Static discharge may ignite atmosphere, causing
explosion – check potential with vendor.
Inerted atmosphere may not be breathable so
warnings and pre-discharge alarms required.
Extinguishants Stops fire burning by preventing Useful in enclosed spaces such as machinery
oxygen reaching fuel, removing enclosures
heat, or otherwise interfering Deluge and fuel/water wash-off needs weight-control
with combustion process – consideration, particularly on floating installation.
water-mists, foams, some types
of deluge etc
Foam application Reduces evaporation of Suitable for contained liquid fires. Less effective on
vapours. running pool fires, not effective on jet fires
Creates film/foam to prevent
oxygen reaching liquid fuel thus
reducing, or extinguishing pool
fire.

152-RP-48 Rev 02, Feb 2006 Page 59 of 261

fireandblast.com

Control Method Control Mechanism Fire Related Design Considerations

Dirivent systems Disperses very small leaks to Only effective for fugitive (very tiny) leak scenarios
prevent flammable cloud build- System shuts down on in major release scenarios as
up. may spread leak and mix release to flammable
concentrations.
Other HVAC Provides air exchange within an System needs special attention to be able to provide
systems enclosed area to prevent or adequate air flow rates and be safe, i.e. to not
slow flammable cloud build-up. introduce any ignition sources and also not move the
fuel/air mixture to other areas hitherto safe within the
context of the originating accident.
Bunds Control spread of liquid While bunds can contain a liquid release/fire, they
releases can also concentrate a fire around the equipment in
the bund and should be used in conjunction with
foam. Design must ensure deluge does not cause
bund overflow by being sized for maximum
foreseeable liquid volume release.
Drains Remove liquid and deluge Small releases are usually within drain system
releases to drain system. capacity. The drain capacity needs to be capable of
removing maximum foreseeable liquid volume
release although the effects of burning liquids in the
drain system must be checked.
Sea-fire possibilities and consequences need
checking
In emergency scenarios environmental issues
become secondary to preservation of life.

3.5 Methods for mitigating the effects of fires

3.5.1 Firewalls

Dedicated firewalls are often used to physically separate fire areas. The basis of the separation
and the specification of the firewall are dependent upon both the fire types and severities identified
in the “fire hazard” area and the vulnerabilities of the equipment, systems or personnel in the area
being protected.

There are several grades of pre-defined firewalls and a fire risk analysis will generally choose an
acceptable defined standard rather than develop a bespoke standard (unlike designing a blast wall
for explosion hazards). Some of the general terms for firewall specifications are described below.
Firewalls’ continued performance is highly dependent upon the preceding and succeeding events,
not least how their integrity is maintained following an explosion event. These issues are discussed
further in Section 4, where interactions with explosion hazard management are discussed in more
detail.

3.5.1.1 Class A-0 division

A division formed by a bulkhead or deck that is constructed of steel or an equivalent material and
suitably stiffened. It should prevent the passage of smoke and flame after 60 minutes of exposure
to a standard fire test.

3.5.1.2 Class A-60 division

A division similarly constructed as A-0 and is additionally insulated with non-combustible materials
so that, if either side is exposed to a standard fire test, after 60 minutes the average temperature
on the unexposed face will not increase by more than 139°C above the initial temperature and also

152-RP-48 Rev 02, Feb 2006 Page 60 of 261

fireandblast.com

that the temperature at any point on the unexposed face, including any joint, will not increase by
more than 180°C above the initial temperature.

3.5.1.3 Class B-15 division

A division formed by a bulkhead, ceiling or lining that is constructed and erected entirely from non-
combustible materials and prevents the passage of flame after exposure to a standard fire test for
30 minutes. It is insulated so that if either face is exposed to the first 30 minute period of a
standard fire test, the average temperature on the unexposed face will not increase at any time
during the first 15 minutes (of that test) by more than 139°C above that initial temperature. The
temperature at any point on the unexposed face, including any joint, will not increase by more than
225°C above the initial temperature after exposure for 15 minutes.

3.5.1.4 Class H-120 division

A division similarly constructed as A-0 and is additionally constructed to prevent the passage of
smoke and flame after exposure to a “hydrocarbon fire test” for 120 minutes. It is insulated with
non-combustible material so that, if either face is exposed to a hydrocarbon fire test, after 120
minutes the average temperature on the unexposed face will not increase by more than 139°C
above the initial temperature and also that the temperature at any point on the unexposed face,
including any joint, will not increase by more than 180°C above the initial temperature.

3.5.1.5 The “standard fire test”

The "standard fire test" is a test conducted in accordance with Regulation 3.2 of Chapter II-2 of
International Maritime Organization International Conference on Safety of Life at Sea [3.3].

3.5.1.6 The “hydrocarbon fire test”

The "hydrocarbon fire test" is a test in which a specimen division which resembles as closely as
possible the intended construction and includes (where appropriate) at least one joint and has an
exposed surface of not less than 4.65 m2 and a height or length not less than 2.44 m, and is
exposed in a test furnace to temperatures corresponding approximately to a time-temperature
relationship defined by a smooth curve drawn through the exposed test temperatures (indicated
below), measured above the initial furnace temperature.

Exposed Test
Time interval Temperature
Temperature
(N minutes
Point (increases in
after start of test)
°Celsius)
1 3 880
2 5 945
3 10 1032
4 15 1071
5 30 1098
6 60 1100
7 120 1100

3.5.1.7 Penetrations and closures in firewalls

Where a firewall of any class is pierced for the passage of electric cables, pipes, trunks or
structural elements or for other purposes, the “penetration” must be arranged so that fire resistance
standard of the division is not impaired. Similarly, any openings such as doors or other access

152-RP-48 Rev 02, Feb 2006 Page 61 of 261

fireandblast.com

hatches must match the integrity of the division when closed and in the case of doors be self-
closing.

3.5.2 Passive fire protection methods

Passive methods are preferred where specific protection of critical process or structural items is
needed in order to prevent escalation. Widespread application to process and structural items is
not generally feasible due to weight, inspection and maintenance/replacement issues. Modern
design philosophy is to identify specific areas or items of concern (usually structure or piping which
on failure would escalate the initial event) and target these items for PFP application. PFP is
preferred over deluge in such situations since it is immediately available and has no moving parts
to fail and prevent operation.

If properly applied/installed it is highly reliable in service. However it has also been the cause of
problems in the past so current best practice concerning the design and application of such
systems, is discussed below.

Passive fire protection (PFP) comes in many forms, but the object is always to provide some sort
of heat insulating barrier between the fire and the item to be protected. PFP can be designed for
use on vessels, pipework, structural members, boundary walls or individual items of safety critical
equipment. The objective is to prevent the protected item heating up and either losing strength,
losing function, distorting or producing noxious fumes.

Previously the design emphasis was on application of codes and rules. For example,
accommodation block were given A60 walls regardless of the fire risk to the accommodation. Now,
best design is to design all PFP systems to be appropriate to the specific fire scenario for which the
PFP is required. PFP can be effective in protecting against high pressure jet fires whereas deluge
is not

The system is usually designed by the PFP supplier’s engineers to the scenario-based
specification of the relevant discipline engineer (process, structural, mechanical or instrument as
appropriate for the item being protected) and the safety engineer.

For any of the systems outlined below it is up to the designer to demonstrate initial suitability of the
PFP system to the IVB and HSE, and the duty holder to maintain the protection throughout the
lifecycle. For some of the common systems initial suitability is easy to demonstrate since the
manufacturer will have a standard fire test certificate (such as A60, B15, or H120) for the proposed
system. However for some of the newer products, or existing products in severe or novel
applications such classification is not easy to obtain and the demonstration of suitability will have to
be via specially devised fire tests or research. Some considerations around standard fire tests are
discussed in Sections 6.2.1 and 6.3.2 of this guidance.

The following types of PFP are in current use and their uses and drawbacks are discussed in the
paragraphs below and further in Sections Sections 4.4 and 4.5.

3.5.2.1 Cementitious or vermiculite type

These are heavy mineral-based based coatings which can be applied to walls, structure or
pipework in a wide variety of ways from spraying or trowelling to bolting-on of pre-formed sections.
They have been used extensively offshore since the 1970s. There are many different types
available. The thickness of the coating principally determines the time it takes to transfer the heat
through the coating and the mechanical strength of the compound or sometimes an extra outer
shell, determines whether the coating will withstand the physical impact of the fire, for example
erosion from jet fire impingement or pressure waves from explosions.

Since the properties of cementitious or vermiculite coatings are well researched and many
applications have been extensively tested, classification of the protection is relatively easy to

152-RP-48 Rev 02, Feb 2006 Page 62 of 261

fireandblast.com

obtain. Some systems have been tested and found capable of withstanding the impact of high
pressure jet fires.

In the 1980s and early 1990s the biggest problem with use of these coatings was that the offshore
installation process was carried out poorly. Many poorly applied coatings fell off after a few years.
Deluge water found its way beneath coatings and the fixing pins or protected items (particularly
where they were warm) corroded rapidly. Some coatings just disintegrated with time. Products
have improved significantly since the early 1990s and recent experience has demonstrated that
provided these systems are installed in full compliance with the manufacturers’ instructions, there
are few problems. However it is difficult to exercise control over application in the offshore
environment, especially in exposed areas and below main deck levels. Therefore, wherever
possible for new designs, coatings should be installed onshore under controlled conditions before
float out.

Removable PFP, in the form of enclosures or blanket wraps can be removed to allow corrosion
checks and inspection/maintenance of protected equipment. However, removable systems are not
practical in many places, being generally heavy, costly and requiring space.

3.5.2.2 Intumescent coatings:

Intumescent paints and coatings work by expanding to many times their original thickness on
exposure to high heat or flame to produce a fire resisting, thermally insulating coating or ‘char’.
Like the mineral-based coatings discussed above they are available in a variety of forms to suit a
wide variety of applications from protection of deck undersides to sealing of piping or cable transits.

The possibility of corrosion under PFP coatings is a major concern for designers. For new builds it
is possible to plan for future inspection through the coating, out as explained below. Retrofitted
systems remain problematic. Although intumescent coatings can now be applied in fairly thin
layers, use in underdeck or other exposed areas and particularly in the splash zone usually
requires a thin neoprene layer under the coating and another on top to prevent external corrosion
and protect the coating. Any such thick or composite coating makes subsequent NDT inspection
results extremely difficult to interpret. It would be possible to plan for such NDT inspection if the
designer specified at the outset that sample pieces of steel were taken and kept, coated and
uncoated, for calibration purposes. This would allow results to be interpreted with more confidence.
For retrofitted systems, without these calibration aids, effective NDT through PFP coating systems
is not practically achievable at present. Research continues but no viable methods exist at present.

Wet-applied intumescent coatings often shrink slightly as they dry out, and they usually give off
toxic gases when they intumesce. The effects on adherence to substrate plus the migration of toxic
gases to affect personnel need taking into account during design.

As for the cementitious PFP, proper preparation of surfaces to be coated with intumescent PFP is
essential for long-term performance. Intumescent systems can be specified to provide fire
protection for anything from minutes to hour, and many systems have been through fully
documented testing. Both cementitious and intumescent coating systems are continually changing
and developing so details are best obtained directly from the manufacturer.

Further discussion of common types of PFP application, such as PFP in firewalls, enclosures,
flexible wrap systems etc is provided in Section 7.3.2 on Fire Protection Design.

3.5.2.3 Weathered and cracked PFP

Since much of the PFP in existence on offshore installations at the current time is suffering from
ageing, 2 separate projects have been initiated. HSE and HSL are continuing a programme started
by Shell which will report on the effects of 10 years of weathering (and ageing) on the fire
resistance of PFP. A joint industry research project is underway by MMI to determine which types
of damage to PFP are most critical and what are the most effective repair methods.

152-RP-48 Rev 02, Feb 2006 Page 63 of 261

fireandblast.com

Both projects were set to report in late 2005.

In addition, ageing, weathering or plain damage to PFP can cause a loss of water-tightness and
thus lead to water penetration and potential corrosion. This in turn creates difficulties for the
maintenance teams to inspect and monitor potential corrosion points under PFP.

3.5.3 Active fire protection methods

3.5.3.1 Mitigation by deluge water application

Deluge works mitigates the effects of fires principally by providing cooling both to the fire and to
equipment exposed to radiant heat from the fire. In addition it can wash away liquid fuel fires to
drain systems or overboard. Protection of all the equipment in a module by application of PFP is
rarely practical, so the alternative is to deluge a whole module or section of structure with large
quantities of water.

The water acts to:

• Cool the general area by evaporation of the smaller water droplets ( see also
Section 5.2 where the effects of deluge on different fire types are is described)
• Provide a running film of water onto equipment in the area in order to cool it
• Provide a screen of water droplets as a barrier to radiant heat, thus reducing the
heat load on structures and equipment
• Provide a screen of water droplets as a barrier to radiant heat exposure of people
• Retard the movement of the flame front through a module and consequently reduce
explosion overpressures to some degree (see Part 1 of the Guidance).

For general area cooling the key factors are application rate and water droplet size. If the water
droplets are too small, they evaporate rapidly in a severe fire or can be blown away if the area is
exposed. If the droplets are too large there is less evaporation from fewer droplets and the cooling
is inefficient for the amount of water used. The droplets however are less affected by wind, will
reach the floor, cool and wash liquid spills away and can provide a running film of water over
equipment to keep it cool. Larger droplets however require bigger pumps, more power, and more
AFFF so the cost of the system has to be balanced against its effectiveness. The deluge rate
depends on both the fire scenario and the escalation potential, but the general rules are:
General deluge only protects equipment exposed to flame or/and radiant heat from pool fires or
radiant heat from jet fires providing there is a sufficient deluge rate to provide a film of running
water over the equipment. Where a jet-flame actually engulfs equipment, however, much of the
film is likely to be displaced by the jet flame and the cooling effect lost. Directed water deluge
using high velocity nozzles may be used as trials have indicated an increased effectiveness
against jet fires, Sections 5.2.2 and Section 5.5.2.3 discuss deluge protection options in the
context of jet fires.4.1 discusses this design option in more detail.
• Areas shielded from deluge but exposed to the fire will receive some limited
protection from the heat attenuation of the deluge droplets falling between the
location of the fire and the location of the equipment. Objects subject to thermal
radiation from fires (but not direct fire impact) receive benefit from attenuation of the
water sprays active between the location of the fire and the object (see Section 5.2
and 5.4).
• Suppression of combustion and cooling of the high heat layer in the roof of a
burning module (where the module is partially enclosed) is known to be achievable
by spraying of very fine droplets at roof beam height. At the present time there is no
method for calculating the protection provided by this mechanism,
• The deluge rate and droplet size must be suitable for the cooling mechanism
appropriate to the type of fire. Where there are several different scenarios, the
152-RP-48 Rev 02, Feb 2006 Page 64 of 261
fireandblast.com

deluge rate for the worst-case scenario, should be used as this should cover all
lesser cases. Therefore in the case of enclosed modules with potential for serious,
pressurised oil, gas or condensate fires deluge rates of 20 to 24 l min-1 m-2 would be
needed, with rapid activation and water coverage especially at roof-level where the
high heat will concentrate, However, deluge of high pressure gas jet fires within
enclosed spaces will very likely result in extinction of the fire and could lead to an
explosion hazard.
• Vessel deluge

Further details on appropriate flow rates and other design issue for deluge systems are provided in
Section 7.3.2.4.

3.5.3.2 Mitigation by Sprinkler Systems

These are usually potable water filled systems and provided in areas where the fire-risk is non-
process related and therefore less severe, for example inside accommodation modules. They are
activated by frangible bulbs, which release water directly from the sprinkler piping as soon as the
bulb is broken by the heat of the fire in the area. Design is straightforward by comparison with
deluge systems and is usually in accordance with the applicable NFPA standards.

3.5.3.3 Watermist systems

Water-mist systems are now commonly being used in turbine, generator or pump enclosures to
replace Halon protection systems which are no longer permitted for use. The fine mist is injected
intermittently from pressurised water reservoirs/ cylinders, in roughly 15 second bursts. The mist
provides cooling and suppresses the combustion, which will be also be controlled by lack of air into
the enclosure (provided there is no explosion on ignition). In enclosed spaces, protection systems
need to take account of manning regimes and hence should include warning systems to evacuate
personnel as the mist systems are being armed.

Enclosure type fires tend to be non installation-threatening (but always need due consideration
within the fire and explosion review process for the installation) The protection is usually automatic
and provides immediate control, however there are a limited number of mist-injection cycles
available from the water reservoir and instruction/training for follow-up action by the platform
personnel e.g. fire team action and/or evacuation needs to be covered in platform emergency
response plans.

3.5.3.4 Gaseous systems

Gaseous systems have been a common replacement to Halon systems. Whereas Halon systems
actually disrupted the combustion process, not all replacement media have the same effect.

Replacement gaseous systems are:

• Carbon Dioxide (CO2);

• Replacement low oxygen alternatives (e.g. Inergen ©);

• Replacement Halon alternatives;

These alternatives function primarily by displacing the oxygen from the fire, although in addition,
the CO2 option generates a low temperature upon release which has a cooling effect on the fire.

The fire extinguishing media can themselves present hazards, most notably CO2 which is a
powerful asphyxiant which causes hyper-ventilation exacerbating the hazard.

152-RP-48 Rev 02, Feb 2006 Page 65 of 261

fireandblast.com

Inergen © has specifically been design to provide a “safer” fire-fighting medium within which
personnel can survive, providing only just oxygen to sustain breathing (with some difficulty) but not
enough to sustain a fire.

3.6 Performance standards

3.6.1 Application of performance standards

The fire and gas detection and protection systems on an installation are generally categorised as
safety critical systems, or ‘safety critical elements’ (SCEs) for the installation. In order to pass on
the understanding of the design and operation of each system to those who operate and maintain
the installation, the key features of the systems are recorded for all to see and understand in the
form of ‘Performance Standards’.

The Performance standards for SCEs should contain precise information relating to the
functionality, availability, reliability and survivability of the system in question

It is rare for platforms to have only one type of device within such systems. The ‘Fire and Gas
Detection’ or the ‘Active Fire Protection’ SCEs for example will have many different aspects, parts
or subsystems. While the ‘goal’ of the overall system will be the same, the Performance Standards
for each part of the SCE will probably be different and needs to be specified separately within the
documentation.

3.6.2 Functionality issues

As can be seen from Section 3.4, there are many different types of equipment available for the
purposes of detecting fires and gas releases, and for protecting against fire. The principals of
operation of the various sub-systems vary widely, as do the availability and reliability requirements
of the equipment involved. It is important that the Performance Standard captures all the key
information, not just part of it. In addition it should provide cross references to the various codes,
standards, analyses and guidance documents which have a bearing on the performance.

Some examples of different functionalities within the same SCE Performance Standard are shown
in Table 3-4 below:

Table 3-4 Typical safety critical element functionality descriptions

Typical
derivation/
SCE Sub-item Functionality
supporting
documents
Gas detection 1. Gas detection at inlets Detect low-level gas at 10 % (alarm) and Fire and Gas
system to enclosed areas high-level at 25 % (ESD 1, close dampers, Detection
Goal: containing non-certified S/D fan). 3 IR Point detectors in each duct Philosophy
electrical equipment on 2oo3 voting
Detect loss of
containment 2. Gas detection in open Detect 50 % LEL gas cloud of radius 5m Fire and Gas
events. hazardous areas or more using paired IR beam detection in Cause and Effect
process modules. Confirmed beam-pair Drawings
detection initiates ESD 2.
Installation Safety
Case
3. Acoustic leak Detect gas leaks of 0.1 kg s-1 and above In-house Vendor
detection in process modules. Executive action only Design Code for
on coincident gas detection (by beam Acoustic Detection
detectors) in same area.

152-RP-48 Rev 02, Feb 2006 Page 66 of 261

fireandblast.com

Typical
derivation/
SCE Sub-item Functionality
supporting
documents
Active Fire 1.Water deluge with 12 l min-1 m-2 general area coverage in LP Firewater design
Protection AFFF in Process separator and oil metering modules with at philosophy
Modules including least 3 % AFFF to cool equipment in Installation Fire
communicating vicinity of oil pool fires and prevent and Explosion
mezzanine and deck consequent leakage from other Analysis and
levels inventories. Activated on confirmed Flame Assessment
detection (2ooN) voting. In-house vendor
2. Water mist application Water mist injection to generator rooms to design code for
in Generator Rooms A provide suppression and cooling. Water Mist
and B Activated on confirmed smoke or heat Systems
detection in generator room.
Passive Fire 1.H120 firewalls Firewall at gridline 2, process area Safety Case
Protection boundary, providing protection to TR and Passive Fire
TEMPSC embarkation areas Protection
2. J15 passive fire Fire protection of gas space of First Stage strategy
protection on First Stage Separator to protect against jet fire Document.
Separator impingement from gas export system and Installation Fire
potential BLEVE. and Explosion
Analysis and
Assessment
Note that a jet fire rating has been
proposed in the latest draft version of the Vendor design
ISO (22899-1) on the jet fire test. Code for PFP
suitable for Jet
This is specified as: Fire impingement
Type of application / Critical temperature
rise ( °C) / Type of fire / Period of
resistance (minutes).

3.6.3 Availability issues

These are often given limited consideration in Performance Standards. It is important to

understand the availability issues for any Performance Standard. A significant factor in generating
a systems’ availability is obtaining an estimate of the level of unrevealed failure modes the system
may be subject to.

Just as there are different functionalities there are differing availabilities associated with different
methods or types of protection equipment. Availability is not the same as reliability. The availability
is the fraction of time the equipment is available to perform its intended function. A passive coating
for example is available 100 % of the time (assuming it has not been damaged or degraded in
service). A passive fire protection enclosure or removable cladding on a vessel however may be
removed for several weeks in the year to allow inspection of a valve or NDT of a significant part of
a vessel. Similarly, automatic Fire and Gas detection systems might be keyed out, making them
only partially available during maintenance or project related activities.

It is important that the person responsible for devising the Performance Standard also documents
the assumptions made regarding availability, so that the design intent is correctly understood and
upheld throughout the life cycle of the installation by the operations and maintenance personnel.

Some example maintenance arrangements for safety critical equipment are given below.

• F&G detection system – During period of unavailability of fire and gas detection in an
area due to essential maintenance, local manual surveillance for fire/gas events will be
provided at all times.

152-RP-48 Rev 02, Feb 2006 Page 67 of 261

fireandblast.com

• Evacuation Systems -- Due to jet fire exposure potential, a standby vessel will be on
close standby whenever the installation (normally unmanned) is manned. Manning will
only be allowed within documented weather operating limits (2 m significant wave
height) for Skyscape© evacuation system.

3.6.4 Reliability issues

Reliability and availability are two technical terms that are often confused. Availability has been
explained above. Reliability is the probability that the system or item of equipment will perform its
intended function when required to do so. The reliability details for each system or subsystem
listed within a performance standard should be clearly stared, with reference back to the reliability
studies carried out during the design of the equipment. Changing the frequency of inspection and
maintenance will have a direct bearing on its stated reliability. For this reason the maintenance or
the inspection period used as key input to the frequency figure quoted must also be quoted in order
for the reliability figure to be meaningful. As noted above for availability, it is important to obtain an
estimate of the level of unrevealed failure modes the system may be subject to, preferably from
gathered “own experience”.

It is also important to understand that reliability figures theoretically derived from calculations
involving manufacturer’s data on ‘mean time to failure’ may be over optimistic. It is strongly advised
that platform specific information is used in evaluating equipment and plant reliability. The
manufacturer’s data may have been gained under laboratory conditions and produces times-to-
failure information that may not be reproducible in the real offshore environment or otherwise
represents an amalgam of accumulated data from a range of applications and maintenance
regimes. For example, theoretical calculations for a pellistor gas detection head, using the
manufacturer’s data may imply that an adequate reliability is achieved by a 6 monthly test and
inspection frequency. In reality, if the detector is then placed in an air inlet duct, exposed to salt,
spray, temperature and pressure cycling and vibration, the time to failure in actual service may be
significantly shorter. Where un-revealed faults in safety equipment could occur, test/ maintenance
history must be monitored. If every time the gas detector is tested it fails to operate there must be
immediate feedback to the responsible engineer, that the high reliability indicated in the
Performance Standard is not being achieved. The test frequency should then be adjusted (for
example to a 3 monthly interval) until is can be demonstrated that an appropriate level of reliability
is restored.

Voting arrangements for heat, smoke, flame or gas detectors also have a direct bearing on the
proposed frequency of maintenance interventions. For example, a detection voting system that
requires 1 detection element to be activated out of a total 2 (known as 1 out of 2 and indicated as
1oo2), has only one other item by way of redundancy plus a spurious indication from either item
will cause unit or platform shutdown. It should be remembered that reliability requirements
encompass unnecessary activation as well as failure to activate. The “built-in” redundancy is
unavailable during maintenance of any one item. Industry good practice has converged on
2 out of 3 voting systems (2oo3) which offer a “good” compromise of high reliability of having 3
items available and still leaving a working arrangement in the event of a single item failure plus the
demand rate for spurious indications is lower as a confirmed signal is always required. During
maintenance this arrangement becomes a 2oo2 system. The voting arrangements should always
be stated in the Performance Standards. Where reliance is placed on just one or two detectors to
take executive action a review of the failure modes and the consequences of failure should always
be undertaken and the consequences of maintenance changes need to be evaluated to ensure
there are no knock-on effects to the platforms overall risk profile.

3.6.5 Survivability

The Performance Standard must state the survivability requirements for each SCE and each of its
component parts where there are different requirements to those for the overall system. This
makes it clear to all concerned exactly how long the item will need to continue to function in a
major emergency in order to fulfil its safety role. For example one or more of the communications

152-RP-48 Rev 02, Feb 2006 Page 68 of 261

fireandblast.com

systems and the place of temporary refuge (TR) will be required to function as long as there are
any personnel left on the installation. This may be anything from 10 minutes on a small NUI to 2
hours on a large installation. Individual fire or gas detectors however may only need to survive for
long enough to detect the release or fire and initiate the necessary alarms, shut-downs and
blowdowns. This may be only a few seconds. Valve actuation systems may need around a minute.
Whatever the specified survivability, the information provided in the Performance Standard must be
clear and unambiguous to the reader. Experience from major disasters both on and offshore
indicates that failure to examine, understand and then communicate the survivability requirements
of the provided safety systems to the right personnel has been a major contributor to the disaster.

3.6.6 Written schemes of examination (WSEs) or verification

The detailed schemes of examination or verification required under the PFEER and DCR
regulations are intended to provide an independent check that:
• the initial design of the safety critical system/element is appropriate for the hazard;
• the SCEs have been procured; installed and commissioned to confirm that they achieve
their required function;
• the maintenance being carried out is compatible with the reliability and availability specified
in the Performance Standard;
• the maintenance activity takes into account the likely failure modes (especially un-revealed
failures) of the components.

The written schemes must be thorough. Since they are derived from the Performance Standard
documentation, any essential information omitted from these documents is in danger of being left
out of either the maintenance scheme or the written schemes of the independent Competent
Person, or both. This will lead to gaps in the platform safety management system. Such gaps may
only come to light in the aftermath of a major incident.

The written scheme is required to be “live” through the platform’s lifetime and may be re-affirmed at
any time.

3.7 Methods and approaches to structural analysis

3.7.1 General

The risk level for the installation as defined by the risk matrix given in Section 2.7.4 determines the
level of sophistication required for the fire assessment.

If the conservatism of simplified methods of analysis can be guaranteed, then these could be used
at an early project phase or as a first step in a sequence of analyses of increasing sophistication.

For High or Medium risk installations, a ‘Structural Assessment’ should be performed for a
representative range of fire scenarios. The process and Safety disciplines will generally define
these Scenarios.

A Structural Assessment may be performed at three levels of increasing complexity starting with a
‘Screening Analysis’. Should a structure fail the ‘Screening analysis’ then a ‘Strength level analysis’
will be required. If it fails the Strength level analysis then ‘Ductility level analyses must be
performed. If the Ductility level analysis indicates failure then mitigation measures are required.
These could involve measures for elimination or reduction of the frequency of exceedance of the
initiating event, reduction of the severity of the consequences of the event or structural
modification.

‘Failure’ in the context of fires means failure to satisfy the performance standards for the
installation. High-level performance standards for the installation and safety critical components
152-RP-48 Rev 02, Feb 2006 Page 69 of 261
fireandblast.com

are defined in terms of allowable peak temperature, strain or time to collapse depending on the
method of analysis used.

Screening Analysis, Strength level or Ductility level performance characteristics from an

assessment of one installation may be used to infer the fitness for purpose of other similar
installations, provided the framing, foundation support, service history, structural condition, blast
and fire barriers and payload levels are not significantly different. In cases where one platform’s
detailed performance characteristics are used to infer those of another similar platform,
documentation should be developed to substantiate the use of such generic data.

The required initial level of analysis depends on the Risk level assigned to the installation or the
risk level associated with a representative set of fire scenarios.

The risk category of the installation does not preclude the use of more sophisticated methods of
assessment which may result in reductions in conservatism and hence cost, if they are considered
more appropriate.

Table 3-5 Appropriate method of analysis – fires

Risk level Analysis method Load calculation bases Response calculation

Low Screening Allowable temperature (yield strength Design basis checks.

analysis reduction to 60 % - see Table 3-6 and
Table 3-7 Past experience for
demonstrably similar
Past experience. platforms.

Medium or Strength level Calculate peak temperature member by Strength level analysis,
High analysis member, from nominal fire loads and fire Redundancy analysis
extent.

Ductility level Calculate temperature - time history of Redundancy analysis,

analysis primary members from fire loads time Ductility level analysis
history and flame extent.

A structural ‘Redundancy Analysis’ of a topside structure will indicate which members can be
removed without collapse of the structure. In addition those members not supporting the TR,
muster areas, escape routes or safety critical equipment must survive during and after the fire
event for sufficient time to allow personnel on board to escape, allowing for the possible need to
assist injured colleagues. The results of a fire response analysis will then indicate which structural
members and SCEs must be protected to achieve the fire performance standards for the
installation.

Simple fire response analyses are usually performed based on the following assumptions [3.4].
• Unprotected structural members and panels have no variation of temperature
through thickness or along their length. In practice the critical sections of the
member are considered from the point of view of resistance.
• Fire protected structural members and panels have a constant steel temperature,
the thermal insulation has a linear variation of temperature through thickness.
• Each member may be considered to have reached a steady-state, variations of
temperature are due entirely to changes in boundary conditions and incident heat
fluxes.
• Conduction between members need not be considered (except when considering
coat-back requirements).

152-RP-48 Rev 02, Feb 2006 Page 70 of 261

fireandblast.com

• Thermal stresses due to restraint may generally be neglected as supports also

soften during fire loading.

The methods of analysis identified above are discussed in the following sections.

3.7.2 Screening analysis

A screening analysis for an existing installation consists of a condition assessment which may
involve a survey followed by design basis checks.

Design basis checks consist of checking the basis of the existing design for the installation and
determining if the methods used for the design are currently acceptable in the context of fire
events.

For a Screening Analysis, the Zone method may be used. The Zone method assigns a maximum
allowable temperature that a steel member can sustain. This method does not take into account
the stresses present in the member before the fire. The maximum allowable temperature may be
read from Table 3-6.

These temperature values correspond to a yield strength reduction to 0.6 of the ambient
temperature values. The fact that a fire is an accidental load will mean that the allowable stress is
the full yield stress value as opposed to about 60 % of the yield stress allowed for in the
conventional design load cases. The yield stress corresponding to 0.6 of the ambient yield stress
will then give an allowable stress the same as that for the structure before the fire.

Higher strain levels than 0.2 % may give a proportionately higher decrease in Young’s Modulus
giving an unmatched reduction in yield strength with the reduction in Young’s modulus exceeding
the reduction in yield strength. The Zone method may then not be applicable [3.5].

Fire barriers must perform according to their required rating.

A blanket critical temperature for all members may be postulated as in the Zone method. This
critical temperature is chosen typically to be 400 °C as this requires no modification to the normal
code checks if strains are limited to 0.2 % in an elastic Design Level analysis. This approach may
result in unnecessary protection and may be unconservative locally to areas of high strain.

It will not usually be necessary to protect every vulnerable member unless the scenario
performance standards demand that the installation is required to re-start after a few days. The
above method will indicate the protection of non-essential members from the point of view survival
of the installation.

The temperature calculation for each member is performed and measures are taken to restrict the
temperatures to values below the critical temperature usually by the application of PFP (Passive
Fire Protection).

It will also be necessary to check that radiation levels on escape ways remain at acceptable levels
(i.e. below 2.5 Kw m-2), to allow for personnel on board to escape.

3.7.3 Strength level analysis

Strength level analyses are conventional linear elastic analyses as used in design against
environmental, operating and gravity loads. The loads used in such an analysis should be in a form
which could be interpreted as a load case as used in the design process.

In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be
taken as 75 % of their maximum values as is the case for the consideration of Earthquakes.
Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the
installation if these have been properly derived.
152-RP-48 Rev 02, Feb 2006 Page 71 of 261
fireandblast.com

The transfer of conclusions and load characteristics from the analysis of a geometrically similar
platform with similar structural and process characteristics is acceptable for strength level
analyses.

In a strength level analysis a maximum allowable temperature in a steel member is assigned

based on the stress level of the member prior to the fire such that the utilization ratio remains less
that the corresponding value given in Table 3-6 below.

The maximum allowable temperature in a steel member as a function of utilization ratio is given in
Table 3-6 below.

Table 3-6 Maximum allowable steel temperature as a function of Utilisation Ratio [3.6]

Member UR at 20 °C to give
Maximum Member Temperature Yield Strength Reduction Factor UR = 1
at Max. Temperature

°C °F
400 752 0.60 1.00
450 842 0.53 0.88
500 932 0.47 0.78
550 1022 0.37 0.62
600 1112 0.27 0.45

If the primary structure on the installation have been designed for all credible fire scenarios to then
the primary structure will be acceptable from a fire resistance point of view.

Higher strain levels than 0.2% may give a proportionately higher decrease in Young’s Modulus
giving an unmatched reduction in yield strength and Young’s modulus. Strength level checks may
then give utilization ratios above unity. A Ductility level or ‘elastic-plastic’ method of analysis may
be required.

Table 3-7 gives the maximum allowable steel temperature as a function of strain. The peak
temperature of each member needs to be determined for the fire event to check if the structural
response remains elastic.

Table 3-7 Maximum allowable temperature of steel

Maximum Allowable Temperature of Steel

Strain %
°Celsius °Fahrenheit

0.2 400 752

0.5 508 946
1.5 554 1029
2.0 559 1038

Fire barriers must perform according to their required rating.

3.7.4 Scenario or performance based strength level analysis

In a performance or scenario based approach, the first task involves the definition of credible fire
scenarios from the failure probabilities of vessels and piping, the inventory pressures local to the
release point, the material released, the emergency shut down systems available and the
152-RP-48 Rev 02, Feb 2006 Page 72 of 261
fireandblast.com

ventilation conditions. This information will normally be supplied by the Safety and Process
disciplines.

A scenario based Strength level analysis is performed in the following general stages:

• Definition of a fire scenario. (See Section 3.2 “Fire types and scenarios”).

• The time history of the rate of release is calculated.

• If required, the probability of occurrence of the release can be estimated from published failure
statistics and the numbers of past failures which are available for most types of vessels,
flanges and process equipment generally [3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13].

• Calculation of the burning rate for the fire geometry enables the extent and duration of the fire
to be determined.

• The heat output from the fire in terms of radiation and the convection of hot air and gases may
then be determined (see also Sections 5.3, 5.4 and 5.5).

• The heat incident on structural members and panels may then be used to calculate the
temperature/time history of the member (see also Sections 5.4 and 5.5.3).

• For load bearing members, the temperature determines the appropriate values for the yield
stress and Young’s modulus of the material of the member to be used in the structural analysis
performed.

• For panels and firewalls, which are usually non load bearing, the important parameters are the
temperature of the cold face and the time to reach certain limiting temperatures which
determine the walls’ rating.

It will also be necessary to check that radiation levels on escape ways remain at acceptable levels
where immediate injury will not caused (i.e. below 2.5 kW m-2).

A utilization ratio of up to 1.7 will be acceptable for members loaded in bending if a small amount of
plastic deformation is acceptable. A different utilization ratio will be appropriate for detection of
buckling. Shear stresses should be kept within the yield stress for the material at that temperature.
Alternatively the yield stress may be enhanced by a factor of 1.5 to take account of the fact that fire
is an accidental load.

Modified code checks may be made on the structural members and if load re-distribution is
neglected then the material effects and isolated plasticity may also be taken into account in the
analysis.

The occurrence of plastic hinging may be taken into account by factoring the acceptable utilization
ratio by the ratio of the plastic ‘Zx’ to elastic section modulus ‘Sx’. This factor is generally greater
than 1.12 and will be in the range 1.1 to 1.5. The member must be able to sustain the formation of
a plastic hinge before buckling, i.e. be in tension or be a ‘plastic’ section.

Use of the critical temperature approach may give an efficient scheme for the application of PFP in
combination with a full non-linear elastic-plastic (progressive collapse) structural analysis. This type
of analysis is referred to as a ductility level analysis for fire or explosion response calculations.

3.7.5 Redundancy analysis

An elastic linear analysis is performed to determine the minimal structure which will fulfil the
requirement that escape ways will remain available for sufficient time to allow escape and that the
TR integrity is maintained during and after a fire event.

152-RP-48 Rev 02, Feb 2006 Page 73 of 261

fireandblast.com

A structural redundancy analysis will determine which members are essential for the above.
Protection of these members with PFP will complete the assessment on the basis of a redundancy
analysis.

The determination of the critical structural members may be performed using an elastic structural
frame model as follows:

• Eliminate all non-critical structural elements by inspection, with due regard to escalation
potential;

• Remove all members identified in step 1;

• Modify the static loading to represent the probable load at the time of the fire 75% of the loads
associated with process contents and storage may be used as suggested for Earthquake
analysis [3.14];

• Remove safety factors in the code check, enhance the yield stress by a 1.5 factor, or allow a
correspondingly higher utilization;

• Identify those members with the highest utilization ratios - particularly relating to stability using
the frame model;

• Remove these members from the geometry;

• Repeat step 6 and assess the remaining structure at each stage.

3.7.6 Ductility level analysis

A ductility level analysis may be required for Medium or High Risk installations. This method of
analysis can take into account the load re-distribution which takes place when structural
components fail and the time to failure of the structure considered.

A number of options for the linearization of stress/strain relationships at elevated temperatures

exist. If the software used for the ductility level analysis allows temperature dependent stress/strain
curves to be input then the linearization will not be necessary.

The levels of heat radiation and convection from the selected fire scenarios are calculated and the
time history of the increase of temperature of the structural components is derived. Conduction of
heat from neighbouring structural components will also occur but may generally be ignored in the
primary framing analysis. Methods of performing these calculations are discussed in the various
parts of Section 6.

Once the steel temperature at a given time is known, the reductions in yield stress and Young’s
modulus may be calculated.

Failure of a structural member is defined as collapse (where increasing displacement results in no

net increase of capacity) under the imposed static gravity and operating loads.

In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be
taken as 75 % of their maximum values as is the case for the consideration of Earthquakes.
Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the
installation if these have been properly derived.

Optimization of PFP (passive fire protection) thickness is rarely worthwhile as application of PFP to
a given thickness is not sufficiently controllable. The thickness of PFP is controllable at best to
within about 3 mm.

152-RP-48 Rev 02, Feb 2006 Page 74 of 261

fireandblast.com

The scenario based strength level analysis method will not detect failures at intermediate or later
times caused by thermal restraint from cold members. This is, in any case, an unlikely event in the
context of offshore topside structures. Imperfections or deflections for example due to a previous
explosion will not be taken into account. It will be necessary to use a ductility level analysis to take
these effects into account.

In view of the fact that a single scenario is only one among many, the spatial variation of thermal
loading is not generally meaningful. It is unlikely that this level of analysis will be necessary unless
a single extreme event such as a riser failure or blow-out which puts the whole installation at risk is
being considered.

It will also be necessary to check that radiation levels on escape ways remain at acceptable levels
(i.e. below 2.5 kW m-2).

3.7.7 Assessment of fire barriers

Fire barriers are given a ‘rating’ derived from the SOLAS (Safety of Life at Sea) [3.3] classification
system for use on ships. Originally they were developed for cellulosic fires as opposed to
hydrocarbon fires, which are more severe. The type of fire is represented in a furnace test where
the firewall is in contact with a furnace with a well-defined temperature/time relationship. The
hydrocarbon fire curve has a higher rate of temperature rise and attains a higher peak
temperature.

The three main ratings used offshore are:

B Maintains stability and integrity for 30 minutes when exposed to a cellulosic fire. The
temperature rise of the cold face is limited to 140 °C for the period in minutes specified in
the rating. i.e. A30 has a 30 minute time period during which temperature rise is below
140 °C.

A Maintains stability and integrity for a period of 60 minutes when exposed to a cellulosic fire.
The temperature rise of the cold face is limited to 140 °C for the period specified in the
rating.

H Maintains stability and integrity for a period of 120 minutes when exposed to a hydrocarbon
fire. The temperature rise of the cold face is limited to 140 °C for the period specified in the
rating.

J Currently proposed one in latest draft version of the ISO (22899-1); identifies Type of
application / Critical temperature rise (°C) / Type of fire / Period of resistance (minutes)

Here retaining ‘stability and integrity’ means that the passage of smoke and flame is
prevented and that the load bearing components of the barrier do not reach a temperature
in excess of 400 °C.

Insulation failure is also deemed to occur when the average temperature rise on the
unexposed face of a separating element exceeds 140 ºC or the maximum temperature rise
exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of any
material which may be close to the unexposed face. Their origins are unknown and, in
many cases, the limits may be excessively conservative.

152-RP-48 Rev 02, Feb 2006 Page 75 of 261

fireandblast.com

3.7.8 Approaches to analysis methods by risk level

3.7.8.1 Overview of installation/compartment risk screening

Installations are subject to different levels of risk, based on the severity of the fire, its potential
duration and the installation’s vulnerability to the event. The severity and duration of the fire will be
functions of process flow rates, pressures and inventory. The potential vulnerability of the
installation will be a function of layout, manning levels, location and age etc.

A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix of
potential consequence versus frequency or likelihood of an accident or event, and such a matrix is
illustrated below (Table 3-8).

The overall categories of 3 published documents are shown; the documents are issued by
UKOOA, API and ISO [3.15, 3.16 and 3.17], the notation differs between the three documents and
has been adjusted for comparison purposes.

Other practitioners make use of a 5 X 5 matrix, the choice of preferred level of refinement should
be dependent on the Duty Holder’s corporate background and their experience with the use of
qualitative risk assessment. A 5 X 5 matrix will obviously offer a greater degree of refinement, the
choice of refinement should be governed by the motive for the analysis, for example, a ranking
exercise for a number of competing feasibility options could easily make use of a 3 X 3 matrix,
whereas, making a decision on a protection option would benefit from the use of a 5 X 5 matrix.

The higher the risk (likelihood x consequence) in an installation or compartment the greater should
be the rigour that is employed to understand and reduce that risk, this may entail choosing more
comprehensive methods and analysis tools. The solutions and protective measures for the
installation with greater risk should be able to bear greater scrutiny, from both the Duty Holder and
the regulator’s point of view.

All three documents use risk matrices for risk screening.

Table 3-8 Risk matrices from the three documents

UKOOA API ISO

Consequence Consequence Exposure level

H M L H M L L1 L2 L3

H H H M H H M H H M
Likelihood
/ M H M L H M L H M L
Probability
L M L L M L L M L L

152-RP-48 Rev 02, Feb 2006 Page 76 of 261

fireandblast.com

There is a large degree of similarity between the three documents, the differences in notation and
the differing treatment of the outcomes (risk) are summarised in Table 3-9 below.

Table 3-9 Notation and treatment of outcome of risk matrix by document

Notation UKOOA API ISO

Likelihood/Probability Likelihood Probability of occurrence Probability of exceedance

H High Higher Risk level 1 (L1)
M Medium Medium Risk level 2 (L2)
L Low Low Risk Risk level 3 (L3)

Outcome UKOOA API ISO

H Requires high (Higher risk) Significant risks which are

sophistication analysis Risk level must be reduced. likely to require
Assess structure by prevention, control,
considering scenario/event mitigation
based approach

M If nominal loads apply, If nominal loads apply, use Risks require further study
use them otherwise them otherwise high to define probability,
high sophistication sophistication analysis consequences, cost
analysis
L Use low sophistication Low risk need not be Insignificant or minimal
analysis, elastic considered further risk which can be
analysis (nominal loads) eliminated from further
consideration

It is also appropriate to note that uncertainties and/or sensitivities should be considered as part of
the level of rigour of analysis chosen (based on the risk ranking). The uncertainties and
sensitivities should also dictate the approach to the ensuing analyses. For example, a
precautionary approach may be adopted where data are limited, the design is novel or manning
levels are higher, (more than say 50, one TEMPSC load).

3.7.8.2 Low fire risk installations

Where the fire risk category for the installation is low, the low risk methodology may be used. This
applies not only to the definition of the fire hazard but also to methodologies in handling the
response of structures, piping, and other SCEs.

A suitable low sophistication means of defining the fire hazard is the use of valid nominal fire loads
available in published codes and Guidance [3.18, 3.19 and 3.20] in the form of averaged and
maximum heat fluxes. Sections 5.4 and 5.5 contain tables of revised nominal fire loads based on
the results of recent research.

Another acceptable means of fire severity determination for low risk installations is comparison with
a specific past cases. Such comparisons should be supported by evidence that a structured
assessment has been undertaken to identify areas of difference and that the original means of
calculation were sound.

152-RP-48 Rev 02, Feb 2006 Page 77 of 261

fireandblast.com

Extrapolation of data for the relevant parameters is not generally recommended but may be valid if
a sound basis exists. The comparison process would incorporate consideration of the following
factors:

– The validity of the model used in the initial assessment;

– The version of the fire modelling software used;

– The resolution and precision of the grids used in the calculation if a computational fluid
dynamics or CFD method is used;

– Consideration of any substantial physical differences between this and previous cases.

The nomination of a typical installation to represent a fleet of platforms may be acceptable

3.7.8.3 Medium fire risk installations

Where there are no suitable past cases for comparison, then the level of analysis appropriate for
high risk installations should be used for fire hazard assessment. Therefore, it is recommended
that for medium risk installations the choice of methodology for any particular task should be
justified where it deviates from the high risk installation methodology.

3.7.8.4 High fire risk installations

Where the potential risk level on an installation or within a compartment is high, this will warrant a
commensurately high sophistication level of analysis. The ability of the installation and the safety
critical systems on it to withstand the fire scenarios need to be accurately determined as any error
could have a significant risk impact. The time before failure may also be an important
consideration.

This level of analysis would normally involve:

– A complete set of fire scenario investigations;

– A combination of CFD and phenomenological fire simulation with knowledge of the

frequencies of release and ignition;

– Determination and assessment of the structure and SCEs against the design fire loads
including consideration of escalation potential;

– Time dependent and possibly non-linear modelling of the installation and systems
response.

Escalation and interaction between fire and explosion scenarios shall be considered including the
collapse of tall structures.

3.8 Particular considerations for floating structures, storage and offloading

systems
3.8.1 Introduction

Floating structures for production, storage and offtake have been used safely and reliably
throughout the oil industry for many years. Early installations were primarily floating storage and
offtake vessels, “FSO”, but today the modern floating production, storage and offtake vessel,
“FPSO”, includes processing equipment and a higher level of sophistication. Consequently, the
FPSO becomes an offshore producing installation, storage facility, and loading terminal all rolled
into one unit.

152-RP-48 Rev 02, Feb 2006 Page 78 of 261

fireandblast.com

The early “ship-shaped” vessels, developed in the 1980s, took advantage of a severe downturn in
the tanker market and were converted from relatively new tankers. More recently, the tendency has
been to use new, purpose-built, ship-shaped hulls, particularly for FPSOs associated with long
lived projects. Conversions of tankers, both old and new, continue to take place. There are many
different types of design, weather-vaning with internal or external turrets or spread moored that
maintain a fixed orientation.

The FPSO and the FSO present many of the same hazards to personnel and the environment,
although the added complexity of production facilities on the FPSO increases associated risk.

The guidance in this section relies heavily on the published guidance of UKOOA, [3.21] and the
draft guidance being prepared by OGP [3.22]. This guidance document will adopt the OGP
nomenclature and when considering an issue applicable to both types of floating installation will
use the term F(P)SO.

A number of features impact fire related hazards on floating installations; for example, the
geometry of the layout, compartmentalisation, operations, fire scenarios, response characteristics
of marine construction to fires and the vulnerability of marine systems associated with the motion,
station keeping and stability. The effects of fire on these features are discussed further in the
following sections.

3.8.2 Marine life cycle considerations

F(P)SOs usually consist of a marine structure supporting process and utilities decks of a
conventional offshore construction. These differing methods of construction are governed by
differing regulatory regimes. For the UKCS, the application of SOLAS and MODU codes without
demonstration of validation by the additional risk assessments normally required by PFEER will be
insufficient for the treatment of fire events.

Some specific attributes to be considered on F(P)SOs are;

• Fire-fighting in the enclosed compartments containing marine systems (e.g. engine
rooms, DP control rooms, generators); fire fighting techniques will include inerting,
with the ramifications this entails for personnel access and the requisite alarms
• As the process and utilities modules are normally located above the vessels deck
(and the cargo storage), the process and utilities deck areas will be large, usually of
one or two levels. Segregation to avoid escalation of a fire can be achieved by
separation of modules occasionally further separated by fire barriers, (this may or
may not help explosion overpressures but will impair the dispersion of released
hydrocarbons).
• The fire risk analysis undertaken on F(P)SOs will consider the nature of the
hydrocarbon fuel source as well. Due to the nature of the storage on F(P)SOs, the
fields they are generally use for tend to be crude that can be stabilised fairly readily.
F(P)SOs may be required to hold stored product in their cargo tanks for typically 3 to
7 days dependent upon their geographic location. The F(P)SO solution is therefore
less favoured for more volatile reservoirs.
• The (potentially) long process and utilities decks and their orientation with respect to
wind conditions will be affected by the weather-vaning of the F(P)SO. The top decks
should be designed to follow a hazard gradient from the most hazardous area with
respect to fires (and explosions) to the least hazardous. This will generally be from
the turret outwards. Due to the weather-vaning effects (either due to wind or current
and their effects on the superstructure height and hull draft) the fires can escalate
downwind and at the very least, toxic products of combustion will be distributed
downwind. The layout should consider these additional hazards and the design
should accommodate them to maintain levels of safety. (Some designs have used
DP to adjust the F(P)SO orientation in the event of a release or a fire hazard

152-RP-48 Rev 02, Feb 2006 Page 79 of 261

fireandblast.com

although the DP then becomes a Safety Critical Element and subject to the
development of Performance Standards and integrity assessments required in the
UKCS.)
• On an F(P)SO, escape routes and piping runs may be very long and tortuous and
personnel may need to pass the origin of the incident to reach the Temporary
Refuge. Consideration in the design of escape over long distances during incidents
and incident escalation should be a key issue.
• Fire water mains will also be extensive and distant from the fire pumps in the
process area. Correct fire-pump sizing and firewater-main hydraulic analyses will be
required to ensure adequate pressure at deluge points, hoses and monitors.
• Buoyancy, stability and station-keeping must be maintained at all times, and the
systems associated with these duties must be protected from fire hazards.

F(P)SOs also require specific consideration of major fire hazard and release scenarios unique to
their design and operation.
• Oil storage tanks – May present hazards in the form of either large scale storage of
stabilised crude or with empty storage tanks containing potentially explosive
mixtures.
• Non-process hydrocarbon inventories – The F(P)SO is a power-hungry installation
and requires substantial stores of diesel to maintain station, process and utilities
power demands plus other life-support systems. The vessels are often located in
difficult or remote places and will generally be designed to be “self-sufficient” for
extended periods in the event that supply vessels cannot reach them.
• Jet fires on main deck – The process decks on F(P)SOs are often lifted clear of the
cargo storage tank roof for several reasons, (see bullet points below) a 5metre gap
is not uncommon. The space provided also allows jet fires from the underside of the
process to reach other process or utility modules without any impingement to reduce
the effect of the flame. The gaps provide other risk reducing and operational
benefits but steps can be taken to reduce the likelihood of jet fires by careful layout
and orientation of the higher pressure equipment.
• A gap will allow “green water” to flow over the main deck without placing an
excessive load on the process modules supports by creating restrictions and eddy
current effects.
• A gap allows a clear and uninterrupted space for long piping runs (both process
piping and storage tank vent and balancing lines)
• A gap allows personnel access across the vessel, both for normal operational and
maintenance access as well as facilitating emergency response.
• Swivel connections, a source of releases – The turret contains a large number of
swivel joints in order to function, these are often at the highest process pressure and
pass the reservoir fluids prior to any cleaning or conditioning and are therefore
subject to the F(P)SOs most onerous process duty.
• Offloading and pool fires on the sea – Offloading to shuttle tankers is a regular event
and poses a significant risk both on the F(P)SO and the shuttle tanker. The risks
comprise the breakage or leakage of the transfer hoses and the potentially
flammable mixing of hydrocarbon and air in the storage holds of F(P)SO and shuttle
tanker. During the offloading operation, the shuttle tanker and F(P)SO are in relative
proximity and the risks on either vessel are compounded by increased potential for
escalation to another vessel.

152-RP-48 Rev 02, Feb 2006 Page 80 of 261

fireandblast.com

3.8.3 Application of fire hazard management to floating structures

3.8.3.1 Topsides considerations

The storage and transfer of hydrocarbons on F(P)SOs present particular hazards to personnel and
the environment and some of these have been listed above. This sections describes further
measures that can be applied to the management of fire hazards in the F(P)SO topsides.

There is a need to continuously vent hydrocarbon vapours during loading, it is important that the
venting system be designed to accommodate the maximum volume of volatile organic compounds
(VOCs) vented from storage. Allowance must be made the higher temperatures the vents will
experience when venting during maximum production rates and as well as providing design
allowances for possible process upsets. In some areas, local regulations or guidelines limit the
amount of VOCs that may be released to the atmosphere. It is always good practice to adopt
loading procedures that will minimise VOC emissions.

The atmosphere in the F(P)SO tanks is to be maintained in a ‘non explosive’ condition. The normal
method is to supply low oxygen content combustion products to the tanks from boiler uptakes or
from an independent oil or dual fuel generator.

Cargo tank purging must be carried out before introducing air to the tank to ensure that the
atmosphere will at no time enter the flammability region. The guidelines given in Chapter 10.0 of
ISGOTT [3.23] should be strictly adhered to during this operation.

F(P)SOs need special consideration due to the potential venting of hydrocarbons either near the
process plant or near the flare stack. Calculations will have to be made at the design stage to
ensure that carry over of hydrocarbons from the inert gas stack will not interfere with day to day
operations.

It is recommended that the inert gas system comply in all respects with the requirements of SOLAS
and the relevant IMO guidance notes. Prudent operators may also consider maintaining
100 % redundancy for this critical component.

After purging, the tank must be gas freed in order to remove the residual inert gas from the tank
and replace it with a normal atmosphere containing 21 % Oxygen.

The issue of VOC return lines and their use during offloading represents a key safety issue. The
operation of VOC reclamation represents a highly hazardous situation where flammable mixtures
of hydrocarbons are returned to the F(P)SO. An added complication is that the offloading and
reclamation systems may often be combined as a dual hose system and for F(P)SOs with stern
accommodation, the offloading and reclamation point may be located close to the accommodation
and TEMPSC.

Due to the longer term storage (compared with most other offshore installations), water and other
contaminants in the crude can accelerate corrosion of the F(P)SO storage structure and systems
resulting in premature failure and, potentially, escape of hydrocarbons. Design allowances should
not be based on ideal crude conditions but should consider a realistic appreciation of operational
practices.

3.8.3.2 Vessel and marine considerations

The layout of surface and sub-sea facilities must be carefully considered early in the design to
account for the following shipping related hazards (that may give rise to loss of integrity and fire):
1. Passing ships and local community activities, such as fishing;
2. Supply and maintenance vessels in relation to anchoring or dropped objects;
3. Anchor mooring patterns of drilling rigs during locating and moving;

152-RP-48 Rev 02, Feb 2006 Page 81 of 261

fireandblast.com

4. Safe access by offtake tankers, avoiding interference with other moorings, flowlines and
risers as well as other field operations.

The field layout must also consider the need for offtake tankers to approach the F(P)SO, moor,
load their cargo, unmoor and proceed to open waters, always in safety. The parameters for
achieving this, which will include manoeuvring areas and weather limits on operations for the
tankers, may be derived by means of a risk assessment study as described in OCIMF Offshore
Loading Safety Guidelines [3.24] – With Special Reference to Harsh Weather Zones. Additional
reference material for Offshore Loading may be found in UKOOA’s guidelines for tandem
off-loading from FPSOs/ FSUs to shuttle tankers, [3.25].

Thrusters may also be useful in fire or platform abandonment scenarios where the vessel can be
rotated to clear fire or smoke from around production areas and living quarters and to provide a lee
side for survival craft launch. It should also be noted that thrusters may well be Safety Critical
Elements.

Due to the vessels being in very close proximity, the risk of a fire or explosion on one vessel
affecting the other is greatest during offloading.

It is important that the F(P)SO is equipped with emergency shutdown and release equipment that
will allow the vessels to part in the event of an emergency on one vessel.

3.9 Particular considerations for mobile offshore units

3.9.1 Introduction

Units that work in the North Sea will generally conform to three types of which two are more
common. Ship-shape units are not often used for drilling, as their motion characteristics are often
not suitable for drilling in harsh weather. A small number of construction and well intervention
vessels work in the calmer weather months.

Most MOUs in the North Sea are of two types, Semi-submersibles and Jack-ups. Semi-
submersibles have more in common with floating structures while jack-ups have more in common
with fixed structures. This specialist subset is termed Mobile Offshore Drilling Units, or MODUs.

Though they are fundamentally different from each other, they do have one thing in common. They
are vessels subject to the Conventions and Codes of the International Maritime Organisation, or
IMO, and thus emanate from a long-standing marine tradition.

3.9.2 MODU classification

The UK Safety Case Regulations do not stipulate design safety cases for MODUs. However,
MODUs are subject to Classification Society rules for design, construction, and operation.
Generally, certificates are subject to renewal every five years with intermediate surveys of a less
intrusive nature ranging from every year to every two and one-half years. General areas of interest
with respect to fire hazards include such items as:
• Structural fire protection layout plan for decks and bulkheads;
• Fire extinguishing systems;
• Recommended sequence of emergency shutdowns;
• Hazardous areas.

152-RP-48 Rev 02, Feb 2006 Page 82 of 261

fireandblast.com

The ABS published Classification Guidance contains a whole chapter on Fire Safety Features,
including:
• Fire control plans;
• Fire pumps;
• Fire main;
• Hydrants, hoses, and nozzles;
• Fixed fire fighting systems;
• Extinguishing systems (CO2, foam, water spray, portable extinguishers, etc.);
• Fire detection/alarms;
• Gas detection/alarms;
• General alarm;
• Area or specific alarms;
• Fireman’s outfits;
• Other PPE;
• Helifuel;
• Paint lockers.

Any reader will quickly note there is a distinctly marine “feel” to the rules. This is appropriate as
hydrocarbons are seldom present on MODUs as much of their time is spent in transit between
locations, thus the threat of types of fires that occur on ships is given attention. In the main,
Conventions and Codes of the IMO are meant to apply to vessels on international voyages, not
when the vessel is undertaking its industrial function. Though these rules are prescriptive, the great
number of ships in the world’s fleet lends of validity through experience.

Marine tradition refers to conventional ships on long distance voyages who must cope with
mishaps such as shipboard fires and explosions with faint prospects for immediate rescue. This
tradition has within it the experience of thousands of ships but scant experience of live
hydrocarbons. Perhaps it is best characterised as highly worthy knowledge in its own right but not
directly coincident with the newer oilfield traditions.

Obtaining and remaining in class is very important for a MODU. Otherwise, it would not be able to
obtain hull insurance. Minimising losses is important for underwriters so MODUs are able to benefit
from loss reduction strategies of the world’s fleet of ships, and the considerable reservoir of
experiences thus represented.

3.9.3 Conventions, codes and regulations

3.9.3.1 General

MODUs are also subject to flag-state rules for operation under the conventions (roughly equivalent
to regulations) and codes (roughly equivalent to guidance) of the IMO. The flag-states are
responsible for enforcing the conventions and codes of the IMO through their national legislation.
The most significant IMO instruments are the international conventions for:
• Safety of Life at Sea (SOLAS) [3.3];
• Prevention of Pollution from Ships (MARPOL) [3.26];
• Load Lines (LL) [3.27];
• Standards of Training, Certification and Watch-keeping (STCW) [3.28];

152-RP-48 Rev 02, Feb 2006 Page 83 of 261

fireandblast.com

• Preventing Collisions at Sea (COLREG) [3.29];

• Tonnage Measurement (Tonnage 69) [3.30].

For the purpose of this guidance, SOLAS is the most relevant and receives expanded treatment.
Two versions of IMO MODU Code are also important, the 1979 and 1989 versions of the Code for
the Construction and Equipment of Mobile Offshore Drilling Units [3.21, 3.32], or MODU Code
[3.33], covered later in this section.

3.9.3.2 SOLAS

SOLAS Chapter II Construction – Subdivision and stability, machinery, and electrical installations

The parts of interest (within SOLAS) are:

Part D – Electrical Installations: Precautions against shock, fire, and other hazards of electrical
origin

Part E – Additional Requirements for periodically unattended machinery spaces: Fire precautions,
alarm system, safety system, and special requirements for machinery, boiler, and electrical
installations

SOLAS Chapter II – Fire protection, fire detection, and fire extinction

The whole of Chapter II is relevant. Coverage includes:

• fire pumps;
• fire mains;
• hydrants/hoses;
• fixed gas fire-extinguishing systems;
• fire-extinguishing arrangements for machinery spaces;
• foam systems;
• water systems;
• arrangements for fuel/lubricating oil/other flammable oils;
• ventilation;
• fire control plans, etc.

Details for passenger ships, cargo ships, and tankers are given and will be of interest for
informational purposes.

3.9.3.3 MODU code

There are two versions of the MODU Code. The 1989 Code [3.34] is meant to be applied to units
constructed after 1 May 1991. The 1979 Code [3.35] applies to earlier units. The 1989 Code
addresses fire/explosion safety in the following chapters: -

Chapter 4 – Machinery installations for all types of units

4.7 – Arrangements for oil fuel, lubricating oil, and other flammable oils

Chapter 5 – Electrical installations for all types of units

5.5 Precautions against shock, fire, and other hazards of electrical origin

152-RP-48 Rev 02, Feb 2006 Page 84 of 261

fireandblast.com

Chapter 6 – Machinery and electrical installations in hazardous areas for all types of units

6.1 to 6.7 – Zoning of hazardous areas and the types of machinery in these areas

Chapter 8 – Periodically unattended machinery spaces for all types of unit

8.3 – Fire safety

Chapter 9 – Fire safety

1 to 13 – Structural fire protection, accommodation, means of escape, fire

pumps/mains/hydrants & hoses, systems in machinery spaces, portable extinguishers, fire
detection & alarms, gas detection & alarms, firemen’s outfits, helicopter facilities, storage of gas
cylinders, and miscellaneous items.

3.9.4 Overview of MODU operations on the UKCS

MODUs operating in the North Sea area are generally prepared to drill a range of wells of different
types in order to meet the needs of the client oil companies. Though there are fire risks from
flammable materials on MODUs, about half the risks with the greatest consequences are
presented by the hydrocarbon accumulation the MODU has been hired to exploit. The Formal Risk
Assessment required in a UK or North Sea safety case overlays all the provisions from fire and
explosion protection that Classification, the flag-State rules, and MODU Code. However, there are
two main differences.

• The rules emanating from the IMO are prescriptive. The risk reduction model is the
marine industry acting on the experiences of the world’s shipping fleet.

4. The model of model of application is for ships on international voyages, not vessels
undertaking industrial processes.

3.9.5 The UK safety case

Generally, oil companies hire MODUs to pursue drilling campaigns. The campaigns can be short
(one well of less than 30 days duration) or as long (3 years or longer on rare occasions). In the UK,
it will be necessary to for the MODU to have an accepted safety case before drilling can begin. The
main hazards a MODU faces are listed below:
• Helicopter crash;
• Fire;
• Explosion;
• Major mechanical failure;
• Blowout;
• Toxic release;
• Dropped object;
• Structural failure;
• Mooring failure;
• Ship collision;
• Loss of stability;
• Towing incident.

152-RP-48 Rev 02, Feb 2006 Page 85 of 261

fireandblast.com

The most serious of these incidents requires a PFEER Assessment [3.35] in order to be sure the
personnel can escape to a place of safety. The assessments MODUs generally undertake are as
below. It is worthwhile pointing out that the MODU Owner will generally engage the crew in a
compartment-by -compartment analysis for fire and explosion risk. This utilises the greatest asset –
the rig crew who are exposed to the risk. Following from this approach, the qualitative method is
preferred. Such QRA as takes place is generally done to meet statutory requirements for integrity
of the Temporary Refuge. The QRA calculations are most often done by consultants outside the
MODU Owner’s organisation. The crew are generally not in the habit of assimilating such
information.

Table 3-10 Typical hazard list showing preliminary PFEER assessments

Fire &
Item no. Type of event explosion Comments and description
consequences

1 Shallow gas Yes MODU Owner depends on the client oil

blowout, subsea company site selection and shallow gas
detection by seismic plus experience in the
area (if available)
2 Shallow gas Yes Usually occurs when the riser is attached
blowout in the (semi) or drilling out the first (structural) string
cellar deck of pipe (jack-up). Same comments as shallow
gas blowout, subsea, above, apply.
3 Reservoir blowout Yes The client oil company’s drilling programme
at drill floor is required to analyse and predict reservoir
content (gas or oil), pressure, and
temperature, any other relevant
characteristics.
4 Toxic gas release No This scenario is meant to cover precautions
against the toxic effect of H2S on personnel.
MODU Owner depends on the client’s drilling
programme.
5 Gas Yes Caused by gas entrained in the drilling mud.
release/ignition in Consequences are more severe for oil-based
mud processing mud. MODU Owner “works as directed” by
areas the oil company and thus depends on oil
company’s drilling programme and
consultation with his site personnel to predict
the likelihood of and to control this event.
6 Well test area Yes Occurs during flow testing of wells only.
fire/explosion
7 Accommodation Yes Covered by class, flag-state rules, and
fire MODU Code
8 Machinery space Yes Covered by class, flag-state rules, and
fire/explosion MODU Code
9 Helicopter crash No Client’s standby vessel covers this scenario
into the sea
10 Helicopter crash Yes MODU helideck requirements are the same
on the installation as for fixed producing installations, per ICAO
rules for design, augmented by such
instruments as CAP 437 [3.36] in the UK.

152-RP-48 Rev 02, Feb 2006 Page 86 of 261

fireandblast.com

Fire &
Item no. Type of event explosion Comments and description
consequences

11 Collision No MODUs have provisions for survival in

damaged conditions. They rely on the client
oil company to provide information such as
proximity so shipping lanes and on the client-
contracted standby vessel to warn errant
vessels away.
12 Structural failure No Covered by Class, flag-state rules, and
due to extreme MODU Code
weather
13 Mooring failure No Covered by Class, flag-state rules, and
MODU Code
14 Loss of stability No Covered by Class, flag-state rules, and
MODU Code
15 Loss of control in No i.e. loss of towline
transit
16 Man overboard No Client’s standby vessel covers this scenario.

Half of the events above that cause most serious concerns on a MODU involve fire and explosion.
This is a very significant proportion. Thus, the question occurs as to how the fire and explosion
expert(s) might apply themselves to reducing the risks MODUs face. The information given below
is meant to stimulate further consideration. Particular circumstances and personnel roles will have
large roles to play.

From the hazard events itemised above in Table 3-10, it can be seen that of 16 event categories, 8
consider fire (and explosion) events. Event categories in item numbers 1, 2, 3, 5 and 6 are caused
by well upsets and three of the remaining hazard categories consider non-well events such as;
• Accommodation fire
• Machinery space fire/explosion

Which are covered by classification, flag-State and MODU Code, and:

• Helicopter crash on the installation.

Which is common to all installations and is considered by the design guidance in CAP 437. The
inspection of helidecks is covered by BHAB inspection of the installation.

3.9.6 Pre-hire surveys

Many oil companies use 3rd party inspectors to perform pre-hire checks on the rigs they intend to
contract. The items listed below cover many equipment categories that the surveyors generally
cover which will have an impact on fire and explosion hazards.

Typical items for pre-hire surveys:

• Well testing equipment;

• Electrical safety;

• Automatic fire detection system;

• Fixed fire extinguishing systems (water & foam);

152-RP-48 Rev 02, Feb 2006 Page 87 of 261

fireandblast.com

• Breathing apparatus;

• Electric safety;

• Blow out prevention equipment (BOPs);

• Well control equipment;

• Fire control system;

• CO2 system for fire control;

• Portable extinguishers and fire fighting equipment;

• Gas detection system;

• Safety.

3.9.7 Classification society surveys

Classification societies will carry out surveys of vessels to ensure that they continue to comply with
class requirements; these will be carried out against the rules issued by the class societies referred
to throughout this section. The survey reports generally stay on the unit and at the field office.

3.9.8 The well programme

The well programme lays out the plan for drilling the well, including predictions for formations to be
encountered, along with the types of fluid in the formations (oil, water, or gas). Part of the
programme will deal with site assessment, covering the prospects for encountering shallow gas.
The programme should offer information regarding whether H2S is likely to be encountered. The
type mud system to be used will be detailed for each hole section. If well testing is foreseen, the
details of the flow rates likely to ensue will be given along with the duration of the test and the
sampling foreseen. Well testing is given separate treatment below.

There is no equivalent of a design safety case for wells. However, the Safety Case Regulations
require operators to apply a process termed Well Examination. This regulation requires that
operators file their well programmes with the HSE a minimum of 21 days before operations are due
to begin. The details to be submitted are spelled out in some detail. If there is no objection from the
HSE, work can begin. However, if there are material changes in the well programme, an
independent, competent person known as a Well-Examiner, must agree the change does not pose
an increase in risk.

For the MODU Owner, the effect of Well Examination is that the programme is fixed in good time
for them to interpret it and make ready for it. It also ensures there is a process for ensuring
changes are subject to analysis for risk.

The well programme covers 5 of the 8 contingencies involving fire and explosion.

3.9.9 The MODU safety case safety management system

The UK Safety Case and supporting regulations entail a robust Safety Management System
(SMS). One component of the system is an active system of audit. Another is the Verification of
Safety-critical Elements – those elements or systems vital to the safety of the personnel on the
MODU. The SMS audits and verification scheme can be a source of information readily available to
the interested fire and explosion specialist.

152-RP-48 Rev 02, Feb 2006 Page 88 of 261

fireandblast.com

3.9.10 Well testing

Though the Well Programme covers the objectives of well testing, it may not provide copious detail
on the well testing equipment. On many rigs, well testing equipment is not permanently installed. It
is brought to the rig when well testing is foreseen. On rigs where the installation is permanent,
maintenance of such equipment is not generally with the core skill and experience of the drill crew.

Few drilling specialists have extensive experience testing wells. The safety case can only generally
cover the well testing equipment and cannot be very specific as there are many different
manufacturers, different layouts for this equipment, and different crews generally man the well test
equipment. Therefore the constructive overview of a fire and explosion specialist should be
welcome in these circumstances.

3.9.11 Recommended approach

The following is written from the aspect of an oil company contracting for the services of a MODU.
Generally, the oil company will likely have staff or have access to 3rd party specialists specialising
in fire and explosion. MODU Owners generally do not. In this situation, it seems natural for the oil
company specialist to at least have an overview. It is probably sub-optimal to ask the MODU
Owner to do everything; on the other hand, it is probably sub-optimal to make numerous in-depth
enquiries of the MODU Owner when many aspects are covered by Classification or flag-State
rules. What is recommended is a cooperative, balanced, and constructive overview into all aspects
of fire and explosion aspects.

Any enquires should respect the culture and strength of the MODU Owner. Chief amongst these is
that the MODU Owner’s greatest asset is the crew. Some of their number will have participated in
or have knowledge of the rig’s treatment of fire and explosion. Rig crew use the “hands on”
approach. Thus, their expertise can best be accessed by qualitative data, as it is the type of data
they are most used to dealing with.

Finally, remember the marine approach should be seen as counting for something. Though the
rules are prescriptive, the nature of their derivation makes them statistically valid as most have
been derived from experiences of the world’s shipping fleet.

Given the diverse character of information for fire and explosion on MODUs, the approach given
below could function as a starting point(s).

152-RP-48 Rev 02, Feb 2006 Page 89 of 261

fireandblast.com

Item Overview

MODU Be aware of the Classification Society. Look up and become familiar with their rules.
Classification The MODU Owner will have records of the ongoing surveys.
Flag-State Be aware of who the flag-State is. Look up and become familiar with their rules. The
MODU Owner will have records of the ongoing surveys.
MODU Code Be aware if the unit has a certificate and whether it is 1989 or 1979. Be familiar with
what it contains.
Safety Case Be aware of the analyses in the safety case for fire and explosion, especially those with
PFEER Assessments. They represent the risks with the most severe consequences.
Pre-hire survey Have a look at the fire and explosion aspects of the pre-hire survey, provided, of
course, such a survey was performed.
Well Programme Have a look at the well programme from the point of view of the MODU Owner. Judge
whether you would be happy with the information in the programme in terms of
preventing fire and explosions? If not, it would be a service to both oil company and
MODU Owner to point out where better information would be beneficial.
SMS Audits The MODU Owner’s own audits can provide information on the standard of
maintenance. It would be a good thing to be aware of the audit findings. Further delving
could be undertaken if an overview gave cause for concern.
Verification of The same comments apply here as above for SMS audits.
Safety-critical
Elements
Well testing Probably the area where the fire and explosion expert might make best input. Well
testing can be infrequent and thus less familiar. An overview of the equipment,
procedures, and risk analyses may well prove beneficial in terms of risk reduction.

3.10 Particular considerations for existing installations

3.10.1 Application of fire hazard management to existing structures

3.10.1.1 General

Much of the preceding guidance has been written with design of new installations in mind. For
existing installations, the elements of the overall platform fire protection design will have already
been fixed. Unless the existing fire risk is found to be unacceptably high, major changes are
unlikely to be justified. The challenge for existing installations is in

• Continuing to ensure all the design arrangements for fire hazard management operate as
intended throughout the long life of the installation.

• Ensuring that if the design or the operation changes, the fire management is reviewed and
changed where necessary to suit the changed fire hazard.

There are slightly different considerations to be borne in mind at different stages of the field life.
Some typical examples of issues for the early, mid and the late stages of field life are provided
below to illustrate this point.

3.10.1.2 Early operating phase

Vigilance is required in the early stages of field life for deviations from the original process,
structural, mechanical or instrument design intent. Such changes need review for any implications
for fire hazard creation or management. Such a review needs to be scheduled and chaired by the
project safety engineer and attended by a mixture of design and operations personnel. It should
take place after a year or two of operation. Since key project design personnel are likely to have

152-RP-48 Rev 02, Feb 2006 Page 90 of 261

fireandblast.com

moved to another project by that stage, an alternative would be for operations to log all variations
to original design, operating or maintenance assumptions/intent for formal follow-up by the
installation safety engineer in order that the implications for fire hazard management can be
explored and corrective action taken if found necessary..

Nowadays, plant modifications are closely scrutinised by a range of discipline engineers and
onshore support staff for any detrimental effect on safety. Accumulated minor operating and
maintenance changes (known as ‘creeping change’) however can go unremarked, unless vigilance
is maintained.

Examples of the types of change that would not be obvious without a specific attempt to capture
them are:
• Environmental data (sea level or weather pattern changes);
• Instrumentation problems – e.g., leading to changed operator response to alarms;
• New fire research findings;
• Change in production composition or phases, leading to changed fire scenarios or release
frequencies.

3.10.1.3 Midlife operating phase

Some typical considerations for fire hazard management of existing installations at the mid-life
stage are:
• Creeping change in original design assumptions – examples are development of sand,
vibration or corrosion problems, increasing the likelihood of releases in certain areas;
changes in process conditions resulting in change to fire consequence modelling
assumptions;
• Fire-related protective equipment proves unsatisfactory in operation – detection devices
give frequent alarms or are found to be failed at every inspection. Alarms that are too
frequent are eventually ignored;
• PFP left off vessels or other equipment for longer and longer periods to allow access for
NDT/inspection;
• Areas of the platform always ‘keyed out’ of the automatic fire and gas system;
• Very slow process changes which come to be regarded as normal by operations
personnel (e.g. more frequent alarms, very low or high operating temperatures etc.).

If minor deviations go un-noticed, over time it becomes custom and practice to operate outside the
original design scope, and/or without all protection functioning. Problems then become apparent
only during an emergency situation.

Many of these minor changes would be identified by the independent competent person during the
course of his examinations of safety critical equipment and systems, but some changes can still be
missed.

Most oil companies include operations personnel in their project teams. Often one or both intended
OIMs plus key offshore supervisors are part of the project team specifically to become fully
conversant with, and supply input to operations and design issues. Over a period of 10 years or so
however, personnel change and key information, whether held personally, in hard-copy or in
electronic format is likely to be lost if no active steps are taken to refresh the ‘corporate memory’ at
regular intervals. In addition, over time, new research improves the understanding of the fire threat
and the ability of the designed fire control measures to effectively counter the threat. The
implications of this knowledge need taking into account and where necessary the emergency
response procedures updated.

152-RP-48 Rev 02, Feb 2006 Page 91 of 261

fireandblast.com

It is thus recommended that a formal review (taking into account new research knowledge) or audit
of the fire hazard management arrangements and records be carried out every 3 to 5 years.

3.10.1.4 Late operating phases

As platforms age the safety systems tend to require more repair and maintenance in order to keep
them in full working condition. The late operating phase is also a time when the platform production
tail off and there is a big drive to reduce OPEX costs. Fortunately, as platform age and production
rates drop, process pressures also drop, water cut increases and fire risks tend to reduce.

It is possible on some installations, where parts of the process have been simplified or
decommissioned or where drilling activity is finished, to review a platform’s fire hazard
management arrangements and remove fire protection equipment that is, by then, surplus to
requirement. This can reduce the maintenance burden. Any such modifications have to be formally
justified and recorded through the Operator’s Plant Modification Request procedures, and
documented in the Safety Case and associated PFEER/DCR documentation.

Typical Problems for the Late Operating Phase are:

• Degradation of Passive Fire Protection;
• Corrosion of firewater systems and leaks in air-trigger systems;
• Wear and tear on firewater pumps and deluge valve sets;
• Obsolescence of parts for Fire and Gas detection/protection systems;
• Increased leak likelihood due to sand erosion, corrosion (especially under lagging) and
fatigue;
• Tightened commercial constraints and reductions in manning.

Despite the associated cost of maintenance and inspection, the performance standards laid down
for of all the safety critical systems, subsystems and individual items must either:
• Continue to be met as per the original design;

or
• Revised (with appropriate justification) to reflect the changing fire risk. The associated
written schemes would be updated to reflect the changed performance standard in
discussion with the appropriate Independent Competent Person(s).

3.10.2 Life cycle considerations

During the operational phase, vigilance over the fire hazard management must be maintained.

Some of the changes that will need to be reviewed and assessed in other phases of the lifecycle
are covered in the table below:

152-RP-48 Rev 02, Feb 2006 Page 92 of 261

fireandblast.com

Table 3-11 Life cycle considerations for fire hazard identification and protection measures

Life Cycle Phase Fire Hazard and Fire Protection Issues

Installation and commissioning
Early Operational Phase
Mid Operational Phase
All design modifications subject
to appropriate ‘Plant
Modification Request’
procedures
Late Operational Phase
Asset life extension
Decommissioning
Checklists, commissioning procedures and test schedules are required to
ensure that design is properly installed and performs as intended.
Regular maintenance and testing to ensure performance standards met
for continued operation as design
Continue to be vigilant for creeping change for example, to platform
process conditions.
Repair or replace parts of system subject to unacceptable wear and tear,
continue to ensure performance standards are met, regardless of OPEX
constraints, while production continues.
HOWEVER: Where fire hazard is proven to be reduced some protection
system removal may be justified and maintenance burden reduced. Any
changes to original design concept to be formally justified and recorded in
platform Safety Case and PFEER/DCR documentation.
See Section 3.10.3 below
Fire risk profile for installation changes.
Production fire risk reduces as plant is isolated, hydrocarbon-freed and
removed.
Other fire risks introduced e.g. gases for flame-cutting or fuel for
temporary plant
Fire protection needs to be based on fire risk assessment of each stage
of decommissioning plan.
Proper isolation from pipelines and reservoir must be ensured

3.10.3 Aging installations and life extension

3.10.3.1 Overview

Many installations in the North Sea have reached the end of their originally stated life span but are
still producing sufficient quantities of oil to make continued operation worthwhile. Other
installations, although no longer producing oil from their own wells are being modified to act as
production hubs, taking oils from other subsea wells in the area and processing it, often with new
or modified topsides plant, for export to pipeline or tanker.

Asset life extension raises several issues in relation to fire hazard management, these are
discussed in the following sections.

3.10.3.2 Design Issues:

New process plant needs to be provided with adequate fire and gas detection systems. The
existing systems may be adequate to cover the new equipment or may need extending, but the
same considerations as for a new design will still apply. The existing system may be virtually
obsolete and not feasible to extend so replacement of the whole system may be required.

The effect of the new plant on the ESD and blowdown systems must be evaluated in the light of
the additional fire scenarios. It should not be assumed that tie-in to the existing platform blowdown
system will be adequate, even though original demands on the system may have reduced. If the
152-RP-48 Rev 02, Feb 2006 Page 93 of 261
fireandblast.com

installation is old, the original blowdown system may have been under-designed by comparison
with existing best practice especially where severe fire scenarios are involved.

All new fire scenarios must be reviewed for effect on existing deluge systems. A fire in the new
plant may set off several other systems, especially on an open installation. The project may have
to supply new fire pumps to cover the new plant as the existing pumps are unlikely to have spare
capacity. The condition of existing pumps for extended future service must be assured.

More use of passive protection may be possible, but integrity assurance for aging
piping/structure/equipment must be provided for

Existing deluge systems are often difficult to extend. The mechanical condition of the system
needs to be assured for extended service. There may now be a new fire scenario with implications
for important parts of the structure (e.g. the TR or TEMPSC areas or their supports) which are
currently unprotected. (See Sections 3.5.2 and 7.3.2.2 for further discussions on the limits to PFP
application, including some issues affecting retrofitting PFP to structures in situ). All escalation
potential should be considered, and the decisions relating to selection of protection recorded.

New fire scenarios must be evaluated for impact on evacuation, escape and rescue.

New support structure provided for the new plant may be vulnerable to fire impingement from
existing fire scenarios, and may require protection.

3.10.3.3 Operations Issues:

There is a tendency for this type of work to be carried out in isolation by small project teams within
narrow boundaries in order to keep costs down. The project teams try to keep documentation
updates to the bare minimum in standalone, project specific reports. It is essential that operations
personnel are involved in the project and offshore personnel are specifically trained on the
implications of the change for fire hazard management.

3.10.3.4 Emergency Response Issues:

As platforms age, emergency equipment and facilities degrade. Although some items can be easily
replaced once they fall below an acceptable standard, other items such as sea ladders, spider
deck walkways, gratings on rarely-used escape routes to sea can fall into disrepair and are
expensive to replace. Routes to sea are important in severe fire scenarios and must be kept up to
standard as long as the fire hazard remains. Where new business is introduced over an old
installation, new escape routes, as well as refurbishment of existing routes (where the original fire
hazard still exists) may be needed.

3.10.3.5 General Considerations

Fire hazards would be identified in the HAZID at FEED stage of the process modification design,
and subsequently assessed as for any new design project.

The impact of the new facilities on the existing fire and gas detection and protection systems needs
to be documented and recommendations tracked to implementation.

Incorporation of new safety critical items into existing Safety Case, SCE and PS related
documentation is a legal requirement.

152-RP-48 Rev 02, Feb 2006 Page 94 of 261

fireandblast.com

3.11 Particular considerations for accommodation and other areas for

personnel
3.11.1 General

Much fire measurement data, definitions and internationally accepted standard tests have been
developed from building fires and the damage caused. Many of these have been adapted for use
on the appropriate sections of petrochemical plants and their shortcomings in wider applications
should be understood. The following sections deal with some standard aspects of conventional
onshore fires but practitioners should refer to standards produced for onshore and civil use for
these “non-hydrocarbon” areas.

Accommodation and other areas of the installation such as control rooms, some workshops (i.e.
those without specific storage requirements for hazardous materials), leisure areas and galleys are
all based on normal architectural practices. The internal materials are the same as onshore
facilities and the design practices tend also to be the same with minor variation. The key difference
with these areas is how they relate to process and other operating areas and extreme care should
be taken to make sure that even the most apparently benign systems do not interface with a
hydrocarbon system in an unforeseen manner.

Key aspects where interfaces can occur are listed below and these should be assessed when
considering the process fire hazards:

1. HVAC;

2. Drainage;

3. Storage areas/enclosures;

4. Access (both for personnel using the facilities and working there and goods coming into
or out of the area).

3.11.1.1 Compartment fires - general

In a compartment or building fire, the source of ignition will normally be at a discrete location and
the initial fire growth will be slow. The temperature in compartment will increase and a hot layer of
gas will build up below the ceiling. A point is reached when re-radiation from this gas layer causes
the unburnt furniture etc to ignite. Within a short space of time the entire contents of the
compartment will be burning in a process called flashover.

The severity and duration of a building fire depend on the amount of fuel and the ventilation
conditions. Fires may be fuel controlled or ventilation controlled. Generally, ventilation controlled
fires are more severe.

The main difference between a building fire and a pool or jet fire is the nature of the fuel. Although
buildings contain hydrocarbons in the form of plastics they also generally contain a large amount of
cellulosic material in the form of paper, and wooden furniture. It is common, although not strictly
correct, to refer to building fires as cellulosic.

When assessing elements of construction for buildings the Standard Fire resistance Test fire is
normally used. For some “fire engineered” designs a natural fire is modelled. The simplest natural
fire model is the parametric fire although there are many, more complex, computer models for
building fires

3.11.2 Compartment fires – parametric

A parametric fire [3.37] is an idealised form of a “natural fire” in a building compartment. They
provide a simple means to take into account the most important physical phenomena which may
152-RP-48 Rev 02, Feb 2006 Page 95 of 261
fireandblast.com

influence the development of a fire. They take into account the fire load, the ventilation conditions
and the thermal properties of the compartment linings. The natural fire is assumed to have a slow
build-up with a pre-flashover period of ignition and smouldering, following flashover, the heat
build-up is rapid and proceeds for some period dependent on the available fuel. There is then a
post-flashover period where cooling takes place. The “standard fire” curve starts from an
equivalent point at flashover and begins the heating phase directly. For the “standard fire” the
heating rate continues (albeit at a slower rate) and does not reach a “cooling period”.

The modelling of the temperature curve of the parametric fire also follows a similar logic of heating
starting directly from a notional equivalent of the flashover point, i.e. without any preceding phase.
The heating rate is then faster than for the standard fire but reaches a point where cooling
commences. The cooling rate assumed for parametric fires is linear compared to the accelerating
cooling of the natural fire.

The parametric fire was developed to model mainly cellulosic building fires. It gives reasonable
correlations against tests for modern office fires. It may often be more severe than the Standard
cellulosic fire.

3.11.3 ISO, cellulosic (Standard fire)

Building regulations throughout the world almost invariably require elements of construction to
have fire resistance based on the standard fire [3.38]. This is an idealised fire defined by a time-
temperature relationship and is the basis for fire resistance tests.

3.11.4 Temperatures

The Standard cellulosic fire has, when compared with most other “design” fires, a low initial rate of
temperature increase. However, the temperature rises logarithmically with no limit. It reaches
945 ºC in 60 minutes and 1153 ºC in 240 minutes. The temperature reached depends on the
conditions in the compartment and in a typical office fire, the combustion products temperature will
reach about 1300 ºC. The fire temperature will normally peak at about 45 to 60 minutes and
decline steadily afterwards. Compartment temperatures will reduce to 200 ºC after 120 minutes.

4. Interaction with explosion hazard management

4.1 General
The methods and systems for the management of explosion and fire hazards will have a degree of
commonality. Some of these will be complementary, whereas others will serve a single function
only. In addition, conflicts may exist between the successful management of explosion hazards
and the successful management of fire hazards. Thus, a holistic approach must be taken in the
management of both types of hazard.

Hazard management will always be a series of compromises between economics, engineering,

operability and risk reduction considerations.

Successful hazard management involves identifying the best compromise between all these
considerations, in compliance with any statutory obligations placed on the operator of the
installation.

152-RP-48 Rev 02, Feb 2006 Page 96 of 261

fireandblast.com

4.2 Fire and explosion prevention methods

4.2.1 General

It has to be accepted that the complete prevention of fires and explosions can never be attained.
However, procedures and systems should be provided to reduce the frequency of such events to
as low as is reasonably practicable. Such procedures and systems are detailed below.

4.2.2 Minimisation of leakage frequency

The loss of containment of a flammable material is a necessary precursor to the occurrence of an

explosion or fire. This can be avoided, as far as is reasonably practicable by:
• Fitness for purpose of all flammable material containment equipment and associated
pipework.
• The maintenance of the design fitness for purpose throughout the life of the installation.
This requires that an adequate inspection and maintenance regime be in place
throughout the life of the installation. In addition, care must be taken to ensure that the
original design intent is not debased by subsequent modification that may take place
within the life of the installation or lost via poor record keeping or industry take-overs
and/or mergers.
• Wherever possible, the number of potential leakage sources should be minimised.
Typical of these would be instrument tappings and pipework flange connections.
However, care must be taken in applying this philosophy as this may lead to an
increased need for ‘hot work’ if modifications, replacement or repair of equipment
becomes necessary.

4.2.3 Minimisation of ignition probability

Given that the leakage of flammable materials cannot be totally prevented throughout the life of the
installation, then an explosion or fire will only occur if the leak is ignited. The probability of such
ignition may be minimised by:
• Adequate control of ‘hot work’ on live installations by the use of air-purged habitats.
Alternatively, only carry out ‘hot work’ during an installation shutdown. (Noting that hot
work should be avoided wherever possible, some installations have a ‘no hot work’
policy and insist on bolting etc., and carry out hot work only during a shutdown.)
• The correct hazardous area zoning for electrical equipment and the correct selection
and maintenance of such equipment.
• The early detection of any leakage together with the necessary control actions to isolate
all non-essential items of equipment which could potentially be sources of ignition.

Note that ignition probability per se, does not represent a true measure of risk. What are most
significant are the time-delay between a leak occurring and the ignition of the leak, and also the
time delay (if any) between the detection of the leak and the ignition of the leak. These are a
function of the rate of ignition rather than of the ignition probability. The minimisation of ignition
probability illustrates one of the many compromises that have to be arrived at in the management
of explosion and fire hazards, whilst accepting that ignition probability must be minimised, in doing
so it must also be recognised that the potential for a ‘long-delayed’ ignition increases. Under these
conditions a severe explosion event may result.

152-RP-48 Rev 02, Feb 2006 Page 97 of 261

fireandblast.com

4.3 Fire and explosion detection and control methods

4.3.1 General

The positive pressure phase of an explosion is in the order of a few hundred milliseconds. Thus,
the effects of an explosion are realised immediately. Conversely, the time for the effects of a fire to
be realised, even upon personnel, is of at least an order greater than that for explosions. Thus the
early detection of a leak is of greater significance when explosion hazards are considered than
when fire hazards are considered.

It follows that leak-detection and associated alarms, are the only means of providing adequate
warning to personnel. Fire-detection is of no value in this context. However, fire-detection is still of
importance when fire hazards are considered.

It may be that very rapid response fire-detection systems, such as those that utilise flame-
detection, could detect an explosion before they are damaged by the explosion blast or drag
effects. In addition, rapid response fire detection may also be of benefit with respect to the initiation
of explosion mitigation systems (such as deluge on gas detection). As stated above, this would be
of no significance when explosion hazards are considered. However, it may be important for the
management of fire-hazards to detect any fire that may follow an explosion. This may provide an
argument for the use of rapid-response fire-detection systems, where the frequency of occurrence
of explosions is deemed to be significant. It may also provide an argument under the same
circumstances for the automatic actuation of any active fire control and mitigation systems upon
the detection of a leak.

4.3.2 Automatic release-detection systems and alarms.

Two generic types of release detectors are available. These operate on:

Type 1) The detection of an accumulation of flammable gas from the release, or

Type 2) The direct detection of a release based on its acoustic signature.

Type 1) detectors may be point detectors e.g. pellistors, or beam detectors. In each case, there is
a requirement to assess the minimum flammable cloud size that should be detected. There is little
guidance available to assist in this. One approach may be to consider both the thermal effects and
the blast effects on a flammable cloud. The thermal effects may be assessed by treating the
combustion of the flammable cloud as a fireball. The minimum cloud size, intended to be detected,
may then be based on an acceptable probability of persons in the area surviving these thermal and
blast effects. A range of figures for the probability of survival of detection systems following an
initial blast load would be between 0.5 and 0.9. The lower end of the range has been used often in
QRAs submitted to the Health & Safety Executive but a survival probability of 0.9 if other protective
steps have been considered.

Type 2) detectors appear to have an advantage over type 1) detectors in as much as they detect a
leak directly. However, it is important that the sensitivity of such detectors is adequate; the
advantage of leak detection is its sensitivity; there are definite benefits to detect leaks at as low
rates as possible, this can be used to alert the operator even if a shut-down is not initiated at this
stage of the incident. In addition, there is no clear evidence as to whether or not such acoustic
detector will operate adequately when two-phase leaks occur. Thus it is suggested that the ideal
leak detection system should employ both types of detectors. The detection of a leak should be
annunciated on an installation-wide basis. All installation personnel, including visitors, should have
received clear instruction as to the correct action to be taken on the receipt of such an alarm.

The minimum cloud size to be detected should also consider the potential escalation. This
assessment should be conservative due to the diversity of potential escalation paths and the
analysts’ inability to assess them all.

152-RP-48 Rev 02, Feb 2006 Page 98 of 261

fireandblast.com

4.3.3 Automatic fire-detection systems and alarms.

Only leak detection can provide adequate warning to personnel of a potential explosion hazard.
Fire detection is of very limited value in the event of an explosion already having occurred.

Several fire detection device-types are commonly available, they include:

• UV and IR flame-detectors
• Rate of temperature rise detectors
• Smoke detectors
• CCTV with or without embedded flame imaging software

The flame-detectors will have the most rapid response of the above if they are in the vicinity of the
fire. However, very early smoke detector (VESDA) systems can respond rapidly based on an
arrangement where the detection system samples smoke at very low concentrations, this has often
been used in sensitive enclosed areas, computer systems have a long history of being protected
by VESDA systems. It is advisable that total reliance is not placed on flame-detectors alone.
Conditions arise where fires are obscured by smoke and indeed, smoke generation is the major
hazard to personnel.

IR detectors may also be obscured by water, for example, triggering deluge on gas detection may
impair subsequent fire detection, or the IR detectors may fail to register fire escalation to adjoining
process systems.

The fire-detection system should include a mix of each type of detectors and be appropriate to the
mix of release/fire/explosion hazards considered in the escalation path.

The comments concerning alarms made for leak detection are equally pertinent for fire detection.

4.3.4 Reducing the available inventory of fuel.

This is of equal importance to the management of both fire and explosion hazards. Obviously,
where explosion hazards are concerned, any beneficial effects will arise if the fuel inventory is
partially or completely depleted before an ignition takes place. This contrasts with the situation
where fire hazards are concerned, where the beneficial effects will continue to operate after an
ignition takes place. However, these beneficial effects on the fire-hazard will only ensue if the
automatic isolation and blow-down and flare systems are not damaged by any prior explosion, to
such an extent as to prevent their correct operation. Isolation and blow-down valves should,
wherever possible, fail to a “safe” condition; generally, this means that isolation valves “fail closed”
and blowdown valves “fail open” although there can be extenuating circumstances for this rule.

Especially for large high pressure valves, the actuators can be significantly large pieces of
equipment, and their destruction in an accident can compromise the “fail safe” mode; such valve
actuators should be protected against blast and drag-effect damage as much as reasonably
practicable, but it must be accepted that there will be practical limitations on the extent to which
this can be achieved.

This emphasises the importance of early detection of leaks and the automatic initiation of the ESD
and blow-down systems upon the detection of a leak.

Whereas, ESD and blow-down systems do provide benefit in the management of fire and
explosion hazards, it is important to realise that these systems alone cannot be relied upon to
prevent subsequent failures of equipment or structural elements due to the effects of a fire. Blow-
down systems are almost universally designed to API RP520 [4.1]. This requires that the internal
pressure be reduced by 50 % or to 100 psig (22 barg); whichever is the lower; within fifteen
minutes. However, even if this is achieved, a significant fire could still be ongoing which could
cause failures, especially in congested areas.
152-RP-48 Rev 02, Feb 2006 Page 99 of 261
fireandblast.com

4.3.5 The significance of area ventilation

4.3.5.1 On explosions

The equilibrium size of a flammable cloud, produced by the accumulation of flammable gas from a
leak will be inter-alia, a function of the area-ventilation rate. The severity of an explosion following
the ignition of such a flammable cloud, will be, inter-alia, a function of the mass of flammable gas in
the cloud. Thus it follows that an increased rate of area ventilation will have a beneficial effect upon
the explosion hazard. The possible disbenefit of this is that it could make early detection of a leak
more difficult to achieve. Nevertheless, in most cases the balance of risk will come down in favour
of maximising the rate of area ventilation.

4.3.5.2 On fires

The influence of area ventilation rate on fires is less apparent than its influence on explosions. The
research report [4.2] indicates that the suppression of pool fires by water/foam deluge systems is
aided by increased wind-speed i.e. an increased ventilation rate. However, the possible distortion
of the water spray pattern by the wind could mitigate against this.

Where mechanically ventilated, enclosed areas are concerned; the internal wind-speeds are
unlikely to be sufficient to distort water-spray patterns. Note that for enclosed areas, the rate of
mechanical ventilation will usually be of the order of 12 air changes per hour. Research [4.3] has
indicated that for naturally ventilated areas ventilation rates in the order of a few hundred air
changes per hour are achievable.

It is possible to shut down ventilation systems to provide ventilation control of a fire, but it should
be noted that in order to prevent smoke and combustion products migrating along ducts if the
HVAC is not shutdown and isolated, (which could lead to fire or fire effects spreading to other
areas) that common practice is to shut down and isolate HVAC systems in all but the most critical
areas (such Temporary Refuges) on confirmed detection of fire.

4.3.5.3 Maximisation of ventilation rates

For existing installations, there are constraints to the options for increasing the existing ventilation
rates. For mechanically ventilated areas, major refits are required for fans and ducting sizes, for
naturally ventilated areas, the ventilation rate may be increased by the removal of any louvered
wind walls.

For ‘new builds’ the influence of the rate of ventilation on both fire and explosion hazards should be
addressed in the design. For naturally ventilated areas a conflict may arise between protecting the
temporary refuge against smoke ingress and the maximisation of area ventilation. It is conventional
wisdom that wherever possible, the temporary refuge should be up-wind of the prevailing wind
direction. There will normally be bulkheads between the temporary refuge and drilling and process
areas. This means that the open sides of these areas will be at a right angle to the prevailing wind
direction limiting natural ventilation.

4.3.5.4 Other factors influencing ventilation rate

4.3.5.4.1 Equipment layout

The equipment layout within an area will have an influence on the area ventilation rate. The most
efficient layout to maximise the ventilation rate will be the same as that to minimise the explosion
hazard. Layout guidance can be found in Part 1 of this guidance.

For existing installations, it must be accepted that little can be done to change the existing layout of
equipment. For ‘new builds’ cognisance should be taken of the recommendations given in the
FLACS explosion handbook.

152-RP-48 Rev 02, Feb 2006 Page 100 of 261

fireandblast.com

4.3.5.4.2 Influence of release rate

The release rate of gas can itself have a significant influence on the rate of natural ventilation.

The research report [4.4] provides some, albeit limited, data on this effect. Analysis of these data
indicates that:
• If the leak is counter-flowing to the ventilation flow direction, the ventilation rate will
be reduced.
• If the leak is co-flowing with the ventilation flow direction, the ventilation rate will be
increased.
• If the leak is crosswind to the ventilation flow direction, the ventilation rate is
effectively unchanged.

The following correlations are suggested as representing a conservative estimate of these effects.

For leak direction counter to ventilation flow direction,

V ′ = V (1 − 22.4 x ) ...................................................................... Equation 4-1

where

V is the reduced ventilation rate (m3/s)

V' is the original ventilation rate (m3/s)

x is the gas release rate (m3/s)

For leak direction co-flowing with the ventilation flow direction,

V ′ = V (1 + 12.45 x ) .................................................................... Equation 4-2

where

V is the increased ventilation rate (m3/s)

V' is the original ventilation rate (m3/s)

x is the gas release rate (m3/s)

4.3.5.4.3 Influence of water deluge

The research report [4.4] indicates that the presence of water deluge reduces the ventilation rate in
naturally ventilated areas. The date on this is very limited and applies only to deluge rates in the
order of 24 l min-1 m-2.

It is suggested that a conservative estimate of this effect would be to reduce the area ventilation
rate by 30 % when the area deluge system is operating.

4.4 Fire and explosion mitigation methods

4.4.1 Active fire-fighting systems

The first, and most obvious, consideration of the interaction with the explosion events is whether or
not the fixed fire-fighting systems would still be functional after an explosion. Water deluge systems
should be provided with as much protection against the explosion effects as is practicable. For
152-RP-48 Rev 02, Feb 2006 Page 101 of 261
fireandblast.com

existing installations, it must be accepted that little can be done in this regard. For ‘new builds’, this
may be achieved by the judicious location of water deluge pipe-work. However, because of its very
nature, such a system will be distributed throughout the whole of the area; it is likely that only a
limited degree of protection could be provided.

It is now well established that in well-vented areas, the presence of an area water deluge can
reduce the severity of explosions. This would appear to be an argument for the initiation of water
deluge, before the ignition of a flammable atmosphere takes place. The could have the benefits of
reducing the explosion severity to an extent that the water deluge system in operation to control or
mitigate the effects of any subsequent fire, and also prevent damage to automatic isolation and
blow-down systems. Research report [4.5] provides correlations to estimate the reduction in
explosion severity by area deluge.

The correlations also demonstrate the variation in explosion severity with the gas concentration in
the flammable atmosphere. The correlations are:

In the absence of water-spray,

PE 2 = PE 1 e
( −17.693((E −1.0563) −(E −1.0563) )) ......................................... Equation 4-3
2
2
1
2

In the presence of water-spray,

PE 2 = PE 1 e
( −18.215((E −1.007) −(E −1.007) )) ............................................ Equation 4-4
2
2
1
2

where

PE1 is the overpressure at equivalence ratio E1

PE2 is the overpressure at equivalence ratio E2

C1
E1 =
CS

C2
E2 =
CS

and

C1 is gas concentration 1

C2 is gas concentration 2

CS is the gas stoichiometric concentration

It is not possible to provide a generic correlation for the absolute reduction in explosion severity, as
the domains in which the explosion takes place will vary from one another. However, it can be
stated that the ratio of the unmitigated explosion severity to the mitigated explosion severity
increases as the unmitigated explosion severity increases. Thus area deluge mitigation of
explosions is most effective where very severe explosions can occur. This means that such a
system will be most effective in large, congested well-vented areas.

The mitigation of explosions by area water deluge will only occur when the explosion is
accompanied by significant flame acceleration. In practice, this means large, well-vented domains.

152-RP-48 Rev 02, Feb 2006 Page 102 of 261

fireandblast.com

Where this does not occur, such as in enclosed domains area water deluge will not provide any
benefit, and in some cases, could increase the explosion severity.

As has been stated above, the presence of water-deluge will result in the reduction of the natural
ventilation rate. This will have the effect of increasing the equilibrium, size of the flammable cloud
and also increasing the time required to disperse this flammable cloud. In ageing platforms, there
has been a concern that the presence of water-deluge may increase the probability of ignition due
to water ingress into electrical equipment.

Thus, in any particular situation, the decision as to whether or not the activation of an area water-
deluge is appropriate can only be informed by an assessment of all the above factors.

Water-deluge systems, with or without foam, can be effective in suppressing and extinguishing
pool fires. The following correlations for the time to extinguish pool fires have been developed from
a research programme of fire trials [4.6]. These trials used diesel as the fuel but the correlations
would give a reasonable approximation for the time to extinguish stabilised crude oil fires.

29
T50 = 494 − 376 Y + .............................................................. Equation 4-5
Y

80
TE = 859 − 448 Y + ............................................................... Equation 4-6
Y

where

T50 is the time to reduce the fire size by 50 % (s)

TE is the time to extinguish the fire(s)

Y = C ×U

and

C is the water spray area cover rate (l min-1 m-2)

U is the internal wind speed (m s-1)

These correlations are specific to water sprays with droplet Sauter mean diameters of 400 to
500 microns. The research report [4.7] indicates that the water droplet diameter can have a
significant effect upon the time to extinguish a pool fire. In summary, large droplets are more
effective than small droplets, inasmuch as they are less easily displaced by ventilation crosswinds
and can penetrate the fire plume more effectively.

The addition of a foaming agent to the water spray system can reduce significantly the time
extinguish a pool fire compared to those predicted from Equation 4-5 and Equation 4-6.

One additional factor in foam compound selection is the viscosity of the finished foam. For two
dimensional pool fires a low viscosity of the finished foam is appropriate. However, for three-
dimensional running fires, such as may be encountered on a helideck, a high viscosity (or sticky)
finished foam is appropriate.

Where water miscible fuels may be encountered, then alcohol resistant foam is necessary.

In locations where the ambient temperature can be below 0 °C for a significant time the foam
compound should be ‘freeze-protected.’

152-RP-48 Rev 02, Feb 2006 Page 103 of 261

fireandblast.com

A number of characteristics affect the effectiveness of water spray systems (designed for example
to NFPA15 [4.8]) against either pool or jet fires.. The effects of water systems with respect to
different fire types are discussed in more detail in Section 5.2.

However, area water deluge can provide significant protection against incident thermal radiation
from both jet and pool fires.

The research report [4.9] suggests the following correlation for the reduction in incident thermal
radiation.

R = 100 tanh (1.55 x ) ................................................................ Equation 4-7

where

R is the percentage reduction in incident thermal radiation

x = f ×L

and

f is the water volume fraction in the atmosphere

L is the distance through the water spray or curtain (m)

This indicates that the presence of area deluge could provide significant protection for personnel
escaping from the location of a fire. The same applies to the use of water curtains if these are of
adequate thickness.

Area deluge systems or water curtains cannot be relied upon to protect personnel from the thermal
effects of an explosion. These thermal effects are of too short a duration to prevent any serious risk
of failure of equipment or structural elements. Such risks would be associated with the blast and
drag effects of an explosion. Obviously, water spray systems can provide no protection against
such effects. Dual agent (foam and dry powder) can be effective in the suppression and
extinguishment of pool fires. Their effectiveness is probably limited to enclosed areas due to the
problem of delivering the dry powder to the base of the fire in open, well-ventilated areas. Where
effective, dual agents can reduce the fire duration to less than that where water deluge and foam is
used.

Any area deluge or local cooling system should be fully operational as soon as possible after the
receipt of an initiating signal. The recommendation for the maximum value of this time delay, given
in NFPA, should be adhered to. This is because waterspray heads constructed of brass or
gunmetal will, when exposed to flame impingement, suffer major damage if water flow has not
been established. This level of damage is likely to occur within 60 seconds and seriously degrade
the effectiveness of the waterspray system. This could be avoided by the use of waterspray heads
constructed of a high melting point material, such as super-duplex stainless steel. However this
option would be accompanied by a severe cost penalty.

Consideration should be made as to whether the fire hazard may extend beyond the notional fire
area, thus mitigation measures should be able to protect from fire effects from outside (via an
adjacent module for example). The application of water systems should then be appropriate to the
fire hazard identified and also to the type of protection required, e.g. does the outside area include
key escape routes form the primary affected area to the Temporary Refuge.

Where high voltage electrical equipment, or equipment susceptible to damage by exposure to

water are present then conventional water deluge or foam systems will not be appropriate fire
fighting systems. Historically, such equipment has been protected against fire by the installation of
Halon flooding systems. Since the adoption of Montreal protocol, this option is no longer available.

152-RP-48 Rev 02, Feb 2006 Page 104 of 261

fireandblast.com

A number of drop-in Halon replacement systems have come on to the market but these are not yet
in general use and thus little data are available on their effectiveness in ‘real’ fire situations.

Water mist systems do appear to be very effective against electrical fires in enclosed areas.
However, there is no general agreement as to whether or not unacceptable levels of damage to
such equipment would ensue. More evidence is required to determine whether this objection to the
use of water mist systems is or is not valid.

4.4.2 Fire-proofing systems

Two types of fireproofing materials are in general use on offshore installations. These are:
• Inert materials;
• Intumescent materials.

The inert materials provide excellent protection against fire exposure and a resistant to the erosive
effects of jet flame impact. They do suffer from the disadvantage of increased load on the
structure. It is for this reason that the intumescent materials are generally preferred. The
intumescent materials can also provide excellent fire protection. However, there is a concern that
the erosive effect of jet flame impact could dislodge the ‘char’ formed and thus reduce the
effectiveness of the fireproofing. Where these materials are to be used, the material manufacturer
should provide jet fire test data to demonstrate that this is not a problem.

The design standard performance specifications for fireproofing materials are generally based on
diffusion flame engulfment rather than jet flame impact. Thus the need for the test data referred to
above is reinforced.

In this context it is of course necessary to know whether diffusion flames or jet flames will be
encountered. The research report [4.10] does provide some evidence on the likely rainout of liquid
from an ignited two-phase release. If the rainout is significant then a pool fire will result. If not, then
a spray fire (equivalent to a jet fire) will result. It is suggested that for ignited two-phase releases;
• If the GOR is low, then at drive pressures above 10 bar absolute a spray fire will
result.
• If the GOR is high, than at drive pressures above 5 bar absolute a spray fire will
result.

The effectiveness of both types of fireproofing materials can degrade over time. This can be due to
mechanical damage of the coating, especially the sealing topcoat. This in turn can lead to water
ingress and deterioration of the fireproofing material, together with possible unrevealed corrosion
of the substrate. This can be avoided by regular inspection of the fireproofing coatings and repair
as necessary. Ideally, the fire-proof coating of any item should be capable of withstanding an
explosion blast loading, up to the failure loading of the equipment item or structural element
concerned, without suffering any significant degradation of the fire-proof rating. This would retain
the protection provided by the fire-proofing against any fire subsequent to the explosion. The
design of fire-proofing systems is universally carried out on the basis of the fire loading only.

4.4.3 The temporary refuge

Ideally, the temporary refuge should provide for the protection of personnel against the effects of
both fires and explosions. Whilst it is feasible that the temporary refuge could provide such
protection against the thermal and smoke effects of fires and against the thermal effects of
explosions, there must exist a practical limitation on the protection that could be provided against
the blast effects of explosions. Thus the objective should be to reduce the explosion blast effects
on the temporary refuge to as low as is reasonably practicable. This is probably best achieved by
maximising the separation distance between the temporary refuge the likely locations of explosions
as much as it is reasonably practicable to do.

152-RP-48 Rev 02, Feb 2006 Page 105 of 261

fireandblast.com

4.5 Combined fire and explosion analysis

4.5.1 Introduction

Parts 1 and 2 of the Guidance have considered the subjects of explosion and fire in isolation. In
practice, not only is it impossible to fully isolate the two phenomena, but also to do so risks missing
potential high-risk events. This applies particularly where a fire analysis ignores potential damage
caused by a preceding explosion or where an explosion occurs during a fire.

The nature of the interaction between explosion and fire will depend upon whether an explosion
precedes a fire (the usual base case) or whether it occurs during a fire. The effects of interaction
are discussed in the following sections.

For the purposes of this section, explosion shall be assumed to include the effects of projectiles.

4.5.2 Fire response of explosion damaged structures

4.5.2.1 General

There are four categories of explosion damage to structures, three of which may affect subsequent
fire endurance.

1. A structure, which has responded to explosion while remaining in the elastic deflection
range everywhere and without connection failures. A Category 1 structure can be
considered to have been unaffected by explosion when considering its response to fire.
This is the case for structures subject to explosion within the SLB range.

2. A structure, which has responded to an explosion with plastic deformation but without
connection failures. A Category 2 structure will be unaffected in its response to fire
except in respect of:
a) Possible damage to PFP (e.g. due to substrate strains), but noting that
there are extremely limited data available on PFP damage following an
explosion;
b) Loss of straightness of members subject to buckling loads;
c) Deformation of supported equipment and pipes;
d) Loss of pipe/equipment support.

3. A structure that has responded to explosion loading with or without connection failures
(local or global). Category 3 structures will be weakened and behave differently in fire
scenarios, compared to undamaged structures, with much reduced fire endurance.

4. A structure, severely damaged by explosion with loss of entire segments of the

structure.

Categories 2, 3 and 4 damage relate to structures designed to resist explosion in DLB range.

4.5.2.2 Analytical treatment of explosion damaged structure

For category 1 damage in an explosion (SLB) it is assumed that there is no weakening of structure
with respect to fire endurance hence fire and explosion can be considered independently by
different techniques, if required.

In practice it is very difficult to perform fire response analysis of explosion-damaged structure,

where the explosion damage may have reduced the reserve structural capacity for dead loads.

152-RP-48 Rev 02, Feb 2006 Page 106 of 261

fireandblast.com

The two practical difficulties are:

• Calculating the reserve structural capacity for distorted and/or weakened structures;
• Covering a suitable range of explosion damage scenarios.

It is therefore recommended to design the main parts of the structure to survive design (10-4 years
return period) events with category 1 or modest category 2 damage. In practice this will involve
optimising the overall layout of the topsides facilities to minimise explosion pressures.

For category 2, 3 or 4 damage it would be necessary to apply a structure model that has been fully
modified to take account of the explosion damage that has occurred prior to fire.

This is a particularly advanced type of analysis but could be practical where the non-linear software
can determine both fire and explosion response. It is probably necessary to account both for
geometry changes and the straining that has occurred in strained members, and this will affect the
material model for those members. For this reason it may not be suitable to use different software
for the fire and explosion response and merely use the output geometry from the non-linear
explosion software as input to the fire-response software.

4.5.3 Explosion response of structures at elevated temperatures

4.5.3.1 General

As temperature increases, the yield stress and Young’s modulus of metals decrease. This can
result in comparatively small temperature rises resulting in a considerable increase in explosion
related deflection. This applies particularly where a component is designed to resist explosion
through plastic deformation. Explosions during fire can sometimes result from:
• Equipment or vessel BLEVEs due to heating in fire;
• Delayed effect of explosions in one area on an adjacent area, already in flames. This is
part of a complex domino situation where a first area is in flames and the explosion in
that first area has caused leaks in a second (adjacent) area, and it takes some time
before the leaks in the second area ignite and cause the second explosion, causing
explosion overpressures in the first area.

Unless, analyses of escalation identify clear limits to potential damage, it is recommended that the
fire hazard strategy assumes a “burn down philosophy” and that the fire risk analysis should
confirm that the TR is not destroyed with an unacceptable frequency, in which case, a different
solution will be required (e.g. a revised layout or separate accommodation jacket).

Other damage can occur due to projectiles caused by vessel BLEVEs and to a lesser extent from
pipe failures. Another source of damage may be equipment and structure falling from areas above
that has become weakened by fires. The higher the module stack, the more damage a dropped
could cause. Where appropriate, this aspect needs to be linked to dropped-object hazard
evaluation. On F(P)SOs and converted jack-up type substructures the damage consequence due
to impact with the deck might be large and the protection requirements difficult to meet without
heavy protection such as thick steel plates or Bi-steel.

4.5.3.2 Analytical treatment of fire-damaged structure

Rigorous numerical analysis for explosion effects on fire-damaged structure is currently not
practical in most cases, though the advanced non-linear techniques briefly mentioned in
Section 4.5.2.2 might be applicable here.

Coping with the explosion after fire scenarios is principally achieved with a suitable barrier
philosophy and distancing (sensitive equipment and structure from hazard). For vessel BLEVEs
distancing will not usually be sufficient due to long projectile trajectories. Barriers, which may be

152-RP-48 Rev 02, Feb 2006 Page 107 of 261

fireandblast.com

walls or other equipment installed between the location of the BLEVE incident and vulnerable
targets, can reduce projectile trajectories and thereby render distancing philosophy effective.

From the practical standpoint, where an explosion during a fire is a significant risk, the temperature
of structural steelwork may need to be kept significantly lower than for fire-only loaded steelwork.
This is to improve resistance to resist the secondary explosions. This can be accommodated by
more extensive application of PFP and this factor should be borne in mind when contemplating
reducing the extent of PFP coverage to meet only specific fire scenarios.

An additional consideration is that where there is a significant risk of an explosion during a fire it is
necessary to ensure adequate strength and bonding or fixing of passive fire protection materials at
high temperatures.

4.6 Safety conflicts

The application of safety measures always requires a balance regardless of whether the hazards
are fire or explosion related. The over-riding principle concerns the risk assessment of the
identified hazards and whether the protective steps for one hazard will exacerbate the likelihood or
consequences of another. This “conflict” is particularly meaningful when dealing fire and explosion
hazards as they are the result of only slightly diverging escalation paths. All protective measures
should be considered in the context of the hazards identified for the specific installation as is
reiterated elsewhere in this guidance; the hazard identification exercise for the installation should
be rigorous and comprehensive.

This section will discuss specifically the potential conflicts arising from the use of the protective
measures considered for fire hazard management. The detail of each measure discussed can be
found elsewhere in this guidance.

The conflicts will be reviewed in the context of their role in the protective hierarchy and the issues
“in conflict” will be described.

4.6.1 Conflicts arising from inherent safety measures

The major inherent safety steps are to reduce or eliminate inventories.

Reduction or elimination of inventory is desirable for all hydrocarbon related hazards and presents
no obvious conflicts with other hazard categories.

In general, the reduction or elimination of ignition sources is again desirable for all hydrocarbon
related hazards although care should be taken that dispersion of gas or vapour to a
“non-hazardous” area where ignition sources have been allowed is considered in the HAZID and
that suitable other steps have been taken.

4.6.2 Conflicts arising from preventative safety measures

Additional safety measures that might be considered here are open module areas to disperse any
hydrocarbon release (in gaseous or vapour form) or providing comprehensive hazardous drainage
systems to remove liquid spills as quickly and safely as practicable. These steps would then
prevent the concentration of flammable fluids reaching or exceeding the Lower Flammable Limit
(LFL).

The reduction or elimination of ignition sources will (theoretically) prevent ignition of any release
prior to dispersion or dilution having occurred.

A conflict arises with the open module concept. The normal practice for fire protection engineers is
to consider the firewater demand of the largest area plus adjacent areas to which the fire may
spread. It can be seen that the larger area (the practical result of opening modules) increases the

152-RP-48 Rev 02, Feb 2006 Page 108 of 261

fireandblast.com

firewater demand and may make the demand impractical for normal firewater pump sizing. The
open area also decreases the likelihood that the fire will ever be ventilation controlled, thus
requiring the designer to consider other steps. This “open module” measure does however improve
the situation for explosions (as was discussed in Part 1 of this guidance).

Concerning designing drainage systems to remove liquid hydrocarbon spills, these pose no
obvious safety conflicts with other hazard categories but may create an undesirable environmental
event. Although regulators often acknowledge environmental impacts in extreme events, the
design and operational constraints of this safety measure should be considered further and the
consequences of both events understood.

4.6.3 Conflicts arising from detection safety measures

Detection measures tend to be relatively passive and provide a step towards a more precise
hazard management system (focussed control, mitigation or response). There are no obvious
conflicts identified here, merely that the detection devices/systems should certainly be directed
towards specific hazard categories and if possible, specific hazards. The detection devices should
be defined by their Performance Standards to achieve a certain degree of detection in the context
of particular hazards and also with other protective measures having been activated, for example,
flame detection effectiveness after firewater systems (deluge or mist) have been activated.

Therefore, for detection, the issue is more of omission (of particular applications) rather than
conflict and can be clarified by clear application to the defined hazards.

4.6.4 Conflicts arising from control safety measures

Safety measures that might be considered to control the event would comprise isolation valves and
blowdown systems to control the inventory available to feed the fire. Dependent upon the way that
the incident was defined, a further control system would be the firewater system, either acting to
control escalation or acting as a mitigation measure. The firewater systems will be discussed under
conflicts arising from mitigation measures.

Concerning isolation valves and blowdown systems, these will limit the released inventory for any
release event and present no conflict in the execution of that function. However, to function well in
the event of an incident, these measures may require additional ESD valves and blowdown lines.

The designers should be aware of one area of conflict in that the actuators of large valves are
themselves quite large and that they and/or blowdown piping will constitute significant obstructions
to explosion generated flame-fronts and thus increase overpressure loads which may in turn
require blast protection as both ESD valves and blowdown lines are safety critical. The design
process moves into a vicious circle whereby the safety items can increase the severity of the event
they are controlling. These issues are not insuperable and like many safety issues are dealt with by
adopting good layout principles.

4.6.5 Conflicts arising from mitigation safety measures

The are 3 main mitigation measures for fire hazards;

• Physical containment; to stop the fire either escalating to adjoining sensitive areas (where
personnel may be), or reaching new inventories or to otherwise limit the fire by ventilation
control.

• Extinguishing systems; to extinguish the fire directly or to cool surrounding piping,

equipment and structures to retain strength and stop escalation.

152-RP-48 Rev 02, Feb 2006 Page 109 of 261

fireandblast.com

• Designing for retention of structural integrity; to provide fire resistance (via intrinsic
structural strength or passive fire proofing) in order to maintain structural integrity to support
process systems (and avoid escalation) and to support areas of greater safety for
personnel (TR and muster areas) and to support evacuation systems (TEMPSC launch
stations, helidecks).

With respect to the mitigation measures identified under item 1, these measures provide the
greatest conflicts with other hazard categories. Physical containment of areas, whilst delineating
fire areas, providing greater effectiveness for the applied fire water systems and a degree of
ventilation control (in circumstances where the area/module is well sealed) have adverse effects on
other hazards. Gas or vapour releases are also contained, they are not dispersed beyond the
area/module and the opportunity for dilution to below the Lower Flammable Limit does not exist.
Also, there remains the possibility that delayed ignition initiates an explosion rather than a fire in
which case the resultant explosion overpressure will more than likely be higher than in an open
module (though this may not always be the case and a considered analysis should be undertaken,
see Part 1 of this Guidance). The avoidance of gas/vapour clouds in the flammable or explosive
region should always be the first priority.

Concerning mitigation measures identified under item 2, there is a range of demands for the
extinguishing systems dependent upon which fire type they are designed for. In addition, there are
different nozzle types and spray behaviour required for explosion suppression. The mixture of
nozzle types and their location should be considered carefully when designing the firewater
system. Dependent upon the hazards identified for an area, a decision can be taken on the basis
of the risk (considering both likelihood and consequence) of the “reasonably foreseeable” events.
The risk ranking of the types of events will provide an indication as to the types and locations of
firewater nozzles to be used.

There is also the effect of timing; deluge used for explosion suppression is required to be activated
early, i.e. in advance of any ignition and this has led to the practice of some operators of

The critical consideration for the structural and safety demands required by mitigating measures
under item 3 is to maintain structural integrity. There are no obvious conflicts arising from
measures meeting these demands, the increased strength and/or added passive fire proofing do
not impact other hazard management measures. However, the addition of passive fire proofing
does increase the likelihood of accelerated corrosion due to trapped moisture which may arise
from leaking insulation or from temperature cycling generating condensation.

4.6.6 Conflicts arising from emergency response safety measures

The safety measures considered here will form escape and evacuation equipment, both personal
and for teams and will also comprise portable and hand-held fire-fighting equipment. These are all
measures required to assist personnel and there are no obvious conflicts where their provision
impairs the hazard management efforts for other hazard categories. At worst, they may be
ineffective, as indeed they will be for some fire scenarios.

4.7 Fire and explosion walls

There are two main types of fire and explosion resistant walls: Proprietary corrugated walls (in
carbon or stainless steel) and bulkhead walls.

Corrugated walls are the most popular, mostly because they are lighter, less expensive and can be
manufactured complete, off-site and installed after grit-blasting and painting of topsides structure
and installation of main equipment. They fit more easily into the construction programme. PFP is
generally tested using flat surfaces; the effects of a jet fire on a corrugated wall either in terms of
heat load or surface PFP are less well understood.

152-RP-48 Rev 02, Feb 2006 Page 110 of 261

fireandblast.com

Another issue for manned areas can be toxicity of smoke from intumescent PFP. This type of PFP
is rarely used on corrugated walls but is common on bulkhead structures.

Corrugated walls are designed not to participate in the loads bearing capacities of the structures
they are integrated into and only have to have residual strength in fire to support their own weight.

Bulkhead walls on the other hand do participate in the dead load carrying capacity of the structures
into which they are constructed and therefore require to be insulated to prevent strength loss in
fire. Most fire / Blast walls do not otherwise require to be insulated, and insulation of them is only
normally required where they are used as boundaries to enclosed occupied rooms.

Resistance to penetration by projectiles will be affected by temperature rise and this will depend
upon whether PFP is used or not. It also depends on whether or not the insulation is on the fire
attack side or the cold side of the wall.

In some cases relatively thin coatings of PFP have been applied to (carbon steel) corrugated walls
and this has the advantage of ensuring limited temperature rise during the important early blow-
down phase of platform equipment when BLEVE and projectile risk is highest (a compromise
solution).

Stainless steel corrugated walls have more residual strength at elevated temperatures and are
therefore more resistant to projectiles. On the other hand they tend to be thinner than equivalent
carbon steel walls and this diminishes the strength advantage in regard to projectile penetration,
but they are very ductile.

Support interface design is important as this must allow for thermal expansion of the wall in fire and
out-of-plane bending, due to preceding explosion or differential temperature through the depth of
the wall or both. The out of plane deflection due to fire is lower with corrugated walls because the
geometry of the wall profile ensures that the inner flange and outer flange are heated equally,
whereas large differential temperatures occur in bulkhead walls and stressed skin construction
(with the plate on the fire side) because the cold side flange of the stiffeners is not heated directly:
the temperature gradient is greatest with uninsulated walls.

Provided the supports are configured to deform without strength-loss, the residual strength of the
wall will not be affected by the distortion but care needs to be taken with the PFP in these areas,
particularly where such PFP is within the coat-back distance for the structure that supports the
wall. If in doubt, shaped stainless steel flashings can be used in such locations with fibrous
insulation behind.

4.8 Decks
Decks normally comprise a series of girders and a stiffened deck plate. Usually the PFP will be
applied to limit the temperature rise of main girders and those secondary beams that support the
higher categories of Safety Critical Equipment. Coat-back requirements are often relaxed to 50 mm
or so hence the overall percentage of cover to deck steel work will be relatively small.

Of course it is not normal to coat the top surface of decks. In pool fires decks would not be
expected to be heated if the fire is from above but this may not be the case with jet fire. The top
flanges of girders can be weakened in such circumstances, particularly as the insulation to the
girder below the deck plate will inhibit heat loss and allow higher top flange temperatures to occur.
These are potential considerations.

As a general rule it is preferable to specify the secondary deck beams and plating to have a higher
strength than the primary structure so that it’s loss in explosion and / or fire does not lead to the
primary structures being dragged down or losing their secondary stabilising support members, for
example for lateral torsion buckling. The welding of secondary steel and girder connections needs
particular attention and it is recommended to make welded connections capable of transmitting the

152-RP-48 Rev 02, Feb 2006 Page 111 of 261

fireandblast.com

forces imposed during gross deformation of the secondary members they connect without fracture
(as in earthquake-resistant design).

Potential deficiencies in fire resistance of decks which support SCE’s or which act as fire-
boundaries can sometimes be overcome by the addition of deck to deck hangers. Where the
critical fire is below the deck these hangers would not be weakened as they would be located in a
different fire area. This is a solution that can be applied for retrofit situations.

It should be understood that there may be a problem of running pool fires on decks due to
distortion of plates arising from the fire. All analyses are based on a circular or bunded fire and do
not take into account potential running. The HSE are currently planning a test programme to
investigate this effect.

4.9 Feedback from explosion testing at Spadeadam

Large scale fire testing has been carried out at the Spadeadam test establishment. In the context
of testing of PFP, Spadeadam has developed a large scale explosion test of PFP material which
subjects PFP covered samples to an explosion loading (including drag forces in the case of pipes
or beams) and following the explosion test, the samples are subjected to a standard jet fire test.

There is an added level of acceptance for Duty Holders that the combined explosion/fire testing
can be witnessed by a 3rd Party such as the Verification Body, who have certified the results of the
tests for a number of PFP manufacturers.

152-RP-48 Rev 02, Feb 2006 Page 112 of 261

fireandblast.com

5. Derivation of fire loadings and heat transfer

5.1 Introduction
In the following sections generic fire types are identified for the types of fire that might occur on or
near an offshore installation. The fire types are considered further in terms of their characteristic
flame and how their behaviour might be affected by confinement and/or deluge. The parameters
used to define the fire and the hazards presented by the fire in terms of thermal and smoke loading
are defined.

Based on large scale experimental work (including unpublished studies by Advantica to which
access has been granted for this guidance) and on the predictions of validated models developed
and used by Shell and Advantica, typical fire loading data are summarised for the fire types.
Typical values can be used to assess the hazard to personnel and the likely effect on fire impacted
obstacles using a simple calculation method.

Also considered are the effects of deluge on fire behaviour, the potential heat loads from fires and
the effect on the temperature rise of an engulfed object, plus the manner in which PFP may limit
the rate of temperature rise of an engulfed object and how blow-down may reduce the heat load
and hence the likelihood of failure. Using these typical fire loadings and calculations of heat
transfer to objects, the steps to prepare an initial scoping or indicative QRA of the fire hazards are
also outlined.

5.2 Fire characteristics and combustion effects

5.2.1 General

In Section 3.2.35, potential fires on offshore installations were categorised into six fire types. In this
section, each of these fire types is described in detail in terms of the likely nature of the flame and
the thermal loading it may present to the surroundings. Where appropriate, the effect of active
water deluge on the fire is discussed as is the effect of confinement.

5.2.2 Gas jet fire

5.2.2.1 Nature of the gas jet fire

An ignited pressurised release of a gaseous material (most typically natural gas) will give rise to a
jet fire. A jet fire is a turbulent diffusion flame produced by the combustion of a continuous release
of fuel. Except in the case of extreme confinement which might give rise to extinguishment, the
combustion rate will be directly related to the mass release rate of the fuel.

In the offshore context, the high pressures mean that the flow of an accidental release into the
atmosphere will be choked having a velocity on release equal to the local speed of sound in the
fluid. Following an expansion region downstream of the exit the flame itself commences in a region
of sub-sonic velocities as a blue relatively non-luminous flame. Further air entrainment and
expansion of the jet then occurs producing the main body of the jet fire as turbulent and yellow. In
the absence of impact onto an object, these fires are characteristically long and thin and highly
directional. The high velocities within the released gas mean that they are relatively unaffected by
the prevailing wind conditions except towards the tail of the fire. The fire size is predominantly
related to the mass release rate which in turn is related to the size of the leak (hole diameter) and
the pressure (which may vary with time as a result of blowdown).

In the case of high pressure releases of natural gas, the mixing and combustion is relatively
efficient resulting in little soot (carbon) formation except for extremely large release rates. Hence
little or no smoke is produced by natural gas jet fires (typically <0.01 g m-3), and the fires tend to be
152-RP-48 Rev 02, Feb 2006 Page 113 of 261
fireandblast.com

less luminous than jet fires involving higher hydrocarbons. CO concentrations in the region of
5 to 7 % v/v have been measured within a jet fire itself but this is expected to drop to less than
0.1 % v/v by the end of the flame.

A factor which is often overlooked is the noise produced by sonic gaseous releases. This is usually
high pitched and so loud that it may prevent effective radio communication between personnel. As
a result emergency actions could be hampered.

A further point to note is that some combinations of leak size and pressure will not give rise to an
inherently stable flame. For hole sizes under 30 mm diameter, there is a lower bound pressure
which high pressure releases must exceed to produce stable flames. Simplistically, this extends
approximately linearly from 2 barg at 30 mm diameter to about 75 barg at 8 mm diameter. In
practice this means that most small leaks (see Section 5.4.1) will be inherently unstable and will
not support a flame without some form of flame stabilisation, such as the presence of another fire
in the vicinity to provide a permanent pilot or stabilisation as a result of impact onto an object such
as pipework, vessels or the surrounding structure. This implies that unstable flames may self-
extinguish revert to leaks thus contributing to potentially explosive environments. This aspect of
flame behaviour should be considered in determining major hazard scenarios and their escalation
paths, however, in the highly congested environment offshore, impact within a short distance is
very likely, and small leaks will most likely stabilise on the nearest point of impact.

Apart from providing flame stabilisation, impact onto an obstacle may also significantly modify the
shape of a jet fire. Objects which are smaller than the flame half-width at the point of impact are
unlikely to modify the shape or length of the flame significantly. However, impact onto a large
vessel may significantly shorten the jet fire, and impact onto a wall or roof could transform the jet
into a radial wall jet where the location and direction of the fire is determined by the surface onto
which it impacts.

As noted above, the combustion process within a natural gas jet fire is relatively efficient and
produces little soot (carbon). Consequently these flames are not as luminous as higher
hydrocarbon flames. Radiation emissions from natural gas flames arise mostly from water vapour
and carbon dioxide, except for very large releases where soot production starts to enhance the
process. The long thin shape may also result in a flame path which is not optically thick. The net
result is that the radiative heat transfer to the surroundings is lower than for higher hydrocarbon
flames and this is reflected in the fraction of heat radiated, F, for such fires (see Section 5.3.1 “Fire
loading to the surroundings”). Similarly, the radiative heat transfer to objects engulfed by the flame
is generally lower than for higher hydrocarbon flames, but the high velocities within gas jet fires can
result in high convective heat transfer to objects. Clearly the total heat flux which is imparted to an
engulfed object will vary over the surface of the object. In addition, the relative proportions of
convective and radiative heat flux will vary over the surface, with the highest convective component
likely to be experienced close to the point of impact of a flame where the highest velocities occur,
whereas the highest radiative heat load will be experienced where the more radiative part of the
flame (usually nearer the end of the flame) is viewed by the object. As the more radiative part of
the flame is closer to the tail, this can result in the highest overall heat fluxes being experienced on
the rear surface of an engulfed object which may seem counter-intuitive. Neglecting such spatial
variations, broadly speaking, for a given location of an object within a flame (as a proportion of
flame length), the convective component is more or less constant with increasing size of release,
whereas the radiative component increases with release rate as the flame becomes optically thick
and more smoky. Hence the relative proportion of convective to radiative flux varies with fire size
(see Section 5.4.2).

5.2.2.2 Effect of deluge on gas jet fires

The activation of general area deluge can adversely affect the stability of high pressure gas jet
fires, particularly if the fire is not impacting onto an obstacle. However, in most practical cases, this
undesirable effect is very unlikely to occur due to impact onto obstacles providing adequate flame
stabilisation. Indeed, deluge has little effect on the size, shape and thermal characteristics of a high
pressure gas jet fire. Therefore, the heat loading to engulfed obstacles is not diminished. The same
152-RP-48 Rev 02, Feb 2006 Page 114 of 261
fireandblast.com

is true for dedicated vessel deluge systems; the water being unable to form a film over the vessel
in the presence of the high velocity jet, and so dry patches form where the temperature rise is
undiminished by the action of deluge.

There is some evidence that the deluge increases combustion efficiency resulting in lower CO and
increased CO2 levels within the flame.

The major benefit of area deluge with jet fires arises from the suppression of incident thermal
radiation to the surroundings, which protect adjacent plant and in particular, aid escape by
personnel. For a medium velocity type (e.g. MV57) nozzle operating at 12 l min-1 m-2, incident
radiation levels can be reduced by about 20 % for a single row of nozzles, 30-40 % for 2 rows and
40-60 % for more than 2 rows (general area deluge). Increased deluge rates can further reduce
incident radiation levels: 60-70 % at 18 l min-1 m-2; 80-90 % at 24 l min-1 m-2 for general area
deluge. Nozzles producing smaller droplet sizes can have an enhanced mitigation effect, but there
is an increased risk that the droplets will be blown away by the wind.

5.2.2.3 Effect of confinement on gas jet fires

The behaviour of a jet fire within a confined or partially confined area will depend upon the degree
of confinement and the direction of the jet relative to the ventilation opening. If ventilation is
plentiful or the jet is directed through a vent then there may be little difference in jet fire
characteristics compared to an unconfined fire. However, if the release rate of gas is large relative
to the size of the confinement or the ventilation openings are small then the fire may not be able to
entrain enough air for complete combustion inside the compartment. This is likely to result in
increased levels of incomplete combustion products such as CO, increased levels of smoke (soot)
and increased flame temperatures, particularly in regions close to the ceiling of a compartment
where hot combustion products may be trapped and recirculate. This leads to increased heat flux
to objects and surfaces compared to an unconfined fire.

The location where combustion occurs and the hottest parts of the flame may also shift due to the
confinement. In tests involving horizontal jet fires in a compartment incorporating a single wall vent,
where the jet was directed away from the vent, increased temperatures were seen at the interface
between the smoke layer leaving the compartment and the air layer entering the compartment,
most particularly in the area furthest from the vent.

Unlike unconfined fires, the behaviour of under-ventilated confined fires changes with time as the
air initially available within the compartment is consumed, and this may lead to ‘external flaming’
after a period of time when the body of flame moves through the vent in order to find the oxygen
required for combustion. CO levels of up to 5 % v/v at the vent may occur but after the onset of
external combustion the CO levels drop to typically less than 0.5 % v/v by the end of the flame.
Soot production is related to the equivalence ratio and hence the degree of ventilation and may
range from about 0.1 g m-3 at = 1.3 to up to 2.5 g m-3 at = 2.

Certain ventilation patterns could lead to flame instability and extinguishment. The worst case
condition is likely to occur if the jet fire is slightly under-ventilated as this leads to high heat release
rates and enhanced soot production.

5.2.2.4 Confinement and deluge of gas jet fires

Deluge of a confined jet fire may lead to flame extinguishment and hence a serious explosion
hazard from the continuing release. The likelihood of flame extinguishment is significantly
increased if the surroundings are already hot at the time the deluge is activated as the main
mechanism which results in extinguishment of the jet fire is ‘inerting’, that is evaporation of the
water droplets leading to a mixture of gas/air/steam within the compartment which is outside the
flammable limits. The water vapour may also contribute to flame instability by reducing the burning
velocity. However, if the deluge is activated at an early stage, prior to the compartment walls
becoming hot, then the fire may not be extinguished and some benefit in terms of reduced flame
temperatures and wall temperatures may accrue.
152-RP-48 Rev 02, Feb 2006 Page 115 of 261
fireandblast.com

5.2.3 Two-phase jet fire

5.2.3.1 Nature of the two-phase jet fire

An ignited release of a pressurised liquid/gas mixture (such as ‘live crude’ or gas dissolved in a
liquid) will give rise to a two-phase jet fire. The gas stream atomises the liquid into droplets which
are then evaporated by radiation from the flame. However, a pressurised release of a liquid can
also give rise to a jet fire in which two-phase behaviour is observed if the liquid is able to vaporise
quickly. This is most likely to occur when a liquid is released from containment at a temperature
above its boiling point at ambient conditions whereupon flash evaporation occurs, (for example
propane, butane).

Pressurised releases of non-volatile liquids (for example, kerosene, diesel, or stabilised crude) are
unlikely to be able to sustain a two-phase jet fire, unless permanently piloted by an adjacent fire;
even so, some liquid drop-out is likely and hence the formation of a pool. At high pressures, a
spray of liquid droplets may be formed which can drift in ambient winds and become dispersed
over a wide area.

As for the gas jet fire described above, the two-phase jet fire is a turbulent diffusion flame produced
by the continuous combustion of a fuel at a rate directly related to the mass release rate, producing
a fire which is long and thin (although generally wider than a gas only jet fire) and highly
directional. The exception is when liquid drop-out occurs, leading to a potentially increasing
accumulation of fuel as a pool. Two-phase jet fires (particularly those generated by flashing liquid
releases) are significantly less noisy than gas jet fires. As for gas jet fires, impact onto an obstacle
larger than the flame half- width at the point of impact may shorten or modify the shape of a fire
significantly.

The liquid content results in relatively higher release rates for a given aperture and pressure
compared to gaseous releases and, when the release is two-phase (such as may arise from a
relatively long pipe connected to a liquid storage vessel), estimating the release rate is difficult. The
output from Codes used to characterise 2-phase releases should be viewed with caution as these
types of mixed fluid flows are very difficult to model accurately. The generally lower exit velocities
from flashing liquid releases lead to shorter flame lift-offs and proportionately shorter and more
buoyant flames overall. These lower velocities also make the fires more wind affected whilst the
higher hydrocarbon content of these fuels increases the flame luminosity. However, two-phase
releases involving gas dissolved in, or mixed with, a liquid can result in a jet fire which combines
the worst aspects of both the gas jet fire and the flashing liquid jet fire, that is, high velocities and
high flame luminosity.

The higher hydrocarbon content also results in more soot being formed than in a natural gas jet
fire, although there is no available experimental data quantifying the difference. Measurements in
the smoke downstream of a ‘live crude’ jet fire determined an optical obscuration factor of typically
10 % over a 200 mm path length. This corresponds to a visibility distance of about 5 m.

The soot produced then contributes significantly to the radiant emissions from the flame, resulting
in a proportionately higher contribution of radiative flux to engulfed objects. However, the generally
lower velocities arising from flashing liquid releases (such as propane or butane) results in a lower
convective flux to engulfed objects. Impaction to an obstacle close to the leak can also result in a
local cold spot and hence high temperature gradients to the surrounding hot areas, inducing
thermal stress.

In the case of a pressurised gas-liquid mixture (such as ‘live’ crude), the high velocities may still
occur and result in a high convective contribution, whilst the higher hydrocarbon content maintains
a high radiative contribution; making these type of jet fires a ‘worst case’ in terms of total heat flux
to engulfed obstacles. Experimental work suggests that the maximum combined fluxes occur for
gas-liquid mixtures which are about 70 % by mass liquid.

152-RP-48 Rev 02, Feb 2006 Page 116 of 261

fireandblast.com

A special case of interest at some installations is ‘live’ crude which includes a significant quantity of
water. Experiments have shown that mixtures with a ‘water cut’ (defined as mass of water/mass of
fuel x 100 %) of up to 125 % remain flammable, although not necessarily capable of supporting a
stable flame in the absence of some other supporting mechanism. The inclusion of water also
slightly increases flame length and flame buoyancy, and the amount of smoke produced reduces
significantly. For water cuts under 50 % no significant reduction in heat fluxes to engulfed objects
can be expected (<10 %). However, over 50 % the flames are significantly less radiative, and the
overall heat flux to an obstacle can be reduced by 40 % or more.

5.2.3.2 Effect of deluge on two-phase jet fires

Compared to the situation with a gas jet fire, the use of dedicated vessel deluge to protect a vessel
against a flashing liquid two-phase jet fire (e.g. propane, butane) can be more effective. The water
interacts with the flame to some extent; reducing the flame luminosity and the amount of smoke
produced. Nevertheless, at typical application rates (10 to 15 l min-1 m-2) it cannot be relied upon to
maintain a water film over the vessel and hence to prevent vessel temperature rise in areas where
dry patches form, although the rate of rise may be expected to reduce to 20-70 % of the rate
without deluge for a propane jet fire. Similar behaviour has been noted for ‘live’ crude jet fires with
dedicated deluge although, in this case, no reduction in the rate of temperature rise was observed
in the area where the fire impacted the obstacle. However, in tests with an increased water
application of 30 l min-1 m-2, a 2 tonne LPG tank was effectively protected when subjected to a
2 kg s-1 flashing propane jet fire.

For ‘live crude’ jet fires, using area deluge at the ‘standard’ rate of 12 l min-1 m-2 is unlikely to
modify the flame behaviour although there is some evidence that a higher deluge rate
(24 l min-1 m-2) can result in water interaction with the flame, resulting in a shorter flame and some
reduction in heat fluxes to certain areas of an engulfed object, notably the front (where flame
impact occurs) and top areas. Since dedicated vessel deluge is more effective at reducing the
radiative heat fluxes in the region to the rear of the vessel, the combination of area deluge and
dedicated vessel deluge can be effective in reducing overall heat fluxes to a vessel such that the
temperature rise is halted or at least the rate of temperature rise is reduced. This may prevent
vessel failure, especially if combined with a blowdown strategy.

As for gas jet fires, a major benefit of area deluge of two-phase jet fires arises from the attenuation
of incident thermal radiation to the surroundings, which protect adjacent plant and in particular can
aid escape by personnel. Even dedicated vessel deluge alone can result in some reduction (~15-
20 %) in the incident thermal radiation to the surroundings as a result of modifying the flame
characteristics.

Measurements in the combustion products downstream of ‘live crude’ jet fires determined an
obscuration factor due to smoke of typically 10 % over a 200 mm path length without deluge and
no significant change was noted in the presence of area deluge at 12 l min-1 m-2. At 24 l min-1 m-2
the smoke changed from black to grey due to the increased water vapour and this had the effect of
increasing the obscuration factor to about 20 %, corresponding to a visibility distance of about 2 m.

5.2.3.3 Effect of confinement on two-phase jet fires

Confined two-phase jet fires are expected to behave in a similar manner to confined gas jet fires
(see Section 5.2.2.3).

5.2.3.4 Confinement and deluge of two-phase jet fires

The effect of area deluge on two-phase jet fires in compartments is expected to be similar to that
noted in Section 5.2.2.4 for gas jet fires. Extinguishment could give rise to a mist-air explosion
hazard and/or the formation of a liquid pool. In tests involving only partial confinement around the
upper area of a module, during which ‘dead spaces’ occurred close to ceiling, area deluge was
found to be beneficial in reducing heat fluxes to the ceiling surface, reducing the flame extent and
the amount of smoke produced.
152-RP-48 Rev 02, Feb 2006 Page 117 of 261
fireandblast.com

5.2.4 Pool fires on an installation

5.2.4.1 Nature of hydrocarbon pool fires

A pressurised release of a hydrocarbon liquid which is not sufficiently atomised or volatile to

vaporise and form a jet fire will form a pool. Similarly a spillage from non-pressurised liquid storage
will result in a liquid pool being formed. Ignition of the vapours evolving from the liquid can lead to a
pool fire which is a turbulent diffusion flame. For hydrocarbons such as condensate the vapours
will evolve readily from a spillage and be easily ignited. For heavier hydrocarbons, such as diesel
or crude oil, little vapour evolution occurs unless the fuel is heated and hence initial ignition of a
spillage may be dependent on the presence of other fires in the vicinity providing sufficient energy
to initiate vapour evolution. However, once ignited, the fire itself radiates heat to the pool surface
causing more fuel to evaporate. The heat transfer from the flame to the pool controls the vapour
evolution rate (and hence mass burning rate) and within minutes the fire will reach a steady state
condition of flame size and mass burning rate. Larger fires from larger pools will tend to result in
higher mass burning rates. However, an upper limit is reached when the radiation to the pool
surface is independent of the flame thickness above it (optically thick). This occurs for fires only a
few metres in diameter for heavy hydrocarbons due to the radiative emissions from soot. The mass
burning rate is also dependent on the fuel type and for liquid hydrocarbons decreases with
increasing carbon number (typically ranging from 0.1 kg m-2 s-1 for light hydrocarbons to
0.05 kg m-2 s-1 for some crude oils).

Combustion of these relative high hydrocarbons inevitably leads to the production of large
quantities of soot, particularly in large pool fires where the size of the pool reduces the ability of air
to mix with the fuel evolving in the centre of the pool. The soot emissions result in the characteristic
yellow flame and large quantities of smoke can be produced; to the extent that the smoke can
result in reduced thermal radiation to the surroundings by screening of the radiant flame. (Hence,
the fraction of heat radiated, F (see Section 5.3.1 for definition), tends to decrease with increasing
fire size, although the smoke hazard may increase). In measurements in the smoke downstream of
16 m2 diesel pool fires, the obscuration factor over a 200 mm path length, as a result of the soot,
was found to be typically 30 % corresponding to a visibility distance of about 1 to 2 m. CO levels
measured at the same location were in the range 100-200 ppm v/v. However, a worst case level at
the end of the flame of about 0.5 % v/v is recommended. Soot levels in the range 0.5 g m-3 to
2.5 g m-3 can be expected.

Except in very large fires where buoyancy driven turbulence may become significant, the low
velocities within the fire result in the flame being affected by the wind and this factor determines the
trajectory of the flame. These low velocities also result in low convective heat fluxes to objects
engulfed by the fire; the predominate mode of heat transfer being radiation.

5.2.4.2 Effect of deluge with hydrocarbon pool fires

General area deluge can be very effective in controlling hydrocarbon pool fires and mitigating their
consequences. If the water is capable of reaching the liquid pool, the cooling of the fuel reduces
vapour evolution and hence reduces the size of the flame. This, in turn, leads to reduced radiative
heat transfer from the flame to the fuel surface which also contributes to reducing the vapour
evolution. Consequently, with time, the fire size is reduced and complete extinguishment may
result or, if not, sufficient control achieved that manual fire fighting could be safely undertaken. The
ability of the water to enter the pool of fuel is higher on the upwind side of the fire where the
thickness of the flame is least. Consequently, as the deluge starts to take effect on the fire, the
flame retreats from the upwind side of the spillage. In tests involving condensate [5.1], the fire
coverage of the pool was reduced by over 90 % in 10 minutes. Hence, after 10 minutes, the flame
size was commensurate with a pool of less than 10 % of the original area. The introduction of a
small percentage (1 %) aqueous film forming foam (AFFF) into the deluge system can significantly
increase the rapidity of achieving fire control and extinguishment.

Due to the much reduced fire size when a pool fire is subject to water deluge, the amount of smoke
is also significantly reduced [5.2]. Measurements of the obscuration factor over a 200 mm path
152-RP-48 Rev 02, Feb 2006 Page 118 of 261
fireandblast.com

length in the combustion products from a diesel pool fire dropped from typically 20-30 % to
negligible levels when the fire was deluged and CO levels at the same location dropped from over
100 ppm v/v to typically 10 ppm v/v. However, if the water does not directly interact with the fire
itself and only interacts with the stream of smoke evolving then there is no evidence that the water
deluge ‘washes’ soot out of the smoke, nor that the toxicity (such as CO level) is reduced [5.3]. A
point of note is that the cooling effect of deluge may reduce the smoke buoyancy and possibly
result in smoke being present at lower heights where it may hinder the visibility for personnel trying
to escape.

The heat loading to objects engulfed in a pool fire may also be reduced by the activation of deluge,
most particularly on the surfaces where a water film can be maintained. The vulnerable areas will
be the underside where the water cannot provide coverage, and the downwind side where the
flame is likely to be thickest. Nevertheless, in these areas the rate of temperature rise is likely to be
reduced and additional benefit accrues from the action of the deluge in reducing the fire size. The
use of dedicated vessel deluge would be expected to protect an object engulfed in a pool fire,
especially in combination with general area deluge which will, simultaneously, reduce the degree of
fire attack.

As for jet fires, the water deluge will also provide benefit to objects not engulfed by the fire by
attenuating the thermal radiation (see Section 5.2.2.2)

5.2.4.3 Confined hydrocarbon pool fires

The behaviour of confined pool fires will depend on the degree of ventilation and whether the
confining structure becomes hot and re-radiates heat to the fire. In the case of adequate ventilation
for combustion, the mass burning rate and fire behaviour will be similar to a pool fire in an
unconfined area, unless the walls become hot due to insulation in which case the flame
temperatures may rise significantly (by about 200-400 ºC) and hence the heat fluxes to objects
within and near the flame will rise. This is associated with soot combustion and can lead to less
smoke being evolved.

However if the ventilation is less than that required for combustion the fire becomes ventilation
controlled and the mass burning rate (and hence the vapour evolution rate) decreases to match
available air flow. Due to the reduced burning rate, the flame size and heat fluxes to objects from
ventilation controlled confined pool fires may be lower than from unconfined fires unless
re-radiation from hot compartment walls increases flame temperatures. The restricted air flow may
result in an external fire at the vent openings and so areas not previously exposed to fire outside
the compartment may now be exposed to flame engulfment and thermal radiation.

In under-ventilated conditions both the CO and soot levels increase. CO up to 5 % v/v may be
measured at a vent prior to the onset of external flaming although at the end of an external flame
the levels are likely to fall to less than 0.5 % v/v. Soot levels up to 3 g m-3 might be expected.

5.2.4.4 Confined hydrocarbon pool fires with deluge

When deluge is activated within a confined space, the residence time of the water droplets in the
flame and hot walls leads to water evaporation within the flame and a significant reduction in flame
temperatures. This then reduces the radiation back to the pool surface and results in a lower mass
burning rate. An initially ventilation controlled pool fire may then become fuel controlled at this
lower burning rate and any external flaming that had formed is likely to be reduced or to cease
entirely.

5.2.4.5 Methanol pool fires

Methanol differs significantly from the hydrocarbon fuels discussed above. It burns with a non-
luminous invisible flame. No soot is produced and the thermal emissions are dominated by the
molecular emissions associated with the production of CO2 and water vapour. The flame height is
about one third that expected from an equivalent sized hydrocarbon pool. The mass burning rate
152-RP-48 Rev 02, Feb 2006 Page 119 of 261
fireandblast.com

increases with increasing pool size and a value of 0.03 kg m-2 s-1 has been measured for a 10 m
diameter pool. It is not known if the flame has reached ‘optical thickness’ at this scale and hence
whether this would increase further for larger fires. The low radiative emissions of the flame results
in a low fraction of heat radiated, F, and low heat fluxes to engulfed objects. On an offshore
platform an important hazard may be to personnel entering the flame unwittingly due to its
invisibility.

5.2.5 Hydrocarbon pool fires on the sea

Once established, a hydrocarbon pool fire on the sea will behave in a similar manner to an
unconfined pool fire on an installation (See Section 5.2.4.1). Consequently, depending on the size
of the fire, engulfment of the installation legs and the underside of the platform are possibilities.
Flame temperatures of typically 900 to 1200 ºC can be expected and heat fluxes to engulfed
objects up to 250 kW m-2.

Following initial ignition, the flame spread across the surface of a spill on the sea will depend upon
the volatility of the fuel, and the wind speed and direction. For oil spills, the rate of flame spread
downwind increases with increasing wind speed. The flames tend to spread from the ignition
source downwind across the spill without significant crosswind spread and flame spread upwind is
slow. The presence of sea currents or regular waves (swell) does not appear to influence flame
spread but it may be curtailed by choppy conditions or steep waves.

The significant difference between liquid spills on an installation and liquid spills on the sea is that
on the sea it is unlikely that ignition will occur at all. Overall, the likelihood of ignition is low
(especially for less volatile hydrocarbons such as crude oil) due to a number of factors which are
discussed below. The likelihood of ignition also decreases with time following a spill, sometimes
rapidly, so spills where immediate ignition could occur (or ignition has already occurred) are likely
to be the main focus of attention.

Firstly, and perhaps most importantly, the likelihood of an ignition source being present near the
sea surface would generally be low. Assuming an ignition source is present, there are three main
factors that influence the ignitability of liquid spills onto the sea, all of which are time dependent.
Their significance in inhibiting ignition increases with time resulting in lower ignition probabilities.
These are: pool thickness; fuel flashpoint; and emulsification.

Following an initial spillage, the pool will spread out quickly reaching an equilibrium thickness
within a few hours, even for a large spillage. This equilibrium thickness depends upon fuel type
with typical values of less than 0.1 mm for light crude oils and 0.05-0.5 mm for heavy crude oils.
However, there is a minimum pool thickness which is capable of supporting a stable flame; about
0.5 mm for condensate; 1 mm for light crude; and 1-3 mm for heavier oils. When the thickness falls
below these levels, the cooling effect of the sea prevents evaporation of the fuel from the pool
surface which is required for combustion. This is because the temperatures at the pool/water
interface are never above 100 ºC and are generally close to ambient temperatures. When the pool
is thick, a steep temperature gradient through the pool allows evaporation at the pool surface and
potential ignition, especially if a high energy ignition source is present such as another fire which
will enhance evaporation rates.

Therefore, the fuel flashpoint is also a factor in determining the likelihood of ignition. Fuels with a
flashpoint lower than the ambient temperature will ignite readily but those with a flashpoint over
100 ºC (such as stabilised crude oil) will require the presence of a major heat source to achieve
ignition, such as a pre-existing fire on the platform. Therefore, the likelihood of ignition of a liquid
spill reduces with time as the lighter fractions evaporate.

Emulsification of a hydrocarbon fuel with sea water will reduce significantly its flammability. For
crude oils, emulsions with over 25 % water are considered to be not ignitable. The cut-off point for
condensate is unknown, but is likely to be higher. Emulsification of the fuel and water arises
primarily as a result of the initial spill conditions and the subsequent weather/sea conditions.
Breaking waves and wind speeds over 15 m s-1 will promote emulsification and result in a low
152-RP-48 Rev 02, Feb 2006 Page 120 of 261
fireandblast.com

probability of ignition. (The wave action will also cause fluctuations in the pool thickness and may
result in breaking up of the pool and thereby prevent sustained burning). Spills which plunge into
the sea from the platform, (which, if burning, may be extinguished in the process) are likely to
break up and begin to emulsify. The least emulsification is likely to result if spills run down an
installation leg or occur close to the sea surface.

In the case of sub-sea oil pipeline failures in shallow water (<200 m), the oil plume widens as it
rises through the water and breaks up into small droplets. Any significant gas component in the oil
provides additional initial upward momentum and the oil droplets are likely to break the surface in a
location above the original failure and then spread radially. However, the pool may then be carried
along by tidal currents and wind. This process provides significant opportunity for emulsification
and reduces the ignitability of any resulting pool. In case of stabilised crude, the lower initial
buoyancy will result in the rising plume being more affected by tidal currents and the oil may reach
the surface at a location displaced laterally from the original leak site.

In deep water, some or all of the gas component may form gas hydrate solids and this results in a
reduced initial upward velocity for the leak, leaving the oil droplets to rise purely as a result of their
buoyancy. In these circumstances the lateral movement of the rising plume may be significant and
the oil eventually reaches the surface some distance from the original leak location. Again,
significant emulsification will have occurred resulting in very low ignition probabilities.

In summary, a low velocity, ignited, large volume spillage of a volatile liquid hydrocarbon close to
the sea surface near to the installation in calm or moderate conditions represents the worst case
scenario in terms of a pool fire on the sea. Most other scenarios have a low likelihood of producing
a pool fire. Experiments carried out by Sintef (Sintef has carried out two experiment series at
Spitzbergen in 1994, burning large oil slicks on the sea surface) can be referred to for further
information.

5.2.6 Gas fires from sub sea releases

In shallow water, failure of a sub-sea gas pipeline (or a pipeline containing a gas-oil or
gas-condensate mixture with a high GOR) could give rise to a flammable gas release at the sea
surface. However, the likelihood depends primarily on the depth of sea water. In shallow water the
plume of bubbles will increase in radius approximately linearly as it rises through the water
producing a conical plume. When close to the water surface, the streamlines diverge horizontally
and tidal currents interact with the plume and this may result in the area where the gas bubbles
break the surface being twice that expected by conical plume development only. Whether the
resulting gas breaking the surface is flammable will depend on the rate of gas released and the
area over which it breaks the surface which, as already noted, is related to the water depth.
However, unless the water is very shallow (<10 m), the resulting gas release at the sea surface is
likely to be a dispersed low velocity source and burn as a weakly turbulent diffusion flame, strongly
affected by the wind. It could be considered as a ‘pool fire’ with an effective mass burning rate
given by the release rate divided by the area over which the gas surfaces. A full bore rupture of a
sub-sea pipeline will result in a highly transient outflow, so the resulting fire hazard will also vary
with time. The operation of a sub-sea ESDV valve may limit the duration of the release and also
give rise to a rapidly changing release rate with time.

In deep water (>300 m) some formation of gas hydrates is likely and over 500 m some researchers
report complete conversion to hydrates, although this also depends on gas composition and water
temperature. In such cases, the hydrates will rise solely as a result of buoyancy and are likely to
reach the sea surface some distance laterally from the original leak site. Some researchers
suggest that water turbulence may keep the hydrates in suspension and the gas may never reach
the surface.

5.2.7 BLEVE

Fire impingement on a vessel containing a pressure liquefied gas causes the pressure to rise
within the vessel and the vessel wall to weaken. Even within a short timeframe, this may lead to
152-RP-48 Rev 02, Feb 2006 Page 121 of 261
fireandblast.com

catastrophic failure and the total loss of inventory. The liquefied gas which is released flashes
producing a vapour cloud which is usually ignited. These events are known as Boiling Liquid
Expanding Vapour Cloud Explosions, BLEVEs. This highly transient event generates a pressure
wave and fragments of the vessel may produce a missile hazard leading to failure of other items in
the vicinity and hence the potential for escalation. In addition, there is a flame engulfment and
thermal radiation hazard produced by the fireball.

Onshore, BLEVEs are generally associated with the storage of pressure liquefied fuels such as
LPG. Experimental work has shown that a standard LPG storage vessel, incorporating the normal
pressure relief valve, can fail catastrophically within 5 minutes of being subjected to a medium
sized (<2 kg s-1 or ~100 MW) jet fire, despite operation of the relief valve. Following failure, a large
approximately spherical fireball is produced which is highly radiative with little smoke obscuration
due to the fuel atomisation and vaporisation leading to good mixing with the air. Consequently, the
fraction of heat radiated, F, is higher than for a large pool fire involving the same fuel. The initial
upward momentum and vorticity of the fireball causes it to rise into the air as it develops and
eventually it burns out when all the fuel is consumed. How much of the initially liquid fuel vaporises
and takes part in the fireball depends upon the degree of superheat of the fuel at the time of failure
and also whether liquid becomes entrained into the flashing vapour.

In the offshore context, a BLEVE hazard might be considered, for example, in relation to a
pressurised separator vessel containing unstabilised condensate and gas. However, a BLEVE is
unlikely to develop in the same way as described above for an onshore facility as the vessel will
probably be located within a module amongst other vessels and pipework. The potential for
escalation is thus much increased due to the proximity of other vessels and pipework which may
be struck by missiles. Additionally, the presence of this other equipment may lead to increased
overpressures being developed as the burning gas cloud expands through the congested region.
The presence of roof confinement will significantly modify the shape of the developing fireball and
lead to increased lateral development. Even a small inventory of fuel being involved in a BLEVE
event (<100 kg) would be expected to produce a fireball extending throughout the entire volume a
typical module. Consequently, apart from the risk of the BLEVE causing escalation, the event
presents a severe hazard to exposed personnel.

Whilst pre-activation of deluge (area and dedicated vessel deluge) may prevent or delay the
occurrence of a BLEVE, the deluge is unlikely to provide any significant benefit in terms of
mitigation of the event, especially within the region of potential flame engulfment.

152-RP-48 Rev 02, Feb 2006 Page 122 of 261

fireandblast.com

5.3 Fire and smoke loading

5.3.1 Fire loading to the surroundings

An obvious hazard presented by a fire is the thermal radiation to the surroundings, in particular to
personnel during escape and evacuation. The incident thermal radiation, q, to a person or object
from a fire can be described as:

q=VEt (kW m-2) .................................................................. Equation 5-1

Where:

V is the view factor of the flame by the receiver,

E is the average surface emissive power of the flame (kWm-2) (Note the surface
emissive power varies over the surface of the flame and hence an area-based
average is required to represent the whole surface)

τ is the atmospheric transmissivity

The view factor is a function of the flame shape. Consequently, most integral or empirical
mathematical models will assume some kind of simplified flame shape which is then used to
calculate the view factor. The flame average surface emissive power is also a function of the flame
shape. Therefore, average surface emissive powers used by the model will not necessarily be the
same as those measured during an actual fire.

In the far field, (typically more than 2 flame lengths away) the flame shape is not critical, so a
simplified approach can be taken using the ‘point source’ model, whereby the difficulties of defining
a flame shape and associated average surface emissive power can be avoided. In this approach,
the fraction of the heat of combustion of the fuel radiated to the surroundings is defined as:

EA
F= ....................................................................................... Equation 5-2
Q

Where:

A is the surface area of the flame (m2)

Q is the net rate of energy release by combustion of the fuel (kW) and Q = m H

m is the rate of fuel combustion (kg s-1)

H is the net calorific value (kJ kg-1)

The incident radiation received in the far field at a distance, d (m), from the fire is then expressed
as:

τ F m H
qd = ................................................................................ Equation 5-3
4 π d2

The atmospheric transmissivity will depend upon the prevailing atmospheric conditions (absolute
humidity) and the path length, but might typically be 0.8 on a dry day. However, fog would
significantly reduce this value.

The activation of water deluge on an offshore installation, producing water droplets in the air,
effectively reduces the transmissivity by absorbing radiation. However, for the purposes of this
document, a revised ‘effective’ fraction of heat radiated is defined as F ′ , accounting for the
152-RP-48 Rev 02, Feb 2006 Page 123 of 261
fireandblast.com

reduced transmissivity in the area being deluged, (but not including the transmissivity of the
atmosphere between the fire and the receiver which is outside the deluged area). The incident
radiation at a distance, d(m), from the fire can be estimated using:

τ F ′ m H
qd = .............................................................................. Equation 5-4
4 π d2

Note that the above equation does not necessarily take account of any effect of the deluge on the
flame behaviour itself – such as lowering the flame temperature or size. As will be noted later, jet
fires are little affected by deluge, but pool fires can reduce significantly in size. In the case of pool
fires, this reduction in size (area of the surface actually burning) would result in a reduced value of
m and hence would be reflected in calculations made using the above equation.

This ‘point source’ model can be useful for estimating the distance to a given radiation level. In the
case of personnel, it is important to consider both the level of radiation and the duration of
exposure and the consequences for personnel (in terms of burn injuries or fatality) are often related
quantitatively to the dosage level, S d , given by:

S d = ∫ qd
( 4 3) dt ............................................................................... Equation 5-5

As a guide, a radiation level of about 5 kWm-2 can be tolerated for about one minute and
consequently represents a level from which it is reasonable to assume that escape, without
significant injury, would usually be possible for an average employee wearing typical protective
clothing, (see also Section 5.5.3.5).

However, the point source model is not suitable for estimating incident radiation to locations close
to (certainly within one flame length) of the flame, where it may be significantly in error. In the near
field, a mathematical model which defines a realistic flame shape (and ideally a variation of surface
emissive power over the flame to allow for smoke obscuration) should be used.. Typical values of
F and F ′ are provided in Section 5.4.2 for a range of fire types.

5.3.2 Thermal loading to engulfed objects

The thermal load per unit area to an object engulfed by fire will be a combination of radiation from
the flame (qrl) and convection from the hot combustion products (qcl) passing over the object
surface. Hence the thermal load can be written as:

q1 = qrl + qcl

( )
q1 = ε f σ T f4 + τ f σ Ta4 + h T f − Ts ............................................... Equation 5-6

where

ε f , τ f are the flame emissivity and transmissivity respectively,

σ is the Stefan-Boltzmann constant (5.6697 x 10-11 kWm-2K-4)

T f , Ts and Ta are the flame, object surface and ambient temperatures respectively (K)

h is the convective heat transfer coefficient (kWm-2K-1)

However, not all the thermal loading is necessarily absorbed by the surface, some may be
reflected back and the surface will also lose heat by radiation. Hence the total absorbed load per
unit area ( qt ) is given by:

152-RP-48 Rev 02, Feb 2006 Page 124 of 261

fireandblast.com

(
qt = ε f α s σ T f4 − ε s α f σ Ts4 + α s τ f σ Ta4 − ε s τ f σ Ts4 + h T f − Ts ) Equation 5-7

where α s , α f are the absorptivities of the surface and flame respectively. Assuming that both the
flame and surface can be considered as diffuse grey bodies, then α s = ε s , α f = ε f and
τ f = 1 − ε f . Furthermore, the term involving Ta is small and can be neglected, giving:

qt = qr + qc

( ) ( )
qt = ε s σ ε f T f4 − Ts4 + h T f − Ts ............................................... Equation 5-8

When considering an actual object engulfed by a fire, the flame temperature exposed to different
parts of the object surface may vary; similarly the flame velocities (and hence convective heat
transfer coefficient) may vary. Hence, to determine the total load absorbed by an object, Equation
5-8 should be summed over the area of the object.

Also, as the object engulfed in the flame heats up, the absorbed load will reduce. This is
particularly the case with the convective load which reduces linearly with increasing object
temperature. Therefore, for an accurate transient calculation of the temperature rise of an object,
the parameters T f , ε f and h are required, together with the emissivity of the surface (which itself
may change as the surface heats up). Where possible, typical values of these parameters are
provided in Section 5.4.2.

However, researchers often quote heat fluxes measured during experiments using calorimeters
(for total heat flux) and radiometers (for radiative flux). These instruments are designed to have a
surface emissivity close to 1 and are maintained at a low temperature throughout the experiments.
Hence the fluxes measured and reported for calorimeters are given by Equation 5-8 with ε s = 1
and Ts ≈ 333 K and can be regarded as a conservative estimate of the total heat flux absorbed by
an engulfed object. Radiometers are designed and calibrated to measure ε f σ T f4 . At an early
stage, whilst Ts is low, the flux measured by a radiometer is approximately ( qr ε s ) and so, if ε s is
taken as 1, it provides a conservative estimate of the radiative flux absorbed by an object.

Subtracting the measured radiative flux from the measured total heat flux enables the initial
convective flux absorbed by the object to be determined. Using an estimated or measured value
for T f enables h to be determined at the measurement location. In this way, experimentally
measured flux levels can be used to derive input data for transient heat-up calculations (see also
Section 5.5.3).

Consequently, typical values of the total, radiative and convective fluxes (as defined in Equation
5-8 above with ε s = 1 and Ts ≈ 333 K ) are also provided in Section 5.4.2 for the range of fire types.

5.3.3 Smoke loading

The combustion of hydrocarbons produces large volumes of initially high temperature combustion
products which disperse and cool down. If combustion is efficient and complete then the products
from burning a hydrocarbon mixture comprise carbon dioxide and water vapour. These are not
toxic or harmful, providing the ambient oxygen levels are not significantly affected. (The foregoing
excludes fuels containing sulphur or sulphur compounds which can present a toxic hazard).
However, the combustion process of non-premixed hydrocarbon fuels is rarely so efficient
(especially for higher hydrocarbons) and intermediate combustion products such as carbon
monoxide (CO) and soot (carbon particles) are usually formed within the flame and may persist
beyond the flame envelope within the stream of combustion products. Incomplete combustion may

152-RP-48 Rev 02, Feb 2006 Page 125 of 261

fireandblast.com

also lead to unburnt fuel being carried over in the products as well. CO is toxic and soot particles
are an irritant to the lungs. The soot also reduces visibility and may affect the ability to escape.

The amount and nature of the combustion products produced by a fire is determined by the fuel
combustion rate and the amount of air involved in the combustion reaction or entrained within it. A
rough estimate of the mass flow rate of combustion products evolving from a fire can be made by
multiplying the fuel mass burning rate by the ratio of air needed for complete combustion. For
methane this figure is about 17.2 and for higher hydrocarbons it is about 15.

The equivalence ratio, φ , defined as:

m
φ =r ......................................................................................... Equation 5-9
a

Where;

m is the mass burning rate of fuel

a is the mass rate of air entrained

r is the mass ratio of air to fuel required for stoichiometric burning (that is ~15)

Hence, for stoichiometric burning, φ = 1 and the rate of formation of products will be (r + 1) times
the mass burning rate of fuel. For well ventilated fires where plentiful air mixes with the fuel, φ < 1
and more products may be produced compared to the case of stoichiometric combustion.
However, the excess air in the products dilutes the smoke, reducing both the concentration of toxic
products and soot and also lowering the temperature. For fires where the ventilation is restricted to
an extent that insufficient air is available for complete combustion, φ > 1 and the concentrations of
intermediate combustion products (for example CO and soot) will increase and are more likely to
persist beyond the flame envelope.

The amount of CO within the combustion products is usually quantified in terms of its volume
concentration as a volume percentage (or ppm). For soot, the mass concentration of particles in
the combustion products is difficult to measure and an alternative approach is to determine the
optical density by measuring the attenuation of a beam of light passing through the smoke. The
optical density, D10 , is given by:

⎛ I ⎞ 10
D10 = −10 log10 ⎜ ⎟ = κ C L ............................................. Equation 5-10
⎝ I 0 ⎠ 2.303

Where;

I is light intensity through the smoke

I0 is the intensity without smoke

κ is the extinction coefficient

C is the mass concentration of soot (g m-3)

L is the path length of the optical beam through the smoke

The optical density, expressed in terms of unit path length (D10 / L in db m-1) correlates reasonably
well with visibility with 1 db m-1 corresponding to a visibility of about 10 m and 10 db m-1
corresponding to about 1 m. The visibility of exit signs can be significantly improved if they are

152-RP-48 Rev 02, Feb 2006 Page 126 of 261

fireandblast.com

back-illuminated and may be seen at 2.5 times the distance of a surface illuminated sign. For more
information on smoke and its effects on people, refer to Section 6.7.5 and 6.7.6.

5.4 Estimating fire and smoke loadings

5.4.1 Inventories and release rates

The inventories of isolatable sections between ESDVs may vary considerably but typically would
be less than 10 tonnes for gas and 25 tonnes for liquids, excluding those associated with the well
and risers and utility fuels such as diesel and methanol. The inventory of an isolatable section and
the size of a leak will determine the maximum duration of resulting fire. For gas inventories, this
duration may be further reduced by a successful blowdown of the isolated section. Hence, the
duration of large gas leaks may be relatively short. For liquid spills, an effective drainage system
may limit the inventory involved in a fire. Historical data also shows that the likelihood of a release
is also related to its size, with the smallest leaks being more common.

The resulting fire size following an accidental release will be strongly dependent on the mass
release rate of the fuel, which will be determined by the hole size and pressure. For a QRA a range
of representative scenarios should be considered (see also Section 2.2.11).

A leak classification often used is:

• Small leaks – typically 0.1kg s-1
• Medium leaks – typically 1kg s-1
• Large leaks – typically 10 kg s-1
• Major failures – typically >30 kg s-1

For high pressure gas releases, these correspond to failure sizes of the order of 1, 10, 30 and
100 mm diameter respectively.

In the following section, these leak sizes are considered for the gas jet fires and two-phase jet fires.
For leak sizes 10 kg s-1 and above, the fire is large compared with the average module and it may
be necessary to consider the fire to be ‘confined’ with the consequent effects on fire characteristics
as discussed in Sections 5.2.2.3 and 5.2.3.3.

For pool fires, two sizes are considered:

• Small pool (typically less than 5 m diameter)
• Large pool (typically >10 m in diameter)

A small pool fire might typically result for a leak rate in the region of 1 to 2 kg s-1 and, within a
typical open module, would be expected to burn in the fuel controlled regime, that is, sufficient air
for combustion should be available and the fire behaviour would not be affected by confinement or
restricted ventilation. A large pool fire would be expected to produce a flame reaching to the roof of
a module and be affected by the confinement. It may also suffer from restricted ventilation.
Consequently, the effects of confinement on fire characteristics as discussed in Section 5.2.4.3
need to be considered. A similar effect might arise for a small pool fire within a compartment within
a module and these fires should be considered as behaving like a large pool fire.

For pool fires on the sea, only large spills are considered, as small spills are unlikely to affect the
installation. Similarly, only a gas fed fire at the sea surface due to major failure of a 24” diameter
sub-sea pipeline is considered.

For BLEVEs, as discussed in Section 5.2.7 even a small inventory would be expected to give rise
to a fireball extending throughout a module resulting in serious consequences for personnel within
the immediate area.
152-RP-48 Rev 02, Feb 2006 Page 127 of 261
fireandblast.com

5.4.2 Typical values

5.4.2.1 General

Ideally, the fire size and thermal loading from fires should be assessed using mathematical models
which have been extensively validated against large scale data. A range of such models are
available on a licence or consultancy basis. (See Section 5.4.3 and Annex D).

However, a simplified approach was proposed in the Interim Guidance Notes, whereby correlations
for flame dimensions were suggested for jet and pool fires together with guidance on typical heat
loadings to engulfed objects. In this section a similar approach to the Interim Guidance Notes is
taken and updated to reflect recent knowledge and experimental work. For the six fire types
identified and discussed in Section 5.2, tabulated values are provided giving guidance on typical
fire sizes and heat loadings for the release rates identified in Section 5.4.1. The values presented
were derived from information in the literature; the results of an extensive body of large scale
experimental data (some of which is unpublished but to which Advantica has kindly provided
access); and predictions made by Shell and Advantica. In essence the fire loading data presented
here is an updated, more detailed and comprehensive version of the guidance values provided in
the Energy Institute document ‘Guidelines for the design and protection of pressure systems to
withstand severe fires’ Information on smoke loading is also based on experimental data gathered
by Advantica and Shell, much of which is unpublished.

5.4.2.2 High pressure jet fires – gas and two-phase

Wherever possible, the following information is provided for the four release rates of Section 5.4.1:

– The expected flame extent, so that items or personnel within that range can be identified and
the consequences of flame engulfment considered.

– The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation hazard can
be made using Equation 5-3 in Section 5.3.1.

– The CO level and soot concentration in the smoke produced.

– The total heat flux to an engulfed object together with the radiative and convective components,
so that calculations of the object heat-up can be performed (see Section 5.5 “Heat transfer”).
Note that these fluxes represent the initial values when the engulfed object is cold. Values of
typical flame temperature, emissivity and convective heat transfer coefficients are also provided.

– The effect of deluge (where appropriate) in terms of the reduction in the heat flux to engulfed
objects and the enhanced attenuation of incident radiation to the surroundings using the
Effective Fraction of Heat Radiated, F’ (see Equation 5-4).

– The effect of confinement on fire characteristics and the combined effect of confinement and
deluge.

This information is presented in Table 5-1 for gas jet fires and Table 5-2 for two-phase jet fires. As
discussed in Section 5.2.3, for two-phase jet fires, the maximum heat fluxes to engulfed objects
have been found to occur when the mixture is about 30 % gas and 70 % liquid by mass.
Consequently, the values shown in Table 5-2 correspond to this worst case condition.

152-RP-48 Rev 02, Feb 2006 Page 128 of 261

fireandblast.com

Table 5-1 High pressure gas jet fires

Size (kg s-1) 0.1 1.0 10 >30 Effect of confinement

Flame length (m) 5 15 40 65 Affected by enclosure shape and

openings
Fraction of heat 0.05 0.08 0.13 0.13
radiated, F
CO level (% v/v) CO < 0.1 CO < 0.1 CO < 0.1 CO < 0.1 Increased CO up to about 5% v/v at a
and smoke vent prior to external flaming, but
Soot Soot Soot Soot
concentration after external flaming <0.5 % v/v at
~0.01 ~0.01 ~0.01 ~0.01 the end of the flame. Soot levels
(g m-3)
depend on equivalence ratio from
about 0.1 g m-3 at φ = 1.3 to 2.5 g m-3
at φ = 2.0
Total heat flux 180 250 300 350 Increased heat loadings up to
(kWm-2) 400 kWm-2. (280 kWm-2 radiative,
120 kWm-2 convective, Tf = 1600K,
εf = 0.75, h = 0.09)
Radiative flux 80 130 180 230
(kWm-2)
Convective flux 100 120 120 120
(kWm-2)
Flame 1560 1560 1560 1560
temperature, Tf
(K)
Flame emissivity, 0.25 0.40 0.55 0.70
εf
Convective heat 0.08 0.095 0.095 0.095
transfer
coefficient, h
(kWm-2K-1)
Effect of deluge No effect on heat loadings to engulfed objects. Risk of extinguishment and explosion
hazard if deluge activated when
In far field, take F’=0.8F for 1 row of water
enclosure is already hot and fire is
sprays, F’=0.7F for 2 rows and F’=0.5F for >2
well established.
rows at 12 l min-1 m-2, for use in Equation 5-4
(See Section 5.2.2.2).
May improve combustion efficiency and
reduce CO levels within flame.

It should be noted in Table 5-1 and Table 5-2 that for the largest leaks (i.e. a flow rate >30 kg s-1 a
single number is given for the total heat flux which could be interpreted as implying a constant
value for all of these larger release rates. Where heat flux calculations are required for larger leak
rates, the heat flux figures should be used with caution, CFD simulations can be used to obtain
data on the effects of larger fires.

152-RP-48 Rev 02, Feb 2006 Page 129 of 261

fireandblast.com

Table 5-2 High pressure two-phase jet fires

Flashing
liquid
fires
Fuel mix of 30 % gas, 70 % liquid by mass (such as
propane
or
butane).

Size (kg s-1) 0.1 1.0 10 30 1.0 Effect of Confinement

Flame length 5 13 35 60 Affected by enclosure
(m) shape and openings
Fraction of
heat radiated, See equation below table
F
CO level (% CO < 0.1 CO < 0.1 CO < 0.1 CO < 0.1 Increased CO up to
v/v) and smoke Soot Soot Soot Soot about 5 % v/v at a vent
concentration ~0.01 ~0.01 ~0.01 ~0.01 prior to external flaming,
(g m-3) but after external flaming
< 0.5 % v/v at the end of
the flame. Soot levels
depend on equivalence
ratio from about
0.1 g m-3 at φ = 1.3 to
2.5 g m-3 at φ = 2.0
Total heat flux 200 300 350 400 230 Increased heat fluxes,
(kWm-2) take values as per
30 kg s-1 two-phase jet
Radiative flux 100 180 230 280 160
fire.
(kWm-2)
Convective 100 120 120 120 70
flux (kWm-2)
Flame 1560 1560 1560 1560 1300
temperature
(K)
Flame 0.30 0.55 0.70 0.85 1.00
emissivity,
Convective 0.080 0.095 0.095 0.095 0.070
heat transfer
coefficient, h
(kWm-2K-1)
Effect of Some benefit to engulfed objects but temperature may Risk of extinguishment
deluge still rise although at a slower rate. Combined area and and potential formation
dedicated deluge may prevent temperature rise if of pool, see
effectively applied. See Section 5.2.3.2. Section 5.2.4.
In far field take F’ as per Table 5-1.

Fraction of Heat Radiated, Fm , of mixture involving x% liquid by mass:

⎛ x ⎞
Use Fm = ⎜ ⎟ ⋅ ( FL − FG ) + FG where FG is the fraction of heat radiated for natural gas as given
⎝ 100 ⎠
in Table 5-1 and FL is the fraction of heat radiated for the liquid fuel involved. Take
FL = 0.24 for C3; 0.32 for C4, 0.45 for C6-C25 (including condensate and diesel); and
0.5 for crude oil.

152-RP-48 Rev 02, Feb 2006 Page 130 of 261

fireandblast.com

5.4.2.3 Pool fires on the installation

The following information is provided for pool fires on an installation:

• The expected flame extent, so that items or personnel within that range can be identified and
the consequences of flame engulfment considered.

• The mass burning, so that the duration of a fire following a spillage might be assessed and to
provide input to calculations of the incident radiation field.

• The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation hazard
can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel combustion, m , is
taken as the mass burning rate times the area of the pool.

• The CO level and soot concentration in the smoke produced.

• The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see Section 5.5).
Note that these fluxes represent the initial values when the engulfed object is cold. Values of
typical flame temperature, emissivity and convective heat transfer coefficients are also
provided.

• The effect of deluge in terms of the reduction in the heat flux to engulfed objects and the
enhanced attenuation of incident radiation to the surroundings using the Effective Fraction of
Heat Radiated, F’ (see Equation 5-4).

• The effect of confinement on fire characteristics and the combined effect of confinement and
deluge.

This information is presented in Table 5-3.

152-RP-48 Rev 02, Feb 2006 Page 131 of 261

fireandblast.com

Table 5-3 Pool fires on the installation

Pool fire Methanol pool Small hydrocarbon Large hydrocarbon Effect of confinement
parameter pool pool

Typical Pool 5 <5 >5 Any

Diameter (m)
Flame Length Equal to pool Twice pool diameter Up to twice pool See Section 5.2.4.3.
(m) diameter diameter Take values as per
large hydrocarbon
Mass Burning 0.03 Crude – 0.045-0.06 Crude – 0.045-0.06
pool fire for worst
Rate Diesel – 0.055 Diesel – 0.055 case. If confinement is
(kg m-2 s-1) Kerosene – 0.06 Kerosene – 0.06 severe then mass
Condensate - 0.09 Condensate - 0.10 burning rate will
decrease to match
C3/C4s – 0.09 C3/C4s – 0.12 available air flow and
Fraction of 0.15 0.25 0.15 large external fire at
Heat Radiated, vent expected.
F
CO level (% Negligible CO < 0.5 CO < 0.5 Increased CO up to
v/v) and Smoke Soot 0.5 – 2.5 Soot 0.5 – 2.5 about 5 % v/v at a vent
Concentration prior to external
(g m-3) flaming, but after
external flaming about
0.5 % v/v at the end of
the flame. Soot levels
up to 3 g m-3 .
Total Heat Flux 35 125 250 See Section 5.2.4.3.
(kWm-2) Take values as per
large hydrocarbon
Radiative Flux 35 125 230 pool fire.
(kWm-2)
Convective 0 0 20
Flux (kWm-2)
Flame 1250 1250 1460
Temperature
(K)
Flame 0.25 0.90 0.90
Emissivity,
Convective - - 0.02
Heat Transfer,
h Coefficient
(kWm-2K-1)
Effect of Extinguishable See Section 5.2.4.2 See Section 5.2.4.4.
Deluge using AFFF. Expect reduced flame
Considerable fire control and potential temperatures and
Water soluble
extinguishment can be achieved. Expect a reduced or no external
but effect of
reduction in flame coverage (and hence flaming. Mass burning
water deluge
flame size) of up to 90 % within 10minutes. rate reduces to match
unknown.
Rapid extinguishment with AFFF. available air flow.
Up to 50 % reduction in radiative heat flux to
engulfed objects.
In far field take F’ = 0.8F for 1 row of water
sprays, F’=0.7F for 2 rows and F’=0.4F for >2
rows at 12 l min-1 m-2
(See Section 5.2.4 for other rates)

152-RP-48 Rev 02, Feb 2006 Page 132 of 261

fireandblast.com

5.4.2.4 Fires on the sea

The following information is provided in Table 5-4 for hydrocarbon pool fires on the sea:

• The expected flame extent, so that items within that range can be identified and the
consequences of flame engulfment considered.

• The mass burning, so that the duration of a fire following a spillage might be assessed and to
provide input to calculations of the incident radiation field.

• The Fraction of Heat Radiated, F, so that calculations of the far field incident radiation hazard
can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel combustion, m , is
taken as the mass burning rate times the area of the pool.

• The CO level and soot concentration in the smoke produced.

• The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see Section 5.5
“Heat transfer”). Values of typical flame temperature, emissivity and convective heat transfer
coefficients are also provided.

The gas outflow from a sub-sea pipeline will depend on the pressure and the pipeline size. The
release will also vary with time; this variation depending upon the length of pipeline which is
depressurising. Similarly, the area at the sea surface over which the gas emerges will depend on
the depth and the gas release rate. Furthermore, depending on the gas outflow and the depth, the
gas plume at the sea surface may not be within flammable limits. For these reasons, simplified
guidance cannot be readily provided and the use of a model is recommended. This topic is an area
of some uncertainty and model predictions vary considerably. For illustrative purposes, predictions
of the fire hazard following the rupture of a long 24” diameter natural gas pipeline operating at
100 barg at a depth of 50 m suggest that the fire diameter might be of the order of 100 m with a
flame length of 150-200 m. On the basis that the fire is a low velocity laminar flame, it can be
regarded as a large pool fire and the values presented in Table 5-4 for fraction of heat radiated and
heat fluxes are recommended.

152-RP-48 Rev 02, Feb 2006 Page 133 of 261

fireandblast.com

Table 5-4 Hydrocarbon pool fire on the sea

Pool fire on sea parameters Value

Typical Pool Diameter (m) >10

Flame Length (m) Up to twice diameter
Mass Burning Rate (kg m 2 s 1) Crude – 0.045-0.060
Diesel – 0.055
Kerosene – 0.060
Condensate – 0.100
C3/C4s – 0.200
Fraction of Heat Radiated, F 0.12
CO level (% v/v) and Smoke Concentration (g m-3) CO < 0.5
Soot 0.5 – 2.5
Total Heat Flux (kWm-2) 250

Radiative Flux (kWm-2) 230

Convective Flux (kWm-2) 20

Flame Temperature (K) 1460
Flame Emissivity, 0.90
Convective Heat Transfer Coefficient, h (kWm-2K-1) 0.02

5.4.2.5 BLEVEs

BLEVEs are highly transient events in which a fixed inventory is instantaneously released. The
subsequent combustion gives rise to a fireball which grows in size to a maximum before burning
out as all the fuel is consumed. Consequently, the key parameters of interest in terms of a
consequence assessment are the extent of the flame and the incident radiation hazard to
personnel outside the flame. These parameters are also highly transient. In relation to incident
radiation levels outside the fireball, both the maximum level experienced and the ‘dosage’ over the
duration of the event are of interest in order to determine the effect on people.

Consequently, Table 5-5 presents the following data in relation to BLEVEs:

• Typical maximum fireball diameter (assuming unconfined) based on the mass of fuel involved
in the BLEVE, and the maximum flame volume calculated assuming a spherical geometry.
Hence the area of a module which would be expected to be engulfed in flame can be
assessed by dividing the volume of the fireball by the height of the module.

• The expected duration as a function of the mass of fuel involved in the BLEVE.

• The Modified Fraction of Heat Radiated F*, which can be used to calculate the maximum
incident radiation received at a location d, remote from the fireball (more than one fireball
diameter distant from edge of fireball) using the equation:

τ F*M H
qd ,max = kWm-2 ...................................................... Equation 5-11
4 π d2 t

where: t is the duration of the BLEVE event (s)

τ is the atmospheric transmissivity

152-RP-48 Rev 02, Feb 2006 Page 134 of 261

fireandblast.com

M is the mass of fuel involved in the BLEVE (kg)

H is the calorific value (kJ kg-1)

d is the distance from the centre of the fireball where the dosage is
experienced (m)

Various correlations have been developed relating the maximum diameter (D), maximum height (h)
and duration (t) of the fireball following an unconfined BLEVE to the mass of fuel released, for
example CCPS Guidelines for Chemical Process Quantitative Risk Analysis suggests that:

D = 6.48 x M0.325 ; h = 0.75 x D; t = 0.825 x M0.26.

These equations have been used to derive the values presented in Table 5-5 for maximum
diameter and duration. Comparisons with large scale data showed reasonable agreement.

Table 5-5 BLEVEs

Parameter Characteristic expressed as function of

BLEVE fuel mass (kg of fuel)

Maximum Diameter (m) D = 6.48 x M0.325

Maximum Flame Volume (m3) V = 142.47 x M0.975

Duration (s) t = 0.825 x M0.26

Modified Fraction of Heat Radiated, F* 0.35

(ONLY for use in Equation 5-11 to derive
maximum incident radiation at a locations remote
from the fireball)

5.4.3 Predictive models for fire loading

There are basically three types of predictive models which can be used to predict fire
characteristics and the thermal loading from fires, these being:
• Empirical models;
• Integral (or phenomenological) models;
• Numerical (CFD) models.

Empirical models contain, to varying degrees, a physical basis combined with correlations which
have been derived from experimental data. They are generally easy to use, but their applicability is
limited to the range of experimental data used to derive them.

Integral models use equations relating the fire characteristics to the physical processes involved,
such as mixing, combustion and thermal emissions. However, the relationships are simplified and
are generally one-dimensional. Such models will also often contain some parameters which have
been empirically derived from experimental data. Nevertheless, integral models provide an
effective method for predicting fire characteristics and are generally easy to use. Strictly speaking,
they should only be applied to the range of circumstances for which they have been validated by
experimental data. However, because of the physical basis of the equations, the models can be
applied, within reason, to situations outside this range.
152-RP-48 Rev 02, Feb 2006 Page 135 of 261
fireandblast.com

Numerical models (CFD) attempt to model in 3-dimensions the time varying processes within a fire
such as the fluid flow and combustion processes. In principle, this physical basis enables these
models to study complex geometries and conditions far removed from experimental data used to
validate them. It is noted that resulting predictions may be sensitive to small changes in input
parameters if not used properly. Therefore these models generally require ‘expert’ users.. For
these reasons, CFD codes are not routinely used for general risk assessments. However, they can
be useful to study in detail a particular fire scenario of interest due to its severity. The impact of
potential design changes (such as increased ventilation) can then compared and provide at least
qualitative guidance on how to reduce the hazard. The CFD predictions use more realistic
geometry and dynamic models and may require the risk assessment to take into account new
parameters such as the leak jet direction, leak location, and the dynamic behaviour of the fire. This
makes the risk analysis larger. For explosion risk, the CFD method is well established following the
NORSOK Z13 standard. However, for fire risk calculations, it is not routinely used.

Annex D discusses the above model types in more detail and provides an in-depth review of
different fire modes currently available.

5.5 Heat transfer

5.5.1 Mechanisms for heat transfer

5.5.1.1 General

Basic heat transfer by radiation, convection and conduction is well covered in the standard text
books (e.g. Incropera and De Witt, 2002 [5.4]). This section concentrates on determination of heat
transfer using the values identified in Table 5-1 through to Table 5-5 for key parameters measured
in intermediate and large scale trials as; previously, these have not been readily available. This
follows on from the approach recommended by the Energy Institute (formerly the Institute of
Petroleum) in assessing the effect of severe fires on pressure vessels (Energy Institute, 2003)
[5.5].

5.5.1.2 Radiation

Radiation from the hot gases and incandescent soot particles is the main mechanism for
transferring heat. For flames with relatively little momentum, e.g. pool fires, radiative transfer to an
impinged object represents at least 80 % of the heat transferred. Even with impinging high velocity
jet fires, radiative heat transfer still represents 50 % to 60 % of the heat load.

The radiative heat emission process is modelled by assuming that the radiation comes from the
flame surface. The surface emissive power (SEP) of a flame is the heat radiated outwards per unit
surface area of the flame. Generally, a uniform SEP is taken over the whole flame shape but this a
gross simplification of what may happen in practice. For example, in a large pool fire, the base of
the flame may have the relatively high SEP of 180 kW m-2 whereas the smoke obscured flames,
which may comprise two thirds of the flame shape, may have the relatively low SEP of 60 kW m-2.

If an object is definitely not directly impinged by flame, the radiative heat transfer is given by
Equation 5-12 below.

qrad = VF Eτ .................................................................................. Equation 5-12

where VF is the geometric view factor, E (kW m-2) is the surface emissive power of the flames and τ
is the atmospheric transmissivity.

The view factor is purely a geometrical parameter determining the proportion of radiation leaving
one surface which reaches a second surface. As radiation travels in straight lines, only those parts
of the respective surfaces that can see one another contribute to the value of the view factor.
Analytical expressions for the view factor are available (e.g. McGuire J H, 1953 [5.5] and SFPE,
152-RP-48 Rev 02, Feb 2006 Page 136 of 261
fireandblast.com

2002 [5.6]) for standard geometries. For example, pool fires may be represented by tilted cylinders,
jet fires by a conical frustum and fireballs by circular discs through the centre of the fireball.
Numerical integration may be used for more complex geometries where the flame surface is
divided into a series of regular shapes (e.g. triangles or squares) and the view factors for each of
these summed.

Atmospheric attenuation is primarily caused by absorption of radiation by carbon dioxide and by

water vapour and scattering by dust particles. The atmospheric transmissivity over a specified path
length, due to the presence of water vapour and carbon dioxide, can be calculated from the
temperature and relative humidity of the atmosphere provided that the emission spectrum is
known. Usually it is assumed that there is emission at every wave length (black or grey body). For
path lengths of 10 m or less it is usual to take the atmospheric transmissivity as 1. Expressions of
differing complexity are available ranging from those that just take distance into account to those
that also consider water and carbon dioxide concentration. Wayne (1991) [5.7] gives the following
empirical expression, which takes both water vapour and carbon dioxide concentrations into
account:

t = 1.006 − 0.01171 ⎡⎣log10 X ( H 2O ) ⎤⎦ − 0.02368 ⎡⎣log10 X ( H 2O ) ⎤⎦

2

−0.03188 ⎡⎣log10 X ( CO2 ) ⎤⎦ + 0.001164 ⎡⎣log10 X ( CO2 ) ⎤⎦

2

Equation 5-13

Where

288.651
X ( H 2O ) = Rh d S mm ...................................................... Equation 5-14
T

Rh is the fractional relative humidity, d is the path length (m), Smm is the saturated vapour pressure
of water (mmHg) at atmospheric temperature T (K). This expression assumes that the flame is
1500 K, which was chosen as an average between that of a propane fire and a LNG fire. The
transmissivity given by this expression at 15 °C is illustrated by Figure 5-1.

Figure 5-1 Variation of atmospheric transmissivity with distance at 15 °C

The 0.8 transmissivity suggested in Section 5.3.1 corresponds to that at a distance of 25 m at a

relative humidity of 60 %.

152-RP-48 Rev 02, Feb 2006 Page 137 of 261

fireandblast.com

As indicated in Section 5.3.1, the radiation to the surroundings may be represented by a point
source model. For a point source model, the radiation received (qd, kWm-2) at a distance d (m) is
given by:

τ F m H
qd = .............................................................................. Equation 5-15
4π d2

Generally, the heat of combustion (H, kJ kg-1) will be known from the literature (e.g. Weast, 1981)
and typical values for the fraction (F) of the heat of combustion radiated for six main fire scenarios
considered are given in Section 5.4.2. The mass burning rates ( m  ) for hydrocarbon pool fires are
given in Table 5-3. Slightly higher values are given for C3/C4 and condensate pool fires if the pool
diameter is greater than 5 m. For jet fires, the mass burning rate is based on the leakage rate and,
for QRA, these are generally assumed to be 0.1, 1, 10 or > 30 kg s-1. In the case of fireballs, the
mass burning rate is based on the total amount of fuel released divided by a fireball duration
calculated using an expression (0.825. mass0.26) based on the mass released.

Application of the two techniques is illustrated using data from the BLEVE of a 2 tonne LPG tank
(Roberts et al., 2000 [5.8]). The relevant data are summarised in Table 5-6 below.

Table 5-6 Example LPG BLEVE fireball data

Parameter Value

Heat of combustion 46000 kJ kg-1

Amount of fuel released 1708 kg
Duration 7s
Mass burning rate 244 kg s-1
Fraction of heat of combustion radiated 0.38
Surface emissive power 312 kW m-2
Fireball diameter 71 m

The full data set indicated that the maximum output from the fireball was at the lift off point. This
situation can be modelled by treating the fireball as a disc through the centre of the fireball just
touching the surface and the target as a vertical receiver (normally it is necessary to determine
both the vertical and the horizontal component of the view factor) on the surface (see Figure 5-2).

152-RP-48 Rev 02, Feb 2006 Page 138 of 261

fireandblast.com

Figure 5-2 View factor for circular disc with receiver off axis but parallel

The view factor is given by, [5.9]:

⎛ ⎞
⎜ y2 + z 2 − R2 ⎟
VF = 0.5 ⎜ 1 − ⎟ ........................... Equation 5-16
R4 + 2 ( y2 − z 2 ) R2 + ( y2 − z2 )
2
⎜ ⎟
⎝ ⎠

Hence, if z = R and y = n.R

⎛ n ⎞
VF = 0.5 ⎜1 − ⎟ ................................................................. Equation 5-17
⎝ 4 + n2 ⎠

Table 5-1 provides the data for applying both a solid flame and point source model. Assuming an
atmospheric transmissivity of 1, the results from application of each model are plotted in Figure
5-3.

152-RP-48 Rev 02, Feb 2006 Page 139 of 261

fireandblast.com

Figure 5-3 Comparison of solid flame and point source model for a fireball

Figure 5-3 suggests that a solid flame model should be used if the object of interest is closer than
two flame widths/lengths from the flame as, at these distances, the receiver cannot “see” all of the
flame.

The above models are only applicable if there is no direct flame impingement. If the flames are
impinging on an object then the radiation received may be approximated (ignoring reflection and
re-radiation, see Section 5.3.2 “Thermal loading to engulfed objects” for the derivation) by Equation
5-18.

qrad = ε s σ ( ε f Tf4 − Ts4 ) ................................................................ Equation 5-18

where εf, εs are the flame and surface emissivities, σ is the Stefan-Boltzmann constant
(5.6697 x 10-8 Wm-2K-4), and Tf, Ts are the flame and object surface temperatures (K). Section 5.4.2
gives typical values for these coefficients for a range of fire types and sizes.

5.5.1.3 Convection

Heat transfer by convection occurs when there are hot gases flowing over the surface of the object.
Convective heat transfer will always occur to some extent if there is direct flame impingement and,
in these circumstances, at least as much radiative heat transfer will accompany it. Convective heat
transfer can occur without significant radiative heat transfer if a plume of hot gases is channelled to
an object not in direct (or reflected) line of site with the flames. Heat transfer by convection from
impinging flames is represented by Equation 5-19.

152-RP-48 Rev 02, Feb 2006 Page 140 of 261

fireandblast.com

qconv = h (T f − Ts ) ......................................................................... Equation 5-19

where Tf and Ts are the flame and object surface temperatures respectively (K) and h is the
convective heat transfer coefficient (W m-2 K-1). The convective heat transfer coefficient varies with
geometry, boundary layer conditions, gas velocity and temperature. Typical values for the heat
transfer coefficient for a range of types and sizes of fire are given in Section 5.4.2. In cases where
there is convective heat transfer from a hot plume, the plume temperature can be used in Equation
5-17 instead of the flame temperature if it can be reasonably estimated.

5.5.1.4 Conduction

Heat transfer by conduction is very small compared to the other methods of heat transfer but
needs to be taken into account in some circumstances. One-dimensional heat conduction under
steady state conditions is represented by Equation 5-20 below.

qcond = k
(Ts − Tl ) ......................................................................... Equation 5-20
L

where Ts is the temperature (K) of the surface exposed to flame, Tl is the temperature (K) at a
thickness L (m) and k is the thermal conductivity (Wm-1K-1). The thermal conductivity of carbon
steel is about 45 Wm-1K-1 and hence, even with a fairly large temperature differential, the heat
transmitted is low. Hence, in most circumstances, the heat transmitted by conduction can be
ignored. However, there can be problems through differential heating at the joints between thick
and thin thick-walled structures. The other conditions where conduction is normally taken into
account are where heat is transferred through passive fire protection or through the walls of a
vessel or pipe to a fluid inside.

5.5.2 Flame position relative to the receiver

Generally, flames are not static. They will move around in the wind and will vary with the fuel
release rate, amount of back radiation etc. For a pool fire, the wind may tilt the flame towards,
away from or sideways to the receiver. With jet fires, a co-flowing wind will elongate the flames and
a variable crosswind will move the flames from side to side. A fireball will present a smaller flame
area up and down wind compared to the crosswind area. An understanding of the geometry of the
flame is essential in order to apply the heat transfer mechanisms identified in the previous section.
Modern, validated empirical and phenomenological models are now available for most of the
standard situations but the user needs to be aware of the limitations and simplifications made in
the model used if the results are to be relied upon. Summaries and comparisons of these models
are available in the standard reference books e.g. “Yellow book” (1997) [5.10], SFPE Handbook
(2002) [5.11], Lees (2005) [5.12]. Some of these models have been incorporated in commercially
available suites of programmes e.g. FRED, PHAST. The following are given as examples:
• Carsley (1995) [5.13] has developed a model for predicting the probability of
impingement of jet fires;
• Cracknell et al. (1995) [5.14] have developed one for the heat flux on a cylindrical
target due to the impingement of a large-scale natural gas jet fire.
• Chamberlain (1995) [5.15] considered the hazards from confined pool fires in
offshore modules.

A feature of most of these models is that the surface emissive power used for a particular situation
will depend on how the flame geometry is modelled for that situation. Hence a model using a high
surface emissive power and relatively low flame area may/should give the same answer as a
model using a relatively low surface emissive power but larger flame area.

Combustion models used in computational fluid dynamics (CFD) have advanced, enabling more
realistic modelling in situations where the fire scenario can be fully described (this is discussed
152-RP-48 Rev 02, Feb 2006 Page 141 of 261
fireandblast.com

further in Annex D). However, in preparing a safety case, only general assumptions are normally
made and in practice, CFD would only be used to look at a particular case in detail when the extent
of the safety issues or costs at risk justify it.

In assessing the heat transferred, the key decision is on whether or not the object is impinged by
flame. For the general case, it may be sufficient to apply a safety margin, e.g. 50 %, to the flame
length given by a model or the relevant table in Section 5.4.2. If a key structural item is of particular
concern, e.g. a platform support leg, one approach used by industry is to estimate (using a solid
flame model) the distance for 50 kW m-2 received radiation and assume that everything within this
distance is impinged by flame and that everything outside this distance only receives radiation.

In practice, the heat transferred to a receiver will depend on whether it is fully, partially or not
enveloped in flame and, in partially or totally enclosed modules, how much re-radiation there is
from walls, ceilings and process plant. Even when there is full engulfment, the situation is still
complicated as the:
• Relative proportions of radiative and convective load from a flame will vary depending on
the fuel type and location of the object within the flame.
• Total heat loads will vary depending on the fuel type, the size and shape of the object and
the location of the object within the fire:
Particularly with jet fires, the flames can be channelled along and around an object where heat
loads will vary over the surface of the object and the heat absorbed by the object will vary with
time.

Whilst detailed analysis may now be made using CFD and finite element analysis, calculations for
an initial analysis can be readily performed if some of the above factors are simplified. As indicated
in Section 5.3, the main simplifying assumptions are that:
• There are no heat losses;
• The flame and receiver surface are considered grey bodies;
• The ambient temperature can be neglected; and
• In most circumstances, heat conduction can be ignored.

In these circumstances, the heat transferred to the object surface from an impinging flame may be
represented by Equation 5-8.

qtotal = qrad + qconv = ε s σ ( ε f T f4 − Ts4 ) + h (T f − Ts ) ...................... Equation 5-21

If the object is not impinged by flame (e.g. beyond the 50 kWm-2 distance) then, ignoring the hot
plume case, the heat transfer is by radiation and the solid flame model (Equation 5-1) should be
applied.

qrad = V f E τ ................................................................................ Equation 5-22

If the object is more than two flame widths/lengths away then the point source (Equation 5-3) or a
multipoint source model (where the source is split into a number of zones, each representing a
fraction of the total radiation emitted and each zone represented by a point source emitting this
fraction of the radiation) may be used as an alternative to the solid flame model. It may be used at
closer distances but the results will be very conservative. This may be acceptable in some
situations.

152-RP-48 Rev 02, Feb 2006 Page 142 of 261

fireandblast.com

τ F m H
qrad = ............................................................................ Equation 5-23
4π d2

5.5.3 Temperature rise

All the equations given above provide the heat flux to the surface of the receiver. The key
requirement is to determine the temperature rise in the item being considered and the time taken to
reach the critical temperature for that particular component. The main situations considered are:
• Unprotected steel;
• Fire protected steel;
• Pressure vessels (unprotected and protected);
• People.

As the heat absorbed is a time dependent process. Mathematical models, particularly finite
difference methods, are available which can undertake these calculations from first principles or
with the input parameters εs, εφ, Tf and h as determined by the particular model used or as provided
in the tables in Section 5.4.2. Such models may also simultaneously calculate the heat up of a
structure, a vessel or pipe work contents. However, conservative calculations of heat up can be
undertaken on the basis that, at any particular time, steady state conditions exist.

5.5.3.1 Unprotected steel

The equations given in FABIG Technical Note 1 [5.16] are still valid. However, those equations
used a section factor (Hp/A, m-1) defined as the heated perimeter (Hp, m) divided by the steel cross-
sectional area (A, m2). ASFP (2002) [5.17] comment that in new European fire testing and design
standards (e.g. ENV 13381-4 2002 [5.18], BSEN 1993-1-2 2005 [5.19] and BSEN 1994-1-2 [5.20],)
the section factor (the unit remains the same, i.e. m-1) is defined as Asteel/Vsteel (note: the steel
subscripts are provided here to avoid confusion with other parameters) where Asteel is the surface
area of steel exposed to fire per unit length and Vsteel is the volume of the section per unit length.
Using the Asteel and Vsteel notation, for a fully engulfed steel member, e.g. an I-beam, the heat up of
the steel member is described by Equation 5-24 below.

Vsteel dT
ε s σ (σ f T f4 − Ts4 ) + h (T f − Ts ) = Csteel ρ steel .................... Equation 5-24
Asteel dt

Where Csteel is the steel heat capacity (Jkg-1 K-1) and ρsteel is the steel density (kg m-3). A steel
section with a large surface area will receive more heat than one with a smaller surface area and
the greater the volume the greater the heat sink. Hence the lower the section factor the slower an
I - beam will heat up. For an I - beam, the heated perimeter (ASFP still use this in their examples
and data sheets) is calculated as:

152-RP-48 Rev 02, Feb 2006 Page 143 of 261

fireandblast.com

Figure 5-4 “I” beam heated perimeter

Where B and D are the overall breadth and depth of the section and W is the web thickness. A
comprehensive list of heated perimeter equations for different types of beams, columns etc are
given by ASFP in the “Yellow” book (ASFP, 2002) [5.21].

For a steel section that is not engulfed in flame, the heat up of the steel member is described by
Equation 5-25.

Vsteel dT
qrad = V f E τ = Csteel ρ steel ............................................... Equation 5-25
Asteel dt

In this case, the heated perimeter is the projected area of the member that sees the radiation.
Equation 5-24 and Equation 5-25 can be solved numerically (e.g. by using a spreadsheet with fixed
cell addresses for the constants) by using incremental time steps. An example is given in
Section 5.4.3.3 on pressure vessels.

5.5.3.2 Fire protected steel

The Interim Guidance Notes [5.22] advocate a heated perimeter approach when the steel is
insulated. The equation assuming that the fire protection material has negligible heat capacity is
shown below (Equation 5-26). It is assumed that the insulation surface temperature (Ts) rapidly
reaches the flame temperature.

Asteel K PFP
dT = (Ts − T ) dt .................................................... Equation 5-26
Vsteel Csteel ρ steel L

where KPFP is the thermal conductivity of the protection material and L the thickness of the
insulation material.

It should be noted that the thermal conductivity and heat capacity of both the steel and the
insulation material will vary with temperature and, for accurate calculations; these would have to be
expressed as parametric equations. API (2005) [5.23] give approximate thermal conductivity
values for typical insulations, e.g. light weight cementitious 0.51 W m-1 K-1, but the values given are
approximate and should be treated with caution. The problem is that it is very difficult to obtain a
realistic value for both the thermal conductivity and heat capacity as most forms of passive fire
protection react in a complex way.

152-RP-48 Rev 02, Feb 2006 Page 144 of 261

fireandblast.com

Generally, steel may be protected from fire by passive fire protection, which may take the form of a
cladding or a coating (cementitious, vermiculite or intumescent). Summaries of their properties are
reiterated below and should be read in conjunction with further detail in Section 3.5.1, “Firewalls”
and 3.5.2 “Passive fire protection methods”.
• Inert cladding e.g. ceramic boards, a thin steel panel backed by mineral wool, a
removal jacket or a composite panel. The insulation backed steel panels act as
passive insulator until the insulating materials melts leaving voids. Insulation
materials such as rock wool contain resins that will melt and migrate. Composite
panels may comprise a series of panels of different materials with either air gaps
between them or some or all of the gaps filled with insulating material. In most of
these cases, the thermal conductivity needs to take account of different materials
and of internal voids giving rise to internal convection effects and heat capacity will
vary with each material used.
• Cementitious coatings. These will act as passive insulator with a thermal
conductivity dependent on the amount of water present until the temperature
reaches about 100 °C. The temperature will be kept at this until all the chemically
and physically bound water has been driven off. The temperature will then rise with
the material again acting as passive insulator but with a different thermal
conductivity. Hence, an overall thermal conductivity value must account for
movement and evaporation of water in a situation where the total amount of
physically bound water is not likely to be known.
• An intumescent coating. These react to flames by melting and then swelling to form
a hard char five to ten times thicker than the unreacted material thickness. The char
is gradually eroded away exposing unreacted material, which then reacts to form
more char. Hence the unreacted material is gradually being used and, once it has all
been used, bare steel will be exposed. In this case, the thermal conductivity needs
to take account of the unreacted material and the char and the fact that there are
continual boundary and phase changes.

Not withstanding all the problems identified, the manufacturers will have data from furnace tests
with cellulosic and hydrocarbon heat up curves and will have resistance to jet fire test data. In
general, the manufacturers will use the ASFP (2002) [5.24] method to derive the thickness of
material required to protect against a particular fire scenario or combination of fire scenarios e.g.
jet fire preceding a pool fire. The manufacturers will have performed a series of furnace tests
conducted on structural elements with varying section factors, usually between 50 and 350 m-1, to
various fire durations and limiting temperatures. The thickness of material (L) required to provide
specific standards of fire resistance e.g. at least 1 hour for a mean temperature rise of 140 °C, is
derived by means of the empirical relationship:

Vsteel
tresist = a0 + a1 L + a2 L ............................................................ Equation 5-27
Asteel

where tresist is the fire resistance time (minutes). The furnace tests are chosen to cover the range of
section factors, thicknesses and duration required. The constants, a0, a1 and a2, applicable to each
material are determined by multiple linear regressions. Once a satisfactory correlation has been
obtained, the protection thicknesses for a given section factor and required fire resistance time can
be derived using the rearranged equation:

tresist − a0
L= ........................................................................... Equation 5-28
V
a1 steel + a2
Asteel

Generally, interpolation of fire test data is allowed but extrapolation is not. ASFP (2002) [5.25] give
illustrations of how this works with product data sheets based on cellulosic fire curve furnace tests.

152-RP-48 Rev 02, Feb 2006 Page 145 of 261

fireandblast.com

A method of combining the results from furnace and jet fire tests is to compare results from tests
on substrates with similar section factors (usually about 100 m-1) and use this to derive an “erosion”
factor which is added to the value obtained from the expression derived from the furnace tests.
This data can also allow approximate thermal conductivities and heat capacities to be determined
but they will be product specific and the manufacturers of the products being considered should be
consulted.

5.5.3.3 Pressure vessels

There are many different processes occurring when a flame interacts with a pressure vessel due to
the complex behaviour of the flame, the vessel and the vessel contents. API has considered the
requirements for pressure relief valves (API 520, 1997) [5.26] and emergency depressurisation
systems (API 521, 2005) [5.27] and these are considered in Sections 6.6.2 to 6.6.5 discussing
relieving and other process responses. However, API only considers relatively small hydrocarbon
pool fires and, if it is a realistic fire scenario, a pressure vessel is much more likely to fail in a jet
fire. This was reviewed by Roberts et al. (2000) [5.28] and the Institute of Petroleum (2003) [5.29]
have published guidance on the effects of severe fires on pressure vessels and Scandpower
(2004) [5.30] have considered this in regard to emergency depressurisation.

The key processes occurring during jet-fire impingement on pressure vessels include:
• Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid
'zones', by radiation and convection;
• Heat transfer through the vessel walls by conduction. The wall may comprise of an outer
passive fire protection (PFP) coating plus the underlying steel wall;
• Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and by
natural convection or nucleate boiling in the liquid phase;
• Mass transfer from the bulk liquid or vapour to the outside environment through any holes
in the vessel;
• Mass transfer out of the vessel through any open or partially open pressure safety valves
(PSVs);
• Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer lying
above the bulk liquid. The hot layer may or may not be stable;
• Mass transfer between the liquid and vapour phases by evaporation;
• Pressure, enthalpy and composition changes (e.g. relative fractions of mixed hydrocarbons
in a separator) in the fluids during each of the above processes;
• Catastrophic vessel failure resulting in a possible BLEVE.

The heat transfer processes described above are shown schematically in Figure 5-5.

152-RP-48 Rev 02, Feb 2006 Page 146 of 261

fireandblast.com

Figure 5-5 Heat and mass transfer

Various models have been proposed that take these factors into account although few have been
fully validated. Persaud et al. (2001) [5.31] has applied the Shell HEATUP [5.32] model to the heat
up and failure of LPG tanks. They give equations for all the physics describing heat and mass
transfer processes and predict vessel failure by comparing the hoop stress with the ultimate tensile
strength of steel. In practice, when a fire impinges on a vessel containing liquid, the wall in contact
with vapour will heat up very quickly and the wall in contact with liquid will stay at a relatively low
temperature unless film boiling occurs. In flashing liquid propane jet fire trials on unprotected
2 tonne LPG tanks (Roberts et al., 2000) [5.33] the vapour wall reached up to 870 °C on failure
whilst the wall in contact with liquid did not exceed 230 °C.

5.5.3.3.1 Vessel walls

LPG trials indicate that the prime cause of failure, at least for relatively thin walled vessels, was
heating the wall in contact with vapour to a temperature where the steel weakened rather than due
to over pressurisation although over pressurisation will be an important factor if a vessel becomes
hydraulically full. Gayton and Murphy (1995) [5.34] also suggest that time to metal plate rupture is
used in depressurisation system design. On this basis, a conservative estimate can be made of the
time to failure by ignoring the heat transfer to the contents. As indicated above, the iterative
process for solving the time dependent heat transfer equations is illustrated for the vessel vapour
wall case.

In a time step ∆t, the object will heat up by ∆T given by:

∆t q0
∆T = .......................................................................... Equation 5-29
Csteel ρ steel L

where the initial heat absorbed by the wall (ignoring heat losses to the contents) is given by
Equation 5-30 below.

152-RP-48 Rev 02, Feb 2006 Page 147 of 261

fireandblast.com

q0 = ε sσ ( ε f Tf4 − T04 ) + h (Tf − T0 ) .................................................. Equation 5-30

At time t1 = t0 + ∆t, the surface temperature will be T1 = T0 + ∆T, where T0 is the initial surface
temperature.

Using the new T1 and substituting into Equation 5-30, then the heat absorbed at time t1 is,

q1 = ε sσ ( ε f Tf4 − T14 ) + h (Tf − T1 ) .................................................. Equation 5-31

So, in general, at time ti, the thermal flux absorbed by the object is given by:

qi = ε sσ ( ε f Tf4 − Ti 4 ) + h (Tf − Ti ) ................................................... Equation 5-32

and the temperature of the object will increase to Ti+1 = Ti + ∆Ti where

∆t qi
∆Ti = .......................................................................... Equation 5-33
Csteel ρsteel L

In order to illustrate the conservatism of the data in Section 5.4.2, both trials data and data derived
from Table 5-1 are given below in Table 5-7.

Table 5-7 Data for calculation of LPG tank failure

Flashing liquid fires

Parameter 1 kg s-1 Trials data
(From Table 5-1)

Total incident flux (kWm-2) 230 170

Radiative flux (kWm-2) 160 110

Convective flux (kWm-2) 70 60

Emissivity of flame εf 1.0 0.8

Emissivity of steel εs 0.8 0.8

Temperature of flame, Tf (K) 1300 1320
-2 -1
Heat transfer coefficient, h (Wm K ) 70 60
Stefan-Boltzman constant, σ (Wm-2K-4) 5.67 x 10-8 5.67 x 10-8
Wall thickness, L (m) 0.0071 0.0071
Density of steel, ρ (kg m-3) 7850 7850
Heat capacity of steel, C (J kg-1 K-1) 520 520

The predicted rise in wall temperature, for an initial temperature of 20 °C, is illustrated in Figure
5-6. The measured times to failure and maximum wall temperatures (all at positions in contact with
vapour) for each degree of fill are summarised in Table 5-8, the same failure points also shown in
Figure 5-6.

152-RP-48 Rev 02, Feb 2006 Page 148 of 261

fireandblast.com

Table 5-8 LPG tank failure data

Degree of fill Time to Maximum wall Pressure at

of 2 tonne tank failure temperature at failure failure
(%) (s) (Celsius) (barg)

20 250 870 16.5

41 286 704 21.3
60 217 821 18.6
85 254 848 24.4

Heat up times

1200

1000
Wall temperature (oC)

800

600

400 Flashing liquid jet fire data

Trials data
Failure data
200

0
0 60 120 180 240 300
Time (s)

Figure 5-6 Comparison of heat up time with LPG failure times and temperatures

A comparison can also be made with API (2005) [5.35] data for an unwetted 25.4 mm plate.
API 521 [5.35] gives 12 minutes to reach 593 °C. Use of the small hydrocarbon pool fire data in
Table 5-3, gives about 11 minutes as the time; (the API data are based on calculations from a
gasoline trial with a 0.125” plate).

5.5.3.3.2 Vessel contents

The overall response of pressure vessels is considered further in Section 6.6. As indicated above,
the actual heat transfer processes are very complex. Traditionally, the API (2005) [5.36] approach
has been used to calculate the heat transfer to a vessel contents. For vessels containing only gas,
vapour or super-critical fluid the vessel wall is considered to be unwetted and the heat transfer to
the contents is not directly calculated. For vessels containing liquid, the approach is based on the
heat transfer to the wetted surface of vessels up to a height of 7.6 m; as only relatively small
hydrocarbon pool fires are considered. Two expressions are given; one (Equation 5-34) where
adequate drainage and fire fighting equipment exists and one (Equation 5-35) where it does not.

152-RP-48 Rev 02, Feb 2006 Page 149 of 261

fireandblast.com

Qabsorb = 43200 F A0.82 .................................................................. Equation 5-34

Qabsorb = 70900 F A0.82 .................................................................. Equation 5-35

where Qabsorb is the total heat absorbed (W), F is an environment factor and A is the total wetted
surface area (m2). The expression A0.82 is an area exposure factor which recognises that large
vessels are less likely than small ones to be completely exposed to the flame of an open fire. In the
likely confinement offshore, it would be more appropriate to use A rather than A0.82. The
environment factors are given in Table 5-9.

Table 5-9 API 521 environment factors

Type of equipment Environment factor (F)

Bare vessel 1.000

Water deluge protected vessel 1.000
Depressurising and emptying facilities 1.000
Insulated (conductance 22.71 kWm-2 K-1) vessel 0.300

Insulated (conductance 11.36 kWm-2 K-1) vessel 0.150

Insulated (conductance 5.68 kWm-2 K-1) vessel 0.075

Insulated (conductance 3.80 kWm-2 K-1) vessel 0.050

Insulated (conductance 2.84 kWm-2 K-1) vessel 0.038

Insulated (conductance 2.27 kWm-2 K-1) vessel 0.030

Insulated (conductance 1.87 kWm-2 K-1) vessel 0.026

Note that credit is only given for insulated vessels. API now makes it clear that the insulation must
be passive fire protection but the requirement is that the insulation material should function
effectively up to 904 °C. As is recognised by API, their approach is not suitable if the fire scenario
identified is more severe than a about 110 kW m-2 hydrocarbon pool fire e.g. a jet fire or a confined
hydrocarbon pool fire.

Hekkelstrand and Skulstad (2004) [5.37] consider slightly higher heat fluxes than API. They
consider small to medium size fires on the basis that the aim is to prevent escalation to a large fire.
Two figures are given for the incident heat fluxes from fuel-controlled fires. The local peak heat
load is used to calculate the rise in steel temperature and global average heat load is used to
calculate the pressure profile. Their incident heat fluxes for jet and pool fires are summarised in
Table 5-10.

Table 5-10 Global and local peak loads

Jet fire
Heat load Pool fire
Leak rate > 2 kgs-1 Leak rate* > 0.1 kgs-1

Local peak (kWm-2) 350 250 150

Global average (kWm-2) 100 0 100

* This calculation is for an object close to the fire.

Various rules are given for the application of these values and the original publication should be
consulted before use of the values given.

152-RP-48 Rev 02, Feb 2006 Page 150 of 261

fireandblast.com

5.5.3.4 Effect of fire protection on heat transfer to vessels

5.5.3.4.1 Directed water deluge

No credit is given for directed deluge systems in API 521 [5.38] as the reliability of water
application is uncertain because of freezing weather, high winds, clogged systems, unreliable
water supply and vessel surface conditions that can prevent uniform water coverage. However, it is
suggested that systems designed to NFPA 15 [5.39] can be effective. NFPA specifies an
application rate of 12 l m-2min-1. This is derived from small-scale pool fire trials where the
application rate is taken as the amount of water leaving the nozzles divided by the vessel surface
area. The NFPA [X] requirements for nozzle spacing and spray angle are very general. In practice,
it is the amount of water flowing over the surface of the vessel, which has the greatest influence on
fire resistance. As only between 35 % and 45 % of the water exiting the nozzles actually forms a
film on the vessel surface, a poorly designed system delivering the minimum requirement of
12 l m-2min-1 may not even fully protect against a pool fire. Although the application requirement of
10 l m-2min-1 in the FOC tentative rules (1979) [5.40] is lower than the NFPA [5.41] requirement,
systems designed to these will, in general, apply more water to the surface of the vessel as there is
a more detailed specification of the nozzle spacing (longitudinal and stand-off from the surface),
numbers of rows of nozzles and spray angle relative to the size of vessel.

There has been considerable interest in the use of directed deluge in protecting against jet fires.
White and Shirvill (1992) [5.42] have shown that deluge systems with the usual medium velocity
nozzles are not effective in protecting against natural gas jet fires. Lev (1995) [5.43] has suggested
that it may be possible with systems using high velocity nozzles and White and Shirvill (1992)
[5.44] suggest it may be possible with high velocity water monitors. Shirvill (2003) [5.45] has shown
that a system delivering about 17 l m-2min-1 is not effective in fully protecting (keeping the wall
temperature to 100 ºC or less) vessels against 2 to 10 kg s-1 flashing liquid propane and butane jet
fires. Roberts et al. have shown that about 30 l m-2min-1 will protect 2 tonne vessels against 2 kg s-1
flashing liquid propane jet fires. Hankinson and Lowesmith (2003) [5.46] have looked at the
effectiveness of area and directed deluge in protecting against “live” jet fires. Davies and Nolan
[5.47] have empirically modelled the parameters for predicting the surface water coverage and
have developed a practical method for characterising the water coverage. All these recent results
are summarised in a special edition of the Journal of Loss Prevention in the Process industries
(March, 2003) [5.48]. Even though a directed deluge system may not be fully effective (primarily in
protecting the unwetted wall) in protecting against flashing liquid propane and butane jet fires,
Shirvill [X] suggests that the overall rate of heat transfer is reduced by 50 %. This is consistent with
results (Roberts, 2003) [5.49] from 20 % filled LPG tanks.

5.5.3.4.2 Passive fire protection

Roberts and Moodie (1989) [5.50] have shown that a range of fire protection materials are suitable
for protecting LPG tanks against hydrocarbon pool fires. As indicated previously, API (2005) [5.51]
takes reduced heat input into account by the use of environment factors. These environment
factors are calculated using Equation 5-36.

kPFP ( 904 − Trelief )

F= .................................................................. Equation 5-36
66570 L

where kPFP is the thermal conductivity (Wm-1K-1) of the PFP, Trelief the temperature (°C) of the vessel
contents at relieving conditions and L is the thickness (m) of the insulation. API [5.52] provides
thermal conductivities for a range of materials but these may only be strictly applicable to
hydrocarbon pool fires.

In general, PFP materials that have successfully, i.e. meeting the required time to critical
temperature, passed a resistance to jet fire test (Jet Fire Working Group, 1995) [5.53] will be
suitable for protecting pressure vessels against jet fires. Roberts et al. (1995) [5.54] have shown
that this is at least true for LPG vessels. At present, there appear to be no standardised criteria for
152-RP-48 Rev 02, Feb 2006 Page 151 of 261
fireandblast.com

the protection of pressure vessels. LPGA (2001) [5.55] suggests that 90 minutes to reach 300 °C
(the temperature at which carbon steel starts to lose its strength) is suitable for LPG vessels.
Higher temperature criteria may be suitable for thicker walled (> 12 mm) vessels or for vessels
made from steel alloys, which maintain their strength to higher temperatures.

5.5.3.5 People

The response of people to fires is considered in Section 6.7. Hymes et al. (1996) [5.56] have
considered the physiological and pathological effects of thermal radiation and relate these to a
thermal dose (note: dosage is usually taken as irradiation x time). The thermal dose
(s (W m-2)4/310-4) is given by:

4
TL = t ( qrad ) 3 10−4 ......................................................................... Equation 5-37

where t is the exposure time (s), qrad the radiation (Wm-2) received and 10-4 a convenient scaling
factor. The radiation received should be calculated from either the solid flame model if close to the
fire or the point source model if more than two flame widths/lengths away from the source.

From a major hazard perspective, there are two issues:

• How long can a worker continue to operate in an emergency system whilst exposed to a
given level of radiation?
• What fraction of the population will die or sustain injury given exposure to a certain dose of
radiation?

In regard to the former, API (2005) [5.57] provides permissible design thermal radiation levels for
personnel. These are given in Table 5-11 below (Note: API 521 [5.58] should be consulted to
consider these in the context - disposal by flaring - in which they are given).

Table 5-11 API 521 permissible radiation design levels

Permissible
design level Conditions
(kWm-2)
Maximum radiant heat intensity at any location where urgent emergency action by
personnel is required. When personnel enter or work in an area with the potential for
9.46
radiant heat intensity greater than 6.31 kW m-2, then radiation shielding and/or special
protective apparel (e.g. a fire approach suit) should be considered a
Maximum radiant heat intensity in areas where emergency actions lasting up to 30 s may
6.31
be required by personnel without shielding but with appropriate clothing b
Maximum radiant heat intensity in areas where emergency actions lasting 2 to 3 minutes
4.73
may be required by personnel without shielding but with appropriate clothing b
Maximum radiant heat intensity at any location where personnel with appropriate
1.58
clothing b may be continuously exposed.
Superscript notes:
• It is important to recognise that personnel with appropriate clothing b cannot tolerate thermal
radiation at 6.31 kW m-2 for more than a few seconds.
• Appropriate clothing consists of hard hat, long-sleeved shirts with cuffs buttoned, work gloves, long-
legged pants and work shoes. Appropriate clothing minimises direct skin exposure to thermal
radiation.

152-RP-48 Rev 02, Feb 2006 Page 152 of 261

fireandblast.com

The lethality to the population is usually addressed by probit or logit analysis. The two commonly
used probit relations for fatality are:

Eisenberg (based on nuclear bomb data) ........... Y = −14.9 + 2.56 ln ( X ) Equation 5-38

Where X = t qrad
43

Lees (valid up to 70% mortality) .......................... Y = −10.7 + 1.99 ln ( Z X ) Equation 5-39

where ZX is a function of X depending on whether clothing ignites.

Hymes et al. [5.59] gives doses for probability of 1 % and 50 % lethality as 1050 s(W m-2)4/310-4
and 2300 s (W m-2)4/310-4 respectively. These correspond to a radiation dose of 8.6 kW m-2 for
1 minute or 2.6 kW m-2 for 5 minutes for 1 % lethality and 15.4 kW m-2 for 5 minutes for 50 %
lethality.

More details on using these and other methods are given by Lees et al. (1996) [5.60]. The
response of personnel is considered further in Section 6.7.

152-RP-48 Rev 02, Feb 2006 Page 153 of 261

fireandblast.com

6. Response to fires

6.1 Properties of common materials in use offshore

6.1.1 Overview

At normal temperatures steels used in offshore structures are designed to behave elastically, the
stress strain behaviour is linear in both compression and tension and beyond yield the slope of the
stress-strain flattens markedly. For normal design conditions (i.e. excluding extreme weather for
structural steel, fires and explosions) the stress in the steel should be below 60 % of the yield
stress. As the temperature rises, the yield stress and the modulus of elasticity both reduce, at a
temperature of about 400 ºC the yield stress reduces to about 60% of its value at normal
temperatures, and consequently this temperature is often taken as a critical temperature at which
the behaviour of the steel changes and failures can start occurring.

Concrete is not commonly used offshore but there are about 24 platforms in the North Sea with
concrete substructures. The top of the concrete is usually several metres below the underside of
the main deck, but it can be subjected to pool fires on the sea surface or the jet fires from risers.
Concrete can withstand a pool fire for a significant time, the outer layer of the concrete normally
serves to protect the underlying steel from corrosion, but in a pool fire protects the steel and the
bulk of the concrete from the effects of fire, at least for some time. In a jet fire the concrete cover
can rapidly be eroded, exposing the steel reinforcement to the effects of the flame

6.1.2 Mechanical

For simple beams or ties, the yield strength at elevated temperature is all that is required. For a
compression member the yield and the elevated temperature value for Young’s modulus is
required. For a complex FE analysis, the complete stress-strain curves at elevated temperature are
required. The most comprehensive source of material properties for the common structural carbon
steels is EC3-1-2. (S235, S275, S355, S420 and S460 of EN 10025, EN 10210-1 and
EN 10219-1). Many steel grades will be compatible with the European grades. BS5950-8 gives
similar information but tends to be less detailed.

For other grades of steel, one of the best sources of information is FABIG Technical Note 6 [6.1].
This contains mechanical properties for:

Carbon Steels
• BS EN 10113-3:1993, grades 355M, 420M (based on Helsinki University research), 460M

• BS7191 grades 355EMZ, 450EMZ

Stainless Steels
• BS EN 10088 grades 1.4301(304), 1.4404(316), 1.4462(2205), 1.4362(SAF2304)

The properties of the RQT and TMRC steels tend to be lower than the normal carbon steels. At
400 ºC their relative strength is about 10 % lower.

Stainless steels tend to maintain their strength and stiffness at elevated temperatures compared
with carbon steels.

For any carbon structural steel, the rate of loss of stiffness is greater than the rate of loss of
strength (see Table 6-1). Consequently, for the same load level, buckling will occur at a lower
temperature than a failure depending on strength.

152-RP-48 Rev 02, Feb 2006 Page 154 of 261

fireandblast.com

Table 6-1 Reduction factors for strength and stiffness (EC3-1-2)

Steel Reduction factor Reduction factor

temperature for effective yield strength for the slope of the
linear elastic range

20 ºC 1.000 1.000
100 ºC 1.000 1.000
200 ºC 1.000 0.900
300 ºC 1.000 0.800
400 ºC 1.000 0.700
500 ºC 0.780 0.600
600 ºC 0.470 0.310
700 ºC 0.230 0.130
800 ºC 0.110 0.090
900 ºC 0.060 0.068
1000 ºC 0.040 0.045
1100 ºC 0.020 0.023
1200 ºC 0.000 0.000

It can be seen in the table that the strength of steel falls very quickly. This makes an assessment of
the steel temperature very important. At about 500 ºC a 10 % difference in temperature can lead to
a 16 % loss of strength.

For some heat treated and special steels it may be necessary to carry out tests to establish the
necessary properties. This is because the enhancement of properties caused by the heat
treatment may be lost if the steel is heated beyond the heat treatment temperature.

The mechanical properties given in EC3-1-2 are based on anisothermal tests. In these tests, the
steel is first loaded and then heated. The steel responds by expanding due to thermal expansion
and elongating due to the stress. As the steel loses strength and thickness the rate of elongation
increases until a run-away occurs. From a series of such tests at different stress levels, stress
strain curves can be derived for a range of temperatures.

The rate of heating is important. The EC3 data is based on steel being heated at about 10 ºC per
minute. This corresponds to a 60 minute fire resistance in a building where failure will occur at
about 600 ºC. For heating rates between 2 ºC and 50 ºC per minute the EC3 data is reasonable
and the effects of creep may be ignored. Because of the effects of creep, if the heating rate is
faster the data will be conservative and for slower heating rates it will be unconservative. It should
however be emphasised that potential heating rates are much faster in fire incidents offshore. In
any hydrocarbon fire flame temperatures can be in excess of 1500 ºC and temperatures of close to
1800 ºC have been recorded. The maximum temperature will depend on the size of the fire and the
degree of ventilation.

In a hydrocarbon fire, unprotected steel will heat very quickly and will reach temperatures
associated with structural collapse in 5 minutes or so.

Concrete loses strength at a broadly similar rate to structural steel but loses stiffness at a faster
rate. The best reference is EC4-1-2 [6.2] (composite construction).

152-RP-48 Rev 02, Feb 2006 Page 155 of 261

fireandblast.com

Both BS5950-8 and EC3-1-2 give the same information on the strength of bolts and welds at
elevated temperatures. As these are not well known, the information is shown here in Table 6-2.
The yield strength is also shown for comparison.

Table 6-2 Strength retention factors for bolts and welds

Temperature Strength reduction factor for Strength reduction Yield strength

bolts (tension and shear) factor for welds

20 ºC 1.00 1.00 1.00

100 ºC 0.97 1.00 1.00
150 ºC 0.95 1.00 1.00
200 ºC 0.94 1.00 1.00
300 ºC 0.90 1.00 1.00
400 ºC 0.78 0.88 0.97
500 ºC 0.55 0.63 0.78
600 ºC 0.22 0.38 0.47
700 ºC 0.10 0.13 0.23
800 ºC 0.07 0.07 0.12
900 ºC 0.03 0.02 0.06

It can be seen that both bolts and welds lose strength at a faster rate than structural steel.
However, because of the partial factors used for normal and fire design this effect is not as
significant as it might appear (see Section 6.4.2).

6.1.3 Thermal

The thermal properties of the common structural steels are given in EC3-1-2. The thermal
properties of concrete are given in EC4-1-2.

6.2 Effects of fire and nature of failures

6.2.1 Standard hydrocarbon fire test

In a hydrocarbon fire resistance test [6.2, 6.3, 6.4], the gas temperature is increased to 1100 ºC in
about 20 minutes and then held constant.

The temperature time curve of the ISO and BS hydrocarbon test fires are compared with the
standard cellulosic fire in Figure 6-1.

Fire resistance tests are generally only useful for comparing the performance of different products
under constant conditions. Regulations and specifications will often refer to a performance
standard measured in a fire resistance test. Extrapolation to real fire behaviour can sometimes be
misleading.

The results of a hydrocarbon fire test are often expressed as H60 or H90 etc.

152-RP-48 Rev 02, Feb 2006 Page 156 of 261

fireandblast.com

1200

Hydrocarbon
1000

800

Temperature (°C)
Cellulosic
600

400

200

0
0 30 60 90 120
Time (mins)

Figure 6-1 Time temperature curves for hydrocarbon and cellulosic fires in fire resistance
tests

6.2.2 Jet fire test

A draft ISO standard, ISO/CD 22899-1 [6.5] is being developed to advise on requirements for small
scale jet fire tests. It has recently been agreed that there will be a Part 2 giving the background to
the test, more clarification on classification and a combination of furnace and jet fire test results
etc.

The method provides an indication of how passive fire protection materials perform in a jet fire that
may occur. Jet fires give rise to high convective and radiative heat fluxes as well as high erosive
forces. In the test, a sonic release of a gas (0.3 kg s-1) is aimed into a shallow chamber, producing
a fireball with an extended tail. Propane is used as the fuel. High erosive forces are generated by
release of the sonic velocity at about 1000 mm from specimen surface.

The results from the small scale test have been compared with full scale jet fire test results from
four testing establishment laboratories.

The test standard gives guidance on the use of the test result and its application to the assessment
of passive fire protection material.

6.2.3 Types of failure

6.2.3.1 General

Structural failure is any unwanted occurrence and may take any form from excessive deformation
to total collapse.

In a fire, the structure has to carry the applied loads at the time but it also is subject to thermally
induced loading which may, for some elements be more severe. The thermally induced loads are
caused by restrained thermal expansion.

It is also important that the consequences of minor failures on system are analysed with respect to
their effects on other systems. For example, a minor structural failure could lead to the fracture of a
pipe or breakdown in an electrical system.

Another consideration is repair. Has something failed if it does not have to be repaired? Minor
residual deformations following a fire may not impair the function of the component or any other
component and can probably not be described as failure.

152-RP-48 Rev 02, Feb 2006 Page 157 of 261

fireandblast.com

A summary table of the failures of the more obvious (safety critical) elements which may give rise
to escalation and to which the above issues should be applied may be found below.

Table 6-3 Safety critical element failure or loss of function with respect to fire hazards

Performance Standard Requirement

System or (with respect to fire escalation normally
Safety critical element failure or loss
equipment part of survivability characteristics
of function
category See other parts of Sections 6 & 7 of this
Guidance)

Primary Failure is direct cause of major
structure (catastrophic) structural collapse
Secondary Failure allows shifting of load paths and
structure generation of contributory increased
loads (ultimately) to primary structure
Supporting Failure allows
steelwork for distortion/movement/collapse of
vessels/piping hydrocarbon containing vessels and
piping with subsequent loss of
containment integrity
Supporting Failure allows distortion/movement/
steelwork for collapse of rotating equipment/ lifting
equipment equipment/ utilities leading to potential
loss of containment integrity/ equipment
failure/generation of dropped objects/
missiles/ potential loss of power for
some safety systems (control, ESD,
detection, active protection etc.)
Supporting Failure allows
steelwork for distortion/movement/collapse of areas
accommodation/ of key hazard control and places of
control/ muster safety/embarkation for POB
areas/TR
Supporting Failure allows
steelwork for distortion/movement/collapse of access
flooring/ access for POB to places of hazard
ways control/safety/embarkation
Vessels/ main Failure leads directly to loss of
piping containment integrity in hydrocarbon
containing vessels and piping
– Resistance to defined fire loads for a given
duration
(for example, a jet fire direct impingement
for a duration 15 minutes - say until
process pressure is adequately reduced (to
limit the reach of the jet flame). The failure
would be when the structure could no
longer maintain its load within defined
deformation limits whose exceedance
would cause further breaches of process
integrity or collapse of safety areas or
evacuation systems.
– Residual strength requirement defined
– Resistance to defined fire loads for a given
duration
– Residual strength requirement defined
– Resistance to defined fire loads for a given
duration
– Limits to movement are defined
– Resistance to defined fire loads for a given
duration
– Limits to movement are defined
– Resistance to defined fire loads for a given
duration
– Limits to movement are defined
– Limits to loss of airtight integrity defined
– Residual strength requirement defined
– Resistance to defined fire loads for a given
duration
– Limits to movement are defined
– Resistance to defined fire loads for a given
duration
– Resistance to impact and explosion loads
also defined

152-RP-48 Rev 02, Feb 2006 Page 158 of 261

fireandblast.com
System or
Safety critical element failure or loss
equipment
of function
category
Vessel Failure leads to small leaks (loss of
appurtenances/ containment integrity in hydrocarbon
small bore piping containing vessels and piping) with
potential for further fires and explosions
Gas detection Fire from small event may disable
systems to detect further escalating
events
Fire detection As above
Blast walls Blast walls usually have protective
requirement with respect to fires as well
as explosions, loss of fire resistance
integrity following an initial blast will
potentially allow spread of fire hazard to
other areas
Fire walls Failure leads to loss of control and
hence allows unimpeded escalation of
the initial event
Active fire Failure leads to loss of control and
protection hence allows unimpeded escalation of
systems the initial event
Passive fire Failure leads to loss of mitigation and
protection fire resistance on adjacent
systems systems/steelwork and hence
eliminates or impairs any slowing of the
escalation from an initial event
HVAC Failure of closure or redirect aspects of
HVAC leads to loss of a control system
for unignited gas and products of
combustion, allowing unimpeded
escalation of the initial event
152-RP-48 Rev 02, Feb 2006
Performance Standard Requirement
(with respect to fire escalation normally
part of survivability characteristics
See other parts of Sections 6 & 7 of this
Guidance)
– Resistance to defined fire loads for a given
duration
– Resistance to impact and explosion loads
also defined
– Event size and time delay before triggering
defined
– Generally resistance to fire and other
hazard loads impractical, continuing
function achieved by redundancy
– Event size and time delay before triggering
defined
– Generally resistance to direct impingement
of fire and other hazard loads impractical,
continuing function achieved by
redundancy
– Resistance to impact and explosion loads
defined
– Resistance to defined fire loads for a given
duration following initial events also
defined
– Resistance to impact and explosion loads
defined (where possible)
– Generally resistance to direct impingement
of fire and other hazard loads impractical,
continuing function achieved by
redundancy
– Resistance to impact and explosion loads
defined (where possible)
– Generally resistance to direct impingement
of fire and other hazard loads impractical,
continuing function achieved by
redundancy
– Resistance to impact and explosion loads
defined (where possible)
– Resistance to direct impingement of fire
and other hazard loads may be impractical,
continuing function achieved by diversity
within suite of safety systems
– Resistance to impact and explosion loads
defined (where possible)
– Resistance to direct impingement of fire
and other hazard loads may be impractical,
continuing function achieved by diversity
within suite of safety systems
Page 159 of 261
fireandblast.com

6.2.4 Loss of compartmentation

Fire spread by loss of compartmentation will increase the likelihood of most types of failure so loss
of compartmentation is an important type of failure and within the UK, regulations refer to loss of
insulation and loss of integrity. Testing a component in isolation in a fire resistance test may result
in acceptance criteria that may be simple to achieve. In the test, a combination of good detailing
and a suitable thickness of insulation will normally suffice. However, when a component, such as
bulkhead is built into an offshore structure, the interaction between the bulkhead and its
boundaries must be considered. Restrained thermal expansion can lead to buckling which may
dislodge fire protection material. Boards and thickly sprayed material will be more affected, whilst
intumescent coatings will normally be sufficiently flexible.

Intumescent coatings will not protect against a loss of insulation. Their activation temperature is
generally greater than the limit on temperature rise (140 °C).

The biggest problem is in preventing gaps opening up through which the fire might spread.
Awareness and good detailing are probably the best ways to prevent this type of fire spread.
Designers should be aware of the likely magnitude of any gaps. In some circumstances the use of
intumescent mastic may be of use.

Frequently compartment boundaries will be penetrated by pipe work or some form of duct.
Maintenance of compartmentation will normally depend on the performance of a proprietary
penetration seal for which there should be suitable test evidence and careful installation and
regular inspection.

6.2.4.1 Thermally induced deformation

6.2.4.1.1 Linear expansion

Expansion is difficult to resist and a heated member can exert extremely large forces at its
supports. Fully restrained steel will yield at a temperature below 200 ºC, the exact temperature
depends on the grade of steel. A beam, designed to resist bending, has a relatively large axial
resistance and, if restrained, may have an affect structure at some distance from any source of
heat. In building fires, damage to bracing members has been observed 40 metres away from the
fire.

6.2.4.1.2 Buckling

Restrained members may buckle to relieve induced compression. For simply supported members
this may not cause a problem but, for continuous members, bending resistance at supports may be
lost. Buckled steel can cause problems on cooling as the buckling may not be reversed and the
steel becomes shorter than its initial length. Connections may be pulled apart. Potentially the
tensile force generated is equal to the yield resistance of the member. Failures have been
observed in both bolted and welded connections and also in the section itself.

Buckling can also occur in any member in compression, when the buckling resistance falls to the
level of the applied or design load. The onset of this type of buckling may be exacerbated by axial
restraint. However, often, if supporting structure is capable of exerting compressive restraint, then
it is also capable of taking up load when a member starts to buckle. This is a complex mechanism
which depends on the extent of a fire as well as the structural form.

6.2.4.1.3 Thermal bowing

Any section which is non-uniformly heated will tend to bow. For most sections the free bowing is a
simple function of the temperature difference across the section. A 500 mm deep section,
12 metres long, with a temperature difference of 300 ºC will bow by about 125 mm. A linear
gradient will cause no stress in a steel member. A non-linear gradient will cause longitudinal shear

152-RP-48 Rev 02, Feb 2006 Page 160 of 261

fireandblast.com

stresses to be induced. In some types of partially protected steel beam, compression flanges can,
in the early stages of a fire, go into tension.

In a continuous member, thermal bowing will lead to very large induced restraining moments which
are added to any existing moments (Figure 6-2). This can lead to failure of connections and
buckling of compression flanges and webs.

Deformation caused by thermal bowing can cause disruption of services and effect equipment
performance.

Increase due to
thermal bowing

Figure 6-2 The effect of thermal bowing on the bending moment in a continuous beam.

6.2.4.2 Load induced phenomena

6.2.4.2.1 Bending

Beams will generally withstand large deformations before they are unable to support their design
load. In fire tests and actual fires deformations in excess of span/20 are common.

Continuous beams may be more vulnerable because of the addition of thermally induced moments
at their ends. This may make laterally torsional buckling of some cross sections more likely.

In many forms of construction, as deformations increase, tensile membrane action may become
increasingly dominant. In plated construction, this will supplement the bending resistance and can
sometimes carry all imposed loads.

Often, if a beam supports a plated floor, the beam and plate can act together in fire, although not
designed to do so. This can enhance strength and stiffness.

Large deformations due to loss of bending stiffness will affect connections, as described above.

6.2.4.2.2 Tension

Tension members will lose strength in direct proportion to the loss of yield strength. Isolated
tension members are rare in any structure so, as a tension member loses strength and lengthens
under load, loads redistribution tend to occur. Elongation can be significant. At 550 ºC, a tension
member carrying 50 % of its normal resistance will elongate by about 1.25 %. This Assumes a
stress induced component of 0.5 % and a thermal expansion component of about 0.75 %. For a
6 metre length this is 75 mm.

6.2.4.2.3 Compression

A member in compression will fail at a lower temperature (about 80 ºC lower than a bending
member at the same load level). This is because the stiffness of carbon steel reduces at a faster
rate than the strength.

152-RP-48 Rev 02, Feb 2006 Page 161 of 261

fireandblast.com

For most compression members, the applied stress in fire may be increased due to restrained
thermal expansion, see above.

6.2.4.3 Brittle and ductile failure

Generally, in highly redundant structures, any mode of failure will be ductile as there will be
redistribution of load. However, failures such as those caused by induced thermal stresses on
welds and bolts will be brittle but may be followed by an immediate redistribution of load to other
parts. The consequences of the failure of large elements in redundant structures need careful
consideration. For example, Topsides with significant cantilevered decks, which support the TR at
the extremity, are prone to progressive local collapse, especially where critical MSF deck braces
are required to support the cantilever. Localised failure due to yielding under fire however will in
most cases redistribute the gravity loads elsewhere to unaffected areas, except under extreme e.g.
riser rupture type scenarios, thus, as damage and local failures accumulate, the final failure may
be sudden as redistribution of load becomes impossible.

6.2.4.4 Examples of structures following fire

Figure 6-3 Tensile membrane action in the web of a beam

(photo by permission of Corus plc, [6.6, 6.7])

152-RP-48 Rev 02, Feb 2006 Page 162 of 261

fireandblast.com

Shear capacity maintained

by unsplit side of plate

Tensile force induced

on cooling

Fractured
end plate
Typical split in connection
occurring on cooling

Figure 6-4 Failure of a welded connection on cooling

(Photo by permission of BRE, [6.8])

6.2.5 Escalation issues

The discussion of failure leads onto a major issue for the robust design of installations against
major accident hazards. The failure of a component or part of a system may give rise to a
cascading series of events leading to catastrophic failure or loss of life.

A systematic, structured approach to escalation analysis should be adopted to determine if, how
and when an event can escalate to endanger personnel.

The escalation analysis should comprise:

• The assessment of potential escalation paths from an initiating event towards a major
accident hazard as defined in the Safety Case or towards a “safe” shutdown;
• Identification of the mechanisms by which that initial event could escalate to impinge on key
safety systems or facilities (such that the available safety systems can no longer function to
slow or stop the escalation);
• Evaluation of the probability of each escalation path and the time duration from the initial
event.
• Re-evaluation of the design to minimise damage to or failure of SCEs and produce an
ALARP solution

Appropriate consideration should also be given to the actions of key personnel in responding to an
incident, taking into account the effects of the hazard under review. In the case of fire, these effects
would comprise heat, smoke other products of combustion, the impacts to be considered would be
injury, burns, obscuration of vision and impaired breathing and judgement. The growing scale of
the incident should be understood and the dynamic of the incident growth such that there were not
unrealistic expectations of personnel performance, e.g. speed of running, ability to carry or assist
injured colleagues etc.

This assessment should include how operators have contributed to the detection of the fires
(especially in the case of a Normally Unattended Installation) as well as how they respond. The

152-RP-48 Rev 02, Feb 2006 Page 163 of 261

fireandblast.com

speed and accuracy of detection will impact the potential escalation paths of the initiating incident
and if additional detection information from operating personnel contributes to an accurate
diagnosis of the event underway, this should be included in the emergency response assessment.

In the UKCS, the requirement for defining Safety Critical Elements is included in Statutory
Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and Construction, etc.)
Regulations 1996,” [6.9] where Safety Critical Elements means “such parts of an installation and
such of its plant (including computer programmes), or any part thereof -
• the failure of which could cause or contribute substantially to; or
• a purpose of which is to prevent, or limit the effect of,

a major accident.

It can be seen that equipment or devices that prevent, slow or stop the escalation are by definition
safety critical elements. The discussions of acceptance criteria and failure should be linked to the
review of methods of prevention (Section 3.3), detection and control (Section 3.4) and mitigation
(Section 3.5). The consolidation if these issues will contribute to the definition of the Performance
Standards (see Section 3.6) in the context of fire hazards and their management mechanisms.

If a major fire occurs then safety of the occupants is the major priority. It is important to give
occupants sufficient time, either to escape or to sit it out in the Temporary Refuge until the danger
has passed. Depending on the location of a fire, any escape route must be adequately insulated to
be tenable.

Structurally, deformation leading to disruption of another system, or leading to an escape route or

refuge becoming untenable must be considered to be failure. Deformation is controlled by design
(computer simulation etc) and by the application of passive protection.

For further details on impacts to human beings and therefore understanding the limits to
escalation, see Section 6.7.

6.3 Acceptance criteria

6.3.1 General

Structures are designed for several limit states and what is acceptable for one limit state may not
be acceptable for another. When considering collapse, deformation may not be considered, but
when considering effects on safety critical elements and disruption to production, deformation is
clearly important.

In fire, acceptance criteria are set for any components tested in a standard fire resistance test. In
addition, in critical areas more stringent requirements may be set by the safety authorities or
specified by the client.

The most straightforward criteria are the failure criteria specified in fire resistance test standards.

6.3.2 Criteria used in standard fire tests

Fire resistance test standards such as BS476, ISO834 [6.10] or EN1363 [6.11] use three failure
criteria for structural elements They provide a means of quantifying the ability of an element to
withstand exposure to high temperatures, by setting criteria by which the load bearing capacity, the
fire containment (integrity) and thermal transmittance (insulation) functions can be evaluated.

Linear structural elements such as beam only have to satisfy the load bearing criterion as they are
do not form a barrier to the spread of a fire. Separating elements, which directly prevent the spread
of fire, such as a bulkhead have to satisfy all three criteria.

152-RP-48 Rev 02, Feb 2006 Page 164 of 261

fireandblast.com

For buildings, as a consequence of European Harmonization, fire resistance is increasingly being

expressed in terms of “resistance to collapse” (R), ”resistance to fire penetration (E) and
“resistance to the transfer of excessive heat” (I), all of which are describe in more detail below. This
terminology may be adopted for offshore structures in due course.
Resistance to collapse (R) is the ability to maintain load bearing capacity (which applies to load
bearing elements only) or the ability not to collapse (non-load bearing elements only). The use of
the term “resistance to collapse” can be applied to load bearing and non-load bearing elements
and as such is preferred.

For loaded beams and floors, failure is deemed to occur when the deflection reaches span / 20 or,
when the deflection is greater than span / 20, the rate of deflection exceeds span2 / (9000D). D is
the distance from the top of the element to the bottom of the design tension zone. All dimensions
are in millimetres. As well as experiencing large deformations beams experience large strains.
Tests and calculation have shown that strains in excess of 3 % are common in the bottom of an
I - beam in a fire test.

For steel beams, the application of any of the deformation criteria will have a small effect as the
difference between the time to collapse and the time when any of the criteria might apply is small.
Fire containment or the resistance to fire penetration (E), is the ability to maintain the integrity of
the element against the penetration of flames and hot gases (this applies to fire-separating
elements).

Integrity failures should be rare in fire resistance tests for essentially steel elements. Problems are
more likely to occur in actual fires at junctions between elements.

Thermal transmittance refers to the resistance to the transfer of excessive heat (I) and is the ability
to provide insulation from high temperatures (this applies to fire separating elements).

An insulation failure is deemed to occur when the average temperature rise on the unexposed face
of a separating element exceeds 140 ºC or the maximum temperature rise exceeds 180 ºC,
whichever occurs first. These limits are to prevent combustion of any material which may be close
to the unexposed face. Their origins are unknown and, in many cases, the limits may be
excessively conservative.

In a fire test an insulation failure will occur because the insulation is not adequate, or, it may occur
because the insulation becomes detached, often called a “stickability” failure. Often tests on
vertical separating elements are carried out on unloaded, unrestrained elements. Results from
such tests must be interpreted with care and the systems tested must be carefully installed.

Table 6-4 Performance requirements for elements of construction

Component Requirement

Load bearing beams and columns R

Load bearing floors, walls and partitions R,E,I
non load bearing separating floors, walls and partitions E,I

6.3.3 Relationship between criteria used in standard fire tests and actual
performance in real fires

In the UK, fire tests are carried out on small elements. Beams generally have a span of 4.5 m and
columns, which in any case are rarely tested, are 3.2 m high. Wall panels are tested at 3 m x 3 m.
Elements in real structures are often many times the size tested or have no associated test
evidence. Structurally, there will often be little to learn from a Standard Fire Test and designers
must look elsewhere, at the limited evidence available from some large scale tests or rely on their

152-RP-48 Rev 02, Feb 2006 Page 165 of 261

fireandblast.com

FE models. Even if the test is considered to be reasonable, any time measured in the test should
not be thought as actual time in any real fire.

In many cases, for a passive fire protection material, the results of fire resistance tests are all the
information that is available. Designers must decide whether the heating regime in the test
adequately represents the design scenario. If it is important to limit deformation then, interestingly,
the “stickability” of the material and its ability to deform is less important than it would be for a case
in which large deformations or strains are permitted.

Fire resistance test results on passive fire protection tests in the cellulosic fire should be used with
extreme care when considering performance in any hydrocarbon fire.

A jet fire rating equivalent to an A or H rating has been proposed in the latest draft version of the
ISO (22899-1) [6.12], (based on the jet fire test criteria proposed in ISO 13702 [6.13]) specified as:
Type of application / Critical temperature rise (°C ) / Type of fire / Period of resistance (minutes)

6.4 Methods of assessment

6.4.1 General

There are two possible approaches to carrying out structural analysis for the fire condition. Design
codes such as BS5950-8 [6.14] and EC3-1-2 [6.15] offer simple ways of checking elements.
However, the codes were written for building structures and will not always be suitable for highly
redundant offshore structures. Alternatively there are various types of finite element analysis
available which are capable of analysing large substructures or even the whole structure. It is also
possible to simply modify the existing “normal” or cold analysis by adopting elevated temperature
material properties.

In order to analyse any structure in fire a thermal model is required. For simple linear elements, all
that is required is the temperature distribution across the section at the mid point. This may be
computed using a 2-D thermal analysis. For more complex elements and whole structures, ideally,
the complete temperature history of all parts of the structure is required although some
simplification may be possible.

In carrying out a thermal analysis, the modelling of proprietary fire protection is not straightforward.
For fairly simple insulating materials, it should be possible to obtain a reasonable estimate of the
thermal properties. Intumescent materials behave in a very complex manner, as they react
differently in different situations. The local thickness of steel and the heating rate are important.

When carrying out any analysis, it is necessary to establish the applied loads on the structure.
BS5950-8 [6.16] and EC3-1-2 [6.17] allow loads to be reduced below the normal design values in
fire as it is considered that the probability of fire and full design load occurring at the same time is
rare. BS5950 is slightly more conservative than the Eurocodes. For an offshore structure, the
partial factors should be agreed between all parties.

It is also important to use appropriate mechanical material properties. BS5950-8 and EC3-1-2
effectively specify identical material properties for use in fire. However, BS5950 specifies different
strain limits for different types of element and mode of behaviour, the elements referred to
comprise composite structures not seen in the offshore industry (steel and concrete arrangements,
see Sections 6.4.3.3 and 6.4.3.4 for more details).

6.4.2 Partial factors for fire

In determining the structural resistance required, the applied loads on the structure at the time of
fire must be calculated. Both BS 5950-8 [6.16] and the Eurocodes allow reductions in some applied
loads in fire reflecting the accidental limit state. These reductions, which are for buildings, are
summarised in Table 6-5. For BS5950-8, the reductions are expressed as factors, for the

152-RP-48 Rev 02, Feb 2006 Page 166 of 261

fireandblast.com

Eurocodes the reductions are expressed as Ψ1,1 factors. The use of Ψ1,1, rather than Ψ2,1, is
expected to be recommended in the UK National Annex to EC1-1-2 [6.18].

In fire, the applied force or moment is given by:

Gk + Ψ fi Qk ,1

where

Gk is the characteristic value of a permanent action

Qk,1 is the characteristic value of the leading variable action 1

ψ fi is the combination factor for fire situation, given either by (frequent value) or (quasi-
permanent value) according to paragraph 4.3.1(2) of EN 1991-1-2 [6.19].

It is expected that, in the UK, the more conservative frequent value, ψ1,1, will be used for ψfi

Table 6-5 Applied load reductions in fire

BS 5950-8 Eurocode
Type of load Location/type
γf ψ1,1
Imposed Office 0.50 0.50
Escape stairs and lobbies 1.00 0.70
Other (including residential) 0.80 0.50
Storage 1.00 0.90
Snow 0.00 0.20
Wind 0.33 0.20
Permanent All 1.00 1.00

The values in the above table have been derived for buildings and may not be applicable to
offshore structures. They are based on statistical evidence and are almost certainly conservative. It
should be possible to derive similar information for offshore structures and subsequently eliminate
possible costly over design.

As an illustration of what might happen consider wind loading. The design case for wind might be
for a once in 50 year’s gust. During a fire, a structure might be vulnerable for a few hours. For the
same level of reliability, the wind load might be only 20 % of the 50 year level.

6.4.3 Methods in structural design codes

6.4.3.1 Introduction

Many countries have structural design codes for fire and shortly the Eurocodes will be finalised.
Almost without exception, these codes are for building structures and may only be of limited use for
offshore structures as building structures are generally much simpler than offshore structures with
less interaction between different elements.

An important consideration when assessing structures or structural elements in fire is that,

compared with cold, design, large deformations and strains are allowed. The strength of steel is
normally expressed as the stress corresponding to 2 % strain, and deformation limits in fire
resistance tests are about 20 times greater than might be allowed in cold design.
152-RP-48 Rev 02, Feb 2006 Page 167 of 261
fireandblast.com

The assessment methods can be used for beams and compression members. Little information is
given for plated structures. It is normal to assume that members are unrestrained. Problems
relating to expansion and restraint were discussed earlier in Section 6.

6.4.3.2 Member analysis

In a member analysis, the applied loads are calculated using the appropriate partial load factors.
The end reactions are generally calculated making the same assumptions that were made for the
initial design. The effects of thermal restraint and any second order or P-delta effects are ignored.
Only load carrying ability is considered so deformations are ignored.

For compression members it is normal to consider the possibility that the degree of end fixity may
increase in fire leading to a reduction in effective length. Codes such as EC3-1-2, allow the
effective length in fire to be 50 % of the system length, although, in the UK this may be
conservatively limited to 70 %. The reduction is based on two factors. Firstly, in a building a column
will be constructed as a continuous member and secondly, it can reasonably be expected that the
temperature at the ends will not be as high as at the mid-height position.

The method is useful for beams or columns which are not heavily restrained and for simple ties.

6.4.3.3 BS5950-8

BS5950-8 covers both non-composite construction and composite construction (steel acting with
concrete). For non-composite all the guidance relates to beams, columns and tension members. It
gives some guidance on unprotected steel but this is limited to 30 minutes fire resistance in the
standard cellulosic fire and would not normally be applicable offshore.

For beams it gives two methods of assessment. The load ratio – limiting temperature method is
largely based on fire resistance test results and is principally for I - section beams. The load ratio is
the ratio between the member resistance in fire and the normal, cold, member resistance. The
code assumes that the strength of a beam can be characterised by the temperature of the bottom
flange and that, in some circumstances, a colder top flange will be beneficial. However, a colder
top flange is assumed to be supporting a concrete floor. No guidance is given for beams
supporting steel plated floors.

The second method is based on moment resistance. From knowledge of the temperature
distribution across the section and the material properties at elevated temperatures, the plastic
bending resistance may be computed. This method is useful for unusual sections but cannot be
used without the temperature distribution. Where a comparison can be directly made, this method
is slightly more conservative than the load ratio – limiting temperature method.

For members in compression, the only method given is the load ratio – limiting temperature
method and the information is, again, based on standard fire resistance test data. For compression
members with comparatively low slenderness, there is a built in assumption that the column will
have an effective length in fire of about 85 % of the assumed cold effective length.

BS5950-8 gives simple interaction formulae to allow the load ratio to be calculated for both beams
and columns.

A method for checking concrete filled structural hollow sections is given. However, the method
given EC4-1-2 is more robust and is recommended.

In a useful annex, BS5950-8 gives guidance on re-use of steel following a fire and what one should
look for when inspecting a building.

6.4.3.4 EC3-1-2

EC3-1-2 is for non-composite construction only. EC4-1-2 deals with composite construction.

152-RP-48 Rev 02, Feb 2006 Page 168 of 261

fireandblast.com

For use in the UK (for buildings) both codes will have a national annex. All Eurocodes contain
some nationally determined parameters. They also contain some informative annexes. For any
country, the National Annex will give values for the nationally determined parameters and guidance
on the use of informative annexes.

The structural Eurocodes are all written in the same format. The design methods start with tabular
data. This is followed by simple design methods and finally there is some guidance on advanced
methods.

EC3-1-2, however, has no tabular data as the only useful data would be on the protection of steels
using proprietary fire protection materials. The bulk of the design information is in the form of
simple calculation methods. It concludes with some guidance on advanced methods. The term
“simple” is sometimes a misnomer, as a small program or spreadsheet is required.

For beams in buildings, EC3 is generally less conservative than BS5950-8. However, for beams
not supporting concrete floors it is very similar to BS5950 8. EC3 starts from the assumption that
beams are uniformly heated. Their bending resistance is reduced by the reduction in yield strength.
It then allows an “adaptation” factor to be applied that may take into account of a temperature
gradient and, for a continuous beam, colder support conditions.

For compression members, EC3 gives a simple method in which a non-dimensional slenderness is
calculated which leads to a reduction in the squash resistances. The method is a modified form of
all other Eurocode strut formula.

EC3-1-2 gives some guidance on members made from sheet steel with class 4 cross-sections.
These thin sections rapidly heat up and quickly lose strength. The guidance is for completeness
and academic interest.

The strength of bolts and welds at elevated temperatures was given earlier in Table 6-2, EC3-1-2
gives some guidance on checking connections in fire. For example, for a bolt, EC3 states:

γM2
Fv ,t ,Rd = Fv,Rd kb,θ Where;
γ M , fi

kb, θ is the reduction factor determined for the appropriate bolt temperature from Table
6-2.

Fv,Rd is the design shear resistance of the bolt per shear plane calculated assuming that
the shear plane passes through the threads of the bolt

γM2 is the partial safety factor at normal temperature

γM,fi is the partial safety factor for fire conditions

The important point to make is that although the reduction factor from Table 6-2 is lower than for
structural steel, the partial factor at normal temperature, γM2, is 1.25 and the factor for fire, γM,fi, is
1.0. Thus the effect of the reduction factors is somewhat ameliorated.

Guidance is also given on advanced calculation methods. In this context, this refers to finite
element modelling. It states that the model for mechanical response shall take account of:
• The combined effects of mechanical actions, geometrical imperfections and thermal
actions;
• The temperature dependent mechanical properties of the material;
• Geometrical non-linear effects;

152-RP-48 Rev 02, Feb 2006 Page 169 of 261

fireandblast.com

• The effects of non-linear material properties, including the unfavourable effects of loading
and unloading on the structural stiffness.

EC3-1-2 and EC4-1-2 have their roots in the ECCS Model code on fire engineering [6.20]. This
code also includes information on fires, covered by EC1-1-2. It also contains a commentary on
many of the clauses.

In due course, conflicting national standards will be withdrawn. At the time of writing, the situation
is:
• The loading code, EC1-1-2 was published at a full European standard in 2002. EC3-1-2
and EC4-1-2 are undergoing final editing and should be available during 2005. For all three
codes, the UK National Annexes are expected in 2007.

6.4.4 Finite element modelling

6.4.4.1 General

The use of Finite Element (FE) modelling is now becoming the norm. Packages exist which can
carry out both thermal and structural modelling, incorporating Computational Fluid Dynamics
(CFD), which will allow the growth and spread of fire to be modelled.

Finite element models can range from frame models with simple linear elements to complex
models utilising a number of element types, some of these applications are discussed in the
following sections.

In all examples and applications, the FE package being used should have been validated against
test data and the engineers using the package should be trained and preferably experienced in the
types of analysis being undertaken.

6.4.4.1.1 Frame models

Trusses comprising slender members or portal-like structures can be analysed as simple frames,
however the analysis should be non-linear and capable of dealing with large displacements. Ideally
the models should be 3D as 2D will not pick up some buckling modes.

6.4.4.1.2 Complex models

Complex finite element models should give the best prediction of structural performance. However,
any model is only as good as its input data. There is little point carrying out an expensive FE
analyses unless the thermal history is known with a degree of confidence and the design scenarios
assumed are reasonable. For more information on FE modelling see Section 6.4.4.8.

6.4.4.1.3 Modified “cold” model

It is sometimes reasonable to use the same structural model as was used for the normal, cold,
design in fire. Applied loads are appropriately factored and elevated temperature values for yield
stress and Young’s modulus are used. For a structure, or parts of the structure, which are not
highly restrained or which are not highly redundant the method may give reasonable answers but it
is impossible to say whether the results from such an analysis are conservative or unconservative.

6.4.4.2 Structural modelling

Before any FE analysis is carried out the conceptual model of the structure should be carefully
checked and possibly agreed with any potential certification authority. Consideration should be
given to the need to include initial imperfections and whether a dynamic option should be included
in the analysis. It is important that any analysis includes all non-linear effects and that it can model
membrane action. The sensitivity of any analysis to the mesh density should be investigated

152-RP-48 Rev 02, Feb 2006 Page 170 of 261

fireandblast.com

(although not necessarily for each job). Experience has shown that FE analyses of the same fire
and structural scenario using the same software, carried out by more than one group, can produce
widely different results. The differences are often due to differences in the conceptual model. The
assumptions regarding boundary conditions must be justified. If a substructure is being analysed,
the boundary condition assumptions regarding restraint thermal expansion can greatly affect
results. Also, at junction between two elements is there a load path and should adjacent nodes be
connected and in what way? Is the mesh sufficiently fine? Is the analysis being carried out by an
experienced engineer? These are all very important considerations which must be addressed if the
results are to be trusted.

In some areas it may be possible to carry out some preliminary “scoping” analyses to get some
idea what answers might be expected from the FE.

Following any analysis, the results should be carefully examined and anything that looks unusual
should be investigated. It may be correct or it may be due to an error in the conceptual model.

Compared with an elemental approach, any FE approach based on the same temperature
distribution should give more reliable results. However, many FE models will not properly predict
localised behaviour such as connection failure due to the need to refine the mesh density, unless
the analyst is aware of the possibility of such failure and has made an allowance for it in the model.

The main problems in any FE modelling start with the fire. In order to get a reliable estimate of
structural behaviour a reliable fire model is required. Often, designers will impose the Standard Fire
(hydrocarbon, cellulosic etc) on the structure. This may meet any regulatory requirements but it
can never model reality. In any real fire scenario, the heat flux impinging the structure will be
different from place to place and will vary in time. Imposing the Standard Fire will not allow effects
due to temperature differences to be modelled.

6.4.4.3 CFD

Computational fluid dynamics (CFD) can potentially predict the growth and movement of air,
smoke, and flame. CFD is probably more complex than structural mechanics and although,
researchers have been working on CFD for many years it is still in its infancy. In building design, it
is used to predict smoke movement but many think it is not particularly good at predicting pre-
flashover fires. This should be less of a concern for any form of hydrocarbon fire as the pre-
flashover phase will be less significant.

At present, the above cautionary advice for structural modelling, applies even more to CFD
modelling. Knowledge of fire and an understanding of what a particular package is doing are
paramount.

6.4.4.4 Eurocode requirements for advanced models

The structural Eurocodes all contain similar advice on using advanced models. The relevant parts
are summarised below:

The analysis should include:

• The effects of non-linear material properties, including the effects of unloading on
the structural stiffness and the effects of cooling;
• Validation of advanced calculation models;
• The validity of any advanced calculation model shall be verified;
• A verification of the calculation results shall be made on basis of relevant test
results;
• The critical parameters shall be checked, by means of a sensitivity analysis, to
ensure that the model complies with sound engineering principles.

152-RP-48 Rev 02, Feb 2006 Page 171 of 261

fireandblast.com

Some of these requirements may appear to be very severe. It is recommended that they need not
be followed for every structure analysed but they do emphasise the need to use validated software.

6.4.5 Definition and assessment of secondary steelwork

In deciding which structural members need to have their performance checked in fire the required
performance for the structure for each particular limit state must be considered. All primary
elements of structure will need to be assessed and will probably require some form of fire
protection. A secondary member is one which, for the particular fire limit being considered, will not
cause failure of a primary member or loss of compartmentation by its removal. All secondary
members require assessment but may not require protection.

For example, a secondary beam, spanning between larger primary beams and supporting a plated
floor may be sacrificial in fire. For the fire scenario under consideration, deformation of the floor
may be unimportant. A steel plated floor system will often be able to act as a membrane and not
require additional support. The beam may not be critical for giving restraint to the primary beam.
However, in a severe fire heat may be conducted along an unprotected beam into the primary
beam and thus reduce the fire resistance of the primary beam. For practical reasons it might be
better to protect the entire secondary beam rather than simple coating the ends.

Secondary members, which when cold, restrain a primary member may require fire protection to
continue fulfilling this function when hot. However, experience has shown that at the reduced
applied loads in fire, the restraint may not be necessary. For example, loads may be resisted by
membrane action and the restraint may not be required. It is important to consider that it does not
follow that a member which carries load will always be required in fire. The function of all members
should be looked at. Only members which may fail or deform in fire leading to a performance
requirement not being met should be considered for protection.

Simple design methods are not able to provide information on whether secondary members require
special consideration. Only a full non-linear FE analysis will provide this information.

6.5 Attachments and coat-back

An unprotected secondary member attached to a protected primary member will allow heat to be
conducted into the primary member and may reduce its fire resistance. Most operators’
specifications require a length of any attachment to primary steelwork protected with passive fire
protection to be similarly protected.

The attachment acts as a heat conductor into the primary steelwork. Hence, it can introduce a
localised hot spot at its connection with the primary member. The extent of the hot spot depends
on the relative geometries of the primary member and the attachment. The purpose of the coat-
back is to reduce heat conducted through the attachment into the primary member and hence limit
the extent and severity of the local hot spot. In this way, the potential of premature failure can be
avoided. The coat-back length needs to be adequate to achieve this objective.

A joint industry study [6.21] of the effects of coat-back on the primary member temperature
demonstrated the following:
• The required coat back length should be determined based on the local average
temperature which can be tolerated in the primary member at the attachment
location. As the coat-back temperature increases this temperature reduces.
However, beyond 150 mm, any further reduction is small.
• The ratio of the cross sectional area of the attachment to that of the primary member
was found to have a significant influence on the temperature. The ratio of the
section factors (Hp/A) has secondary significance.

152-RP-48 Rev 02, Feb 2006 Page 172 of 261

fireandblast.com

• The effect of the attachment on the temperature increased with increasing fire
resistance period. Thus, to maintain the same temperature in the primary member a
longer coat-back length would be required for a 2 hour duration than for 1 hour.
• Within the limits of the study, it was found that the section shape (of both the primary
member and attachment) had negligible effect.
• The properties of fire protection material have a small effect on coat-back length.

6.6 Process responses

6.6.1 General

A key requirement for any design is knowledge of the quantity, composition and properties of the
fluids to be processed and of the associated operating conditions (temperature, pressure, flow rate
etc.). The section is primarily concerned with the response of pressurised systems to fire. In a fire,
a pressurised system (e.g. vessel, pipeline or heat exchanger) will fail through weakening of the
containment material with temperature and time and/or over-pressurisation caused by heating up
the fluid contents. Generally, offshore systems are fitted with pressure relief systems to prevent
over-pressurisation and blowdown systems to prevent loss of containment. Relief systems
automatically release the contained fluid if the fluid pressure within the system exceeds the
system’s lowest design pressure. These systems usually consist of relief valves or bursting discs
and they are designed to initiate at the set pressure without the intervention of the operator.
Blowdown systems are mechanisms for release of the vapour content from the system as a result
of operator action or as part of automatic control sequences. A system is normally blown down as
part of a planned shutdown or an emergency such as a fire that may weaken a plant component so
that it fails below the relief system set pressure. In both relief and blowdown systems, it is
necessary to dispose of the fluid safely, usually by burning it in a flare stack or venting to
atmosphere.

There are numerous references that discuss relief devices and relief sizing; examples are Parry
(1992) [6.22], Diers (1992) [6.23], CCPS (1998) [6.24], HSE (1998) [6.25] and Energy Institute
(2001) [6.26]. Roberts et al. (2000) [6.27] have reviewed the literature available (up to 2000) on the
response of pressurised process vessels and equipment to fire attack in regard to the new data
available since publication of the IGNs [6.28] and the remaining gaps in knowledge.

6.6.2 Relief

Traditionally, API 520 (2000) [6.29] has been used to size pressure relief valves for non-reactive
systems using heat inputs derived from the fourth edition of API 521 (1997) [6.30]. These heat
inputs have not been changed in the fifth edition of API 521 (2005) [6.31] although it is now
recognised (e.g. Energy Institute, 2003) [6.32] that more severe fires can occur than those
assumed by API. It should be recognised that pressure relief will not protect a vessel or pipeline
from failure if there is a high heat load to wall in contact with gas or vapour is this will rapidly heat
up to a temperature where the steel weakens. However, if the vessel/pipeline can be prevented
from failure due to weakening, e.g. by PFP (or deluge although it is not currently taken into
account), then the pressure relief valve can be effective under fire loading providing that the
possibility of two-phase flow is adequately considered. There are a considerable number of
standards for relief valve sizing e.g. API 520 [6.33], API 2000 [6.34], NFPA 30 [6.35] and NFPA 58
[6.36] (for LPG) and ISO 4126 [6.37]. These are reviewed by the Energy Institute (2001) [6.38] and
recommendations are made, based on experimental data, for the safe and optimum design of relief
systems. Their publication also goes into detail on which is the most appropriate relief device for
the different situations. In particular, they consider the advantages and disadvantages of using:
• Conventional spring-loaded relief valves;
• Balanced relief valves;
• Air assisted relief valves;

152-RP-48 Rev 02, Feb 2006 Page 173 of 261

fireandblast.com

• Buckling pin valves;

• Bursting discs; and
• High integrity pressure protection systems.

They provide advice on relief system design, sizing of relief system systems and design of flare
and vent systems. In general, the recommendations complement those of API 520 and API 521
but, in the specific case of two-phase discharge, they suggest that the API method may not be
adequate, particularly in the case of high-pressure discharge. This conclusion is based on
experiments (described in an appendix [6.38]) involving the two-phase discharge of mixtures of
natural gas, propane and condensate through orifices and relief valves.

6.6.3 Relief sizing

The method of relief sizing depends on the nature of the fluid being relieved. API 520 (Part 1) and
API 521 give equations to calculate the discharge areas for pressure relief devices on vessels
containing super-critical fluids, gases or vapours and for non-flashing liquids. The Energy Institute
(2001) have reviewed these equations and suggest that they give similar results to BS 6759 [6.39]
and ISO 4126 [6.40] and hence any of these standards may be used.

On the basis of comparisons with experimental data, the Energy Institute (2001) suggest that the
homogeneous equilibrium model (HEM) gives the best predictions for two-phase relief flows and is
preferred to the API method. They suggest that the HEM method deals naturally with cases where
the flow upstream is gaseous and where condensate is formed. These cases may not be
calculated accurately with the API method. Since both the API method and the pure HEM method
involve flash calculations, they consider that there is little benefit from the simplification
represented by the API method. The Energy Institute gives details of application of the HEM
method. Whilst the HEM method for two-phase relief has been validated by tests, there is still no
recognised procedure for certifying the capacity of pressure relief valves in two-phase service.

6.6.4 Blowdown

The emergency depressurisation of process vessels is complex and the behaviour of the process
vessel during depressurisation varies depending on the vessel contents and the conditions of the
vessel. During depressurisation at ambient temperature, the temperature of the vessel may drop
dramatically as the contents are released, leading to the need to consider the minimum design
temperature requirements of the vessel. At the same time, however, if the vessel is exposed to an
engulfing fire, the behaviour of the vessel will be very different and the pressures and temperatures
experienced will significantly differ from those normally considered. The design of depressurisation
systems must therefore address both the depressurisation and also the characteristics of any
impinging flame, which may be the cause of the emergency depressurisation.

The Energy Institute (2003) performed a survey of methods used by industry for protection against
severe fires and, from the responses and information received, concluded that:
• There is little consistency in the design methodology used, even within a single
company;
• Some said they had limited in-house expertise and engaged a specialist design
contractor; and
• Some applied API RP 521 (1997) and assumed that by designing to that code, the
risk was adequately addressed.

The new version of API RP 521(2005) recommends that a vapour depressurising system should
have adequate capacity to permit reduction of the vessel stress to a level at which stress rupture is
not of immediate concern. For sizing, this generally involves reducing the equipment pressure from
initial conditions to a level equivalent to 50 % of the vessel design pressure within approximately
15 minutes. This criterion is based on the vessel wall temperature versus stress to rupture and
152-RP-48 Rev 02, Feb 2006 Page 174 of 261
fireandblast.com

applies generally to carbon steel vessels with a wall thickness of 25 mm or more. Vessels with
thinner walls generally require a somewhat greater depressurising rate. It should be noted the
blowdown systems are designed for vapour only flow. If the rate of depressurising is increased,
there is an increased likelihood of two-phase flow occurring with consequences to the method of
sizing calculation used and the need for the knockout pot in the flare header to be sized for this
two-phase flow. The required depressurising rate depends on the metallurgy of the vessel, the
thickness and initial temperature of the vessel wall, and the rate of heat input. For multi-component
fluids, these need to be calculated over a series of time intervals that adequately take into account
changes in the nature of the fluid, e.g. the latent heat of vaporisation. The recommendations in
API 521 are typical for conditions in a refinery or chemical plant. However, they are not intended to
cover all fire scenarios, e.g. impinging jet fires or confined fires, foreseeable for offshore
installations.

Gayton and Murphy (1995) [6.41] suggest that in more severe fires, rupture can occur well within
the 15 minute criterion used by API. Roberts et al. (2000) [6.42] discuss application of the Shell
BLOWFIRE program to give vessel wall temperature-time relationships as input to the ANSYS
finite element program predicting thermal mechanical response of a second stage separator with a
wall thickness from 16 to 20 mm. The BLOWFIRE predictions were that after an initial pressure
drop on opening, the pressure could then increase and the ANSYS programme suggested that
failure could occur at 6 minutes. It was suggested that the worst case might be partial fire
engulfment where local heating of the shell causes local material expansion and the expanding
material pushes against colder, unheated sections, leading to premature buckling and an
increased probability of failure. The general implication is that process plant fitted with protective
systems designed to API RP 521 or a similar standard may be insufficient to prevent failure of the
pressure system before the inventory has been safely removed in a severe fire.

6.6.5 Blowdown system design

As indicated above, the API 521 approach to the design of blowdown systems covers most of the
key aspects but may underestimate the heat load in some credible offshore fire scenarios and may
not be accurate if there is two-phase flow. The Energy Institute (2001) [6.43] recommend that the
Gayton and Murphy [6.44] “fire risk analysis” approach is adopted to at least confirm the expected
thermal loads and that the HEM method is used if two-phase flow is anticipated. The Energy
Institute (2001) summarised the Gayton and Murphy approach.
1. For each item of equipment, define the type of fire (pool, jet, partial or total engulfment)
likely to affect it.
2. Calculate the rate of heat input appropriate to that type of fire.
3. Calculate the rate of temperature rise of the vessel wall neglecting heat transfer to the
contents. This simplification is appropriate for jet or other fires, which might affect only a
small area of the vessel. More complex methods can allow for heat transfer to the contents.
4. Estimate the time to vessel rupture. From this temperature-time profile prepare a yield –
stress-time profile and a corresponding rupture pressure-time profile. Compare this to the
actual pressure vessel versus time for the required blowdown time.
5. If the time to rupture does not meet the established safety criteria (such as time to
evacuate), then design changes may be necessary to improve the vessel protection. These
may be a reduction in blowdown time, or application of fire protection insulation, or changes
to the plant layout to reduce the fire exposure.

The information given in this (UKOOA/HSE) guidance allows the simplified vessel wall approach to
heat transfer to be followed but, if heat transfer to the contents is taken into account, sophisticated
modelling is required. However, whilst there are validated models for blowdown under ambient
conditions (e.g. BLOWDOWN; Haque et al., 1992 [6.45]), there appears to be no experimental
data on blowdown under fire loading and hence there are no validated models. However, LPG tank
pool fire (Moodie et al., 1998 [6.46]) and jet fire data (Roberts and Beckett, 1996) [6.47] has been
used to partially validate models, e.g. BLOWFIRE, that are designed to cover a range of discharge

152-RP-48 Rev 02, Feb 2006 Page 175 of 261

fireandblast.com

devices i.e. the models have been used to predict the pressure relief results. API (2005) and the
Energy Institute (2001) give the equations for calculating the blow down orifice.

In 2003, the Energy Institute published interim guidelines for the design and protection of pressure
systems to withstand severe fires. In this, the heat transfer to the vessel is split in terms of radiative
and convective fractions and the heat transfer to the vessel contents is discussed in a similar way
(see Section 5.5). They give an iterative procedure based on calculating, for each process
segment (isolatable section) and each time step:
1. Pressure;
2. Temperature in all fluid phases;
3. Fluid composition in each phase;
4. Flow rate through the orifice;
5. Liquid levels;
6. Temperature in the metal;
7. Temperature downstream of the orifice;
8. Heat transfer at all interfaces; and
9. Stresses to which the pipes and equipment are exposed.

These are related to the:

• Acceptance criteria for failure;
• Given total capacity of the flare system;
• Method for initiating depressurisation (manual or automatic); and
• Time delay for initiation of depressurisation.

The Energy Institute approach is based on that of Hekkelstrand and Skulstad (2004) [6.48]. They
have refined their approach with the emphasis on using fast depressurisation making the maximum
use of the flare stack capacity and on minimising the use of passive fire protection.

6.6.6 Failure criteria

In order to know what measures to take, if any, in protecting an object against fire, it is necessary
to know the maximum acceptable temperature of the object and the minimum allowable time to
reach this temperature. Different references suggest different critical temperatures. Some of those
in most common use are summarised in Table 6-6.

152-RP-48 Rev 02, Feb 2006 Page 176 of 261

fireandblast.com

Table 6-6 Commonly used critical temperatures

Temperature Use Source Criterion

(Celsius)

550 - 620 Structural steel ASFP, 2002 (BS Temperature at which fully stressed carbon steel
onshore 5950) loses its design margin of safety
427 LPG tanks (France API 521 (1997) Based on the pressure relief valve setting
and Italy)
400 Structural steel ISO 13702, Temperature at which the yield stress is reduced
offshore 1999 to the minimum allowable strength under
operating loading conditions
300 LPG tanks (UK and LPGA CoP 1, Integrity of LPG vessel is not compromised at
Germany) 1998 temperatures up to 300 ºC for 90 minutes.
200 Structural ISO 13702, Temperature at which the yield stress is reduced
aluminium offshore 1999 to the minimum allowable strength under
operating loading conditions
180 Unexposed face of ISO 834 BS 476 Maximum allowable temperature at only one
a division point of the unexposed face in a furnace test
140 Unexposed face of ISO 834 BS 476 Maximum allowable average temperature of the
a division unexposed face in a furnace test
45 Human skin Hymes et al., Pain threshold
1997
40 Surface of safety ISO 13702 Maximum temperature at which control system
related control will continue to function
panel

Failure of a steel component will occur at the time at which the superimposed stress exceeds the
material strength and/or deformation limit. Knowledge of the time to failure is critical in deciding on
the remedial methods to be applied to delay failure. The time to failure of a vessel or pipe work
depends on the severity of the fire, the extent and type of fire protection, and the pressure
response and can vary between a few minutes and a few hours. The Energy Institute (2003)
considered three calculation methods:

• Ultimate Tensile Strength (UTS) with a safety factor;

• Flow stress (combining UTS and elongation stress); or

• Creep rupture stress (where both temperature and time are taken into account).

In theory, the most appropriate failure criterion is the creep rupture strength, rather than the tensile
strength since, as the time to rupture goes to zero; the creep rupture strength becomes equal to
the tensile strength. However, in view of the complexity of creep rupture calculations (see, for
example, Benham et al., 1996 [6.49]), tensile failure criteria are often used. In severe fires, the rate
of temperature rise in the wall above the liquid level or in a gas/vapour only system is very high (of
the order of 100 to 200 K min-1 depending on the steel thickness) and the material strength falls
rapidly once the temperature exceeds 500 °C. In these circumstances, where the time involved is
very short, the use of UTS may be acceptable if used with an appropriate safety factor. However,
BS 7910 (1999) [6.50] suggests that the proximity to plastic collapse should be assessed by
determining the ratio of the applied stress to the flow stress, where the flow stress is defined as the
average of the yield and tensile stresses. Use of a flow stress of the average of, say, the 0.2 %
elongation stress and the UTS would be a more conservative measure. However, if the rate of
temperature rise is much slower, e.g. with a system protected by PFP, it is more appropriate to use
the creep rupture stress. No consensus was reached within the Energy Institute working group on
which method of assessing stress is the most appropriate for response to severe fires. It was
152-RP-48 Rev 02, Feb 2006 Page 177 of 261
fireandblast.com

stated that the ambiguity remains because of the lack of validation data. Offshore vessels tend to
be of a more complex design than storage vessels and will have stress raisers such as:
o Different thicknesses of material;
o Inlet and outlet connections with constraining piping, manways etc;
o Different types of weld materials and configurations;
o Reaction forces during emergency depressurisation;
o Vapour-liquid interface.

The Energy Institute states that it is not clear which of these features are critical in assessing
failure or to what degree, if any, current failure criteria are conservative. Experiments are required
to assist in the validation of models intended to assess such features. Unless the failure criteria are
properly set, it is difficult to see how time to failure or realistic blowdown rates can be properly set.

In 2004, Salater and Overa [6.51] presented data from jet fire trials (170 – 190 kW m-2 incident
heat flux) on pipes pressurised with nitrogen to 85 to 90 % of their design pressure. The
experiments were aimed at taking the pipes to failure and determining the failure criteria that most
closely represented the results. They use Equation 5-7 to model the heat transfer to the pipe
and found good agreement with the measured values for small pipes but found that the model
overestimated the temperatures above 600 ºC for 250 mm pipes. It was found that pipe failure was
adequately predicted by comparing the equivalent stress (von Mises) with the UTS. However, they
emphasise that the pipe corrosion allowance should not be used when making the calculations and
that good high temperature UTS data is needed. Hekkelstrand and Skulstad (2004) [6.52] have
incorporated these results in the latest edition of their guidelines. They imply that the method may
be applicable to pressure vessels containing vapour and liquid but the complexities identified
above are not explicitly considered. They also provide some data on the high temperature
properties of steels. Data is also available by Burgan (2001) [6.53] and Billingham et al. (2003)
[6.54].

A range of assessment criteria and methods for the design of piping systems and supports against
fires and explosions has been developed by SCI and published by the HSE, [6.55]. In addition to a
range of simplified assessment methods, the document advises that non-linear finite element
analysis permits the rupture calculations of a piping system to be based on more accurate methods
which accounts for the reserve strength inherent in many design codes. It also overcomes the
approximations that have been identified with the use of simplified methods.

6.6.7 Performance standards

6.6.7.1 General

Use of performance standards came to prominence following issue of the Prevention of Fire and
Explosion and Emergency Response Regulations (PFEER, [6.56]) and UKOOA Fire and Explosion
Hazard Management Guidelines [6.57] in 1995. Performance standards are closely related to:
• Engineering Acceptance Criteria;
• Rule sets used in Quantitative Risks Assessments (QRA); and
• Design Accidental Loads (DALs).

The use and interrelationship of these are considered in this section.

According to the PFEER regulations [6.58], “a performance standard is a statement, which can be
expressed in qualitative or quantitative terms, of the performance required of a system, item of
equipment, person or procedure, and which is used as the basis for managing the hazard, e.g.
planning, measuring, control or audit, throughout the lifecycle of the installation”.

There are two levels of performance standards:

152-RP-48 Rev 02, Feb 2006 Page 178 of 261
fireandblast.com

• High level performance standards are applied to the installation as a whole or to the major
systems that comprise the installation. These are the goals for safety of the installation and
relate to overall risk to persons on the installation. These standards are verified from the
results of assessments of low level performance standards. High level performance
standards are normally risk-based. For example, HSE use [6.59, 6.60] the following:
1. An unacceptable risk is one where the individual risk of a fatality is 10-3 per year or more for
a worker or 10-4 per year or more for a member of the public.
2. A broadly acceptable risk is one where the individual risk of a fatality is 10-6 per year or
less.
3. A tolerable risk is deemed to exist in the range between 10-3 and 10-6 per year for a worker.
All tolerable risks must be demonstrated to be as low as is reasonably practicable (ALARP).
• Low level performance standards are used to describe the required performance of lesser
systems, which may contribute to the high level performance standards. Performance
standards at this level relate to the principal safety critical systems used to detect, control
and mitigate the major hazards. The selected systems should make a significant
contribution to the overall acceptability of the hazard management arrangements. The
performance standards should be directly relevant to the achievement of the system goal
and the performance standards should be expressed in terms that are verifiable.
• An important principle in setting performance standards is that the number and level of
detail should be commensurate with the magnitude of the risk being managed.
• Typically, the lower level performance standard for the resistance of pressurised systems to
fire attack would be that isolation, depressurising and fire protection systems are functional,
fit for purpose and available on demand.

Requirements and guidelines for the control and mitigation of fires and explosions on offshore
production installations are given, and an approach used that is similar to the UK performance
standards approach [6.61]. This reference states that, in the process of fire and explosion
evaluation and risk management, any risk reduction measures should be recorded so that they are
available for those who operate the installation and for those involved in any subsequent change to
the installation. For this record, the reference uses the term “strategy”. Two strategies are
introduced, namely a Fire and Explosion Strategy and an Evacuation, Escape and Rescue
Strategy. The strategies should describe the role and any functional requirements for each of the
systems required to manage possible hazardous events on offshore installations. The functional
parameters (integrity, reliability, availability, survivability and dependency), and the associated
specifications, are equivalent to the performance standards approach in the UK safety legislation.

6.6.7.2 Engineering acceptance criteria

Typically, the engineering acceptance criteria for a pressurised system to resist fire attack would
be that stresses, deformations and/or temperatures remain below values that would compromise
the integrity of the system. The criterion given in the API RP 521 aims to achieve this by
depressurising the system at a recommended rate. However, this may be inappropriate and
inadequate for offshore installations, for which it was not originally intended.

6.6.7.3 Design accidental loads

Design Accidental Loads (DAL) are loads for those accidental events where the associated risks
exceed the risk tolerability criteria. Therefore, the designed facility should successfully resist the
DAL. This would require a lengthy iterative approach whereby a QRA is carried out first to identify
those events and loads that cause the exceedance of risk tolerability criteria. Therefore, an
approximate approach has been used which defines DAL as being associated with those events
that have the order of magnitude of initiating frequency greater or equal to the tolerable outcome
frequency. For example, when the tolerable outcome frequency is 5 x 10-4, the DAL are those
loads with the initiating event frequency of 10-4 and higher.

152-RP-48 Rev 02, Feb 2006 Page 179 of 261

fireandblast.com

The requirements for successful resistance of a facility to DAL are expressed in the form of
performance standards. Typically, the performance standard would state that a pressure vessel
should survive and remain functional during a postulated fire scenario. Again, in the terms of
engineering acceptance criteria this means that applied stress in the vessel is not to exceed a
defined allowable stress throughout the duration of a fire and thereafter.

6.6.7.4 Link between engineering acceptance criteria and QRA

As implied by the above, the link between engineering acceptance criteria related to pressure
systems and QRA may be made using the following approach:
o Rule sets in a QRA are set to reflect the standards to which safety critical systems are to
perform, e.g. no escalation of the initial fire event in an area.
o This rule set assumes that isolation and depressurising systems, and a dedicated deluge
cooling system are functional, available on demand and survive the initial fire
(performance standards).
o The systems are designed to meet the normal engineering acceptance criteria for stress,
deformation, temperature etc.
o DALs are determined for the systems whose risk, calculated by QRA, exceeds the risk
based performance standards.
o The pressure systems are redesigned to resist the DALs.

Before formal industry guidance could be given on such links, guidance is needed on the rule sets
to use in QRA, the determination of DALs and appropriate engineering acceptance criteria.

6.6.7.5 Overview

Performance standards related to the resistance of pressurised systems to fire attack depend on
having robust engineering acceptance criteria and a robust method to determine if these are met.
At present, these do not exist. Quantitative Risk Assessment is used to confirm that high level
performance standards are achieved, and the QRA rule sets also depend on having robust
engineering acceptance criteria. Design Accidental Loads are determined for the risks calculated
by the QRA that exceeded the risk based performance standards and the facility is designed to
resist these DALs. Guidance is needed on the rule sets for use in QRA, the determination of DALs
and appropriate engineering acceptance criteria and on how these linked together.

6.7 Personnel
6.7.1 General

Fires have the potential to cause severe harm and death to personnel offshore as a result of the
evolution of both heat and toxic combustion products. This potential is present both in the
immediate vicinity of the fire but also through transport of hot products at remote locations through
the action of buoyancy and wind. Inhalation of toxic and irritant smoke is the largest single cause of
fatalities in both onshore and offshore fires.

The objective of any system to mitigate the effects of fire on personnel must be to remove the fire
hazard either through fire extinguishment, reduction of the received insult or separation of
personnel and fire hazard.

This section outlines the main issues to be considered in defining and quantifying the fire hazard
effects on personnel offshore and what preventive measures may be available to a designer to
minimize this hazard.

152-RP-48 Rev 02, Feb 2006 Page 180 of 261

fireandblast.com

6.7.2 Characteristics of fires relevant to human response

6.7.2.1 Hazards of fire to personnel

The fires which can occur offshore are many and varied. The major concern lies with the process
fluids themselves. These can give rise to fireballs, vapour cloud, jet, or pool fires. However, other
fuels are present on the plant such as plastics, hydraulic fluids, cabling, seals, paints, etc. These
may become involved in the later stages of a process fluid fire or be the main fuel consumed.
General fires, not specific to the chemical process industry or offshore, involving the structure and
contents in the accommodation, control rooms and other occupied buildings on the installation
must also be considered.

All these fires produce heat in the form of radiant and convective fluxes. In particular exposure to
high radiant heat fluxes can produce severe burns to the skin and even ignite clothing. Smoke is
also produced. Here smoke is taken to comprise the airborne solid and liquid particulates and
gases evolved when a material undergoes pyrolysis or combustion together with the quantity of air
entrained or otherwise mixed into the mass. Smoke contains a complex mixture of:
a. Asphyxiant gases such as carbon monoxide and hydrogen cyanide which cause
partial/full incapacitation and death:
b. Irritant products (gases and aerosol) which at low and medium exposures cause
partial incapacitation thus hindering evacuation, while at high exposures may lead to
delayed death. The main irritants are acid gases for example hydrogen chloride and
low molecular weight aldehydes such as acrolein and formaldehyde. These
materials attack the eyes and respiratory tract:
c. Particulates sometimes referred to as soot. These particulates may be either non-
irritant or irritant. In the former case vision is obscured making way finding difficult,
while the latter, as well as impairing vision, can also again act as an irritant to the
eyes and respiratory system. Both make evacuation from the scene of the fire more
difficult.

The combustion product plume will also be at elevated temperature. Movement beneath or within a
smoke layer may result in exposure both to radiant and convective heat fluxes. Such exposure
may give rise to hyperthermia and skin burns while inhalation of hot products may result in burns to
the respiratory system.

Finally the lack of oxygen in the fire plume may induce a condition known as hypoxia. This can
cause dizziness and ultimately loss of consciousness.

Movement of a smoke plume around the installation under the combined influence of the wind and
inherent buoyancy must also be considered since its influence may extend beyond the immediate
vicinity of the fire. The potential for smoke movement must always be considered; particularly when
the identification and design of escape routes and muster points is undertaken. This is a difficult
area which can only be approached using models based on computational fluid dynamics or
physical modelling. Experience with the applications of both these techniques to smoke movement
remains however very sparse and the conclusions should be treated with caution.

6.7.2.2 Specification of fire hazards

The heat hazards from a fire are expressed in terms of heat flux and temperature. Thus the
dimensions, shape and surface emissive power of the flame can be used to compute a received
radiant heat fIux generally in kW m-2 to personnel in the vicinity. The temperature and emissivity of
the combustion gases allows specification the thermal environment to which personnel might be
exposed if they must enter the fire plume.

In general the production of toxic and irritant species in a fire is expressed as a yield - the amount
generated per unit mass of fuel burned. This product is then mixed with air entrained into the fire

152-RP-48 Rev 02, Feb 2006 Page 181 of 261

fireandblast.com

plume and the hazard of asphyxiant and irritant gases and liquid irritants is expressed as a
concentration in air, either in volume or mass terms as ppm or mg l-1 respectively.

There does not appear to be a standard form for specifying the smoke hazard. Several may be
encountered. It can again be quantified as a mass concentration of product in the fire plume or
alternatively in terms more closely related to the hazard presented by smoke - a loss of visual
capability. Some parameters used include visibility – the distance in metres at which unilluminated
objects can be seen through smoke, an obscuration (%) – the amount of attenuation of light over a
given path, or an optical density. The latter is alternatively defined in terms of either natural (De) or
common (D10) logarithms:

De = -loge(I/I0) = KCL .................................................................... Equation 6-1

D10 = -10log10(I/I0) = (10/2.303) KCL.............................................. Equation 6-2

Where

I and I0are the light intensities with and without smoke,

C is the mass concentration of particles,

K is the specific extinction coefficient, and

L is the path length through the smoke.

K is a property of the type of smoke and depends on its size distribution and optical properties.
There is limited data available though some measurements for flaming and non-flaming fires
involving plastics suggest figures of 7.6 and 4.4 m2 g-1 (Mulholland, 2002) [6.62]. The product of K
and C is known as the extinction coefficient and has dimensions of m-1.

It has been shown that the optical density expressed as a unit path length (D10/L (dB m-1))
correlates reasonably well with general visibility through smoke with an optical density of 1 dB m-1
corresponding to a visibility of ~10 m. Smoke production is often specified in terms of the volume in
m3 s-1 of unit optical density smoke issuing from a fire.

A further smoke measure often quoted is the mass optical density, Dm. This is more easily
measured in experimental tests and is related to the optical density measured in a volume flow of
combustion products V, resulting from a mass loss of smoke producing material ∆M:

Dm = D10 V / 10 L ∆M ..................................................................... Equation 6-3

Mullholland [6.62] has tabulated existing data on Dm from various materials.

6.7.2.3 Typical hazard levels offshore

Two distinct types of fire are likely to occur offshore. The majority will result from releases of
process fluids and involve flammable liquids and gases. These will be characterized by an absence
of growth and decay phases so that they will reach their full potential output soon after ignition but
most will occur in well-ventilated open conditions. Hence the general levels of toxic species and
smoke production will be low. Indeed some fires, for example methanol and natural gas will
produce little if any smoke. The major hazards from these fires will result from the high heat fluxes
generated.

The exceptions to such a rule are large pool fires involving the heavy hydrocarbons such as crude
oil, which may produce copious quantities of dense smoke and the situation of significant
confinement which restricts ventilation. In these circumstances – vitiated fires - the lack of oxygen

152-RP-48 Rev 02, Feb 2006 Page 182 of 261

fireandblast.com

in the combustion zone results in an increase of incomplete products of combustion including

carbon monoxide and smoke. Tewerson (2002) [6.63] has summarized current knowledge on the
rates of species production from the combustion of a wide range of materials including some
simpler hydrocarbons and solid building materials. This provides a useful compendium of
information, particularly for well-ventilated fires. Tewerson also noted that the levels of species
production for under-ventilated confined fires can be parameterized in terms of the equivalence
ratio, defined as the fuel air ratio relative to stoichiometric conditions and has presented data which
suggest that for solid phase fires the rates of production of incomplete products may increase by
factors of ~5-10 over the well-ventilated situation. Thus Chamberlain [6.64] measured
concentrations of oxygen, carbon monoxide and smoke of 12 %, 2 % and 2.0 g m-3 respectively for
confined jet fires where for such fires without containment carbon monoxide concentrations <0.1 %
might be expected.

Both experimental and theoretical studies have focused on the heat hazards from such fires and
there is considerable data on such issues (see for example Sections 5.2.4 and 5.2.5). There are
little data on the typical species output levels for fires involving offshore process fluids.

Fires offshore may also involve solid phase fuels. These are present in a wide range of locations.
They may include cabling, seals, building materials and building contents including accommodation
modules and control buildings. Some of these materials have the potential to produce heavy yields
of smoke, toxic and irritant products, for example aromatic polymers such as polystyrene and
polyurethane foams. Such fires are likely to conform to the general character of compartment fires
observed onshore with distinct initiation and growth phases leading to flashover and a fully
developed fire.

From the toxic hazard viewpoint there are a number of specific fire types which may occur in
isolation or as stages during the course of a developing compartment fire which are of particular
concern and which specific toxic threats. These are non-flaming fires which occur during the
initiation phase of a fire.
• Flaming fires which are characterized by rapid growth.
• Small flaming vitiated fires which may occur if a fire does not grow to flashover as a result
of lack of ventilation.
• Fully-developed or post flashover fires.

A classification of the toxic hazards represented by these fire types is summarized in Table 6-7.
These will vary with the fuel involved, particularly the mix of irritants and the level of smoke but can
be taken as a general guide.

152-RP-48 Rev 02, Feb 2006 Page 183 of 261

fireandblast.com

Table 6-7 Summary of toxic hazards presented by solid phase fires

Fire Rate of growth CO2/CO ratio Toxic hazard Temperature

Non-flaming/ smouldering Slow ~1 CO 0-1500 ppm 400 °C

O2 15-21%
Irritants
Little smoke
Small flaming Rapid 1000 down to 50 CO 0 –1%
CO2 0-10%
O2 10-21%
Irritants, heat, smoke
Small vitiated flaming Rapid then slow <10 CO 0.2-4%
CO2 1-10%
O2<12%
Irritants, heat, smoke
Fully-developed/post flashover Rapid <10 CO 0-3% 800 °C
HCN 0-500 ppm
Irritants
High temperatures
Dense smoke

6.7.3 Harm criteria

6.7.3.1 The developing hazard from the fire

The influence of any developing fire on potential victims can be considered in three phases:
• The first comprises a period when the fire is growing but before the victim is affected by
the stimuli from the fire - heat and smoke. During this phase the victim has the full
capacity and opportunity to escape and the main factors determining survival are
concerned with detection and response to alarms.
• The next phase is the period of exposure to heat and smoke. The effects of increasing
exposure to heat and toxic products increasingly hinder a victim’s escape capability and
induce growing incapacitation. Escape will become increasingly problematic. At some
stage a stage of full incapacitation will be reached.
• The third phase will result from prolonged exposure to heat and combustion products
and will result in serious injury or death.

Hydrocarbon fires involving process fluids may not exhibit the first of these phases. From this
analysis four major stages can be identified. The times at which these stages are reached are
critical to an individual’s survival.

a) Time to and level of partial incapacitation. The onset of partial incapacitation

hinders escape, reducing an individual’s evacuation speed increasing exposure
to fire and the chance of more serious consequences.

b) The time at which onset of full incapacitation occurs is important since it

removes any chance of self-rescue. The individual is then entirely dependent on
outside assistance.

c) The time for occurrence of serious injury.

152-RP-48 Rev 02, Feb 2006 Page 184 of 261

fireandblast.com

d) The time at which death occurs.

6.7.3.2 The process by which occupants escape

The is dependent on factors such as detection, provision of alarms, response to alarms, length and
design of escape routes, age profile of the population, level of training, knowledge of the
environment and physiological response to exposure to heat and smoke. Again these factors can
be expressed in terms of characteristic times. Thus there is a time to detection of the fire, a pre-
movement time before escape action begins and a time to reach a place of safety determined by
the length of the evacuation route and the evacuation speed.

6.7.3.3 Outcome of an evacuation

The outcome of any evacuation depends on the manner in which the hazards develop (as outlined
in Section 6.7.2.1). A successful evacuation requires that;

tu < te ............................................................................................ Equation 6-4

Here tu is the time from the start of the fire at which conditions become untenable. This may be the
time for full incapacitation should external rescue not be possible or the time to serious injury or
death if external intervention is available. te is made up of a sum of various component times. For
example:

te = td + tpm + ts ............................................................................. Equation 6-5

where

td is the time to detect the fire,

tpm is the pre-movement time and

ts is the time required to attain a place of safety or removal of the fire hazard.

6.7.4 Human response to fire effects

6.7.4.1 Effects of heat

6.7.4.1.1 General

A number of reviews have been produced adequately summarizing the basis of radiative transfer
relevant to hazard analysis and the hydrocarbon processing industries, for example Lees (1996)
[6.65] and Beyler (2002) [6.66]. Others have concentrated on the effects of radiation on humans.
Thus Hymes et al (1996) [6.67] has produced a comprehensive study, Hockey and Rew (1996)
[6.68] have examined Human vulnerability to radiation for hazard analysis used in onshore
situations and O’Sullivan and Jagger (2004) [6.69] have looked specifically at the offshore situation
to identify suitable injury criteria. These provide suitable methodologies for computation of the
radiation received from flames and assessment of its effect on man.

Significant casualties resulted from exposure to radiation during the Los Alfraques Campsite and
Lowell Gas Company incidents

6.7.4.1.2 Radiative transfer

This depends on the source and the intensity of radiation falling on the target. The former can be
specified in terms of the flame shape and dimensions and the total radiated energy or its surface
emissive power. The latter can be computed using a suitable model (Beyler, 2002 [6.70]). The
simplest of these is the point source model which approximates the flame by a point source located
152-RP-48 Rev 02, Feb 2006 Page 185 of 261
fireandblast.com

at the actual centre of the real flame. The target is then regarded as located on a sphere with a
radius given its distance from the flame centre. The received flux is then given by:

q = τ Qr cosθ / 4 π R2 .................................................................... Equation 6-6

Where

Qr is the total radiative energy from the fire,

θ is the angle between the normal to the target and the line of sight from the target to
the point source location,

R is the distance from the point source to the target and

τ is the atmospheric transmissivity and accounts for attenuation of radiation by the

atmosphere.

Alternatively the widely used method of view factors can be used. In this model the received flux is
given by:

q = ϕ E τ ....................................................................................... Equation 6-7

Here E is the flame surface emissive power and ϕ the view or configuration factor. This is a
geometrical factor depending on the target location and orientation relative to the flame and the
flame dimensions and shape. ϕ takes values between 0 and 1. Lees (1996) has parameterised
several view factors relevant to process safety in terms of the geometry of the situation. More
complex computationally-based models used within computational fluid dynamics suites are also
available for the computation of radiation fields.

Beyler has provided a methodology for calculation of the transmissivity τ. He has shown that it
depends principally on water vapour concentration in the atmosphere (in general, at distances
< 100m, and relative humidities up to 50 %, τ > 0.7). For lower humidities and for targets closer to
the source, τ = 1 would be a reasonably conservative assumption.

6.7.4.1.3 Burn injuries

Burn injury correlates closely with skin temperature and the severity of burning increases with
failure of the blood supply to remove heat incident on the skin. The severity of burns has been
previously classified in terms of degree as indicated in Table 6-8 below.

Table 6-8 Burn severity classification

Burn type Characteristic

First degree Persistent redness

Second degree moderate Some blistering
Second degree deep Full blistering
Third degree Charring

The terms second and third degree have largely given way to characterization in terms of depth
For example moderate second degree burns affect only the surface layers whereas deep second
degree burns penetrate into the dermis. Third degree burns destroy both the surface and
underlying layers. Those with first degree burns are expected to escape quickly since movement
should not be impaired. With second degree burns any exposed skin will be uncomfortable and
simple escape tasks such as donning survival gear or turning handles may become difficult.

152-RP-48 Rev 02, Feb 2006 Page 186 of 261

fireandblast.com

Escape becomes increasingly problematic as the depth of second degree burns increases.
However unassisted escape is still possible. The response of third degree burn casualties is
difficult to predict. Fine control of injured extremities may be impossible and the act of escape will
probably incur further injury. Individuals with third degree burns should be considered casualties
who cannot escape unaided. Prolonged exposure to high radiant intensities and extensive third
degree burning results in death.

Injury due to exposure to short but strong pulses of thermal radiation may be correlated in several
ways; the most appropriate factor is the thermal dose – the product of radiation intensity and time.
However, it has been found that this underestimates the effects of high intensities and that a better
correlation is obtained if injury is with a dose, D, in the form:

D = I4/3 t ........................................................................................ Equation 6-8

Where t is the time in seconds, and I is the radiant intensity in kW m-2, this gives D in thermal dose
in units of (kW m2)4/3 s. Table 6-9 shows the spread of selected experimental burn data for
infra-red radiation correlated with the severity of injury. The degree of variability is high.

Table 6-9 Summarised burn data for level of injury with threshold dose

Infra red Radiation Thermal Dose TDU

Harm caused (kWm2)4/3 s

Mean Range

Pain 92 86-103
Threshold first degree burn 105 80-130
Threshold second degree burn 290 240-350
Threshold third degree burn 1000 870-2600

Fatality criteria similarly based on the thermal dose can be derived for hazard analysis purposes.

An alternative approach to deriving the level of fatality is the use of probit functions. Unlike linear
harm functions they account better for extremes of injury and the variable response of a
population. They are based on the statistical normal distribution. The probit function, Y, takes the
form:

Y = a + b loge V ............................................................................. Equation 6-9

V is the thermal dose in (kW m2)4/3 and a and b are constants derived by a fit to data. A number of
probits have been developed as shown in Table 6-10. In Table 6-10, the thermal dose used in the
Lees probit included a multiplier to account for the variation of exposed skin area. Thus for a
normally clothed population a factor of 0.5 was included while the factor rose to 1.0 to account for
ignited clothing. This demonstrates the importance of protective clothing. The probit function can
be converted to a mortality rate using a table such as that presented in Lees (1996). The problem
with the probit approach is that there is never likely to be a sufficiently large sample of injuries from
a well-defined event to validate a particular probit or that the normal distribution is appropriate to
this situation.

152-RP-48 Rev 02, Feb 2006 Page 187 of 261

fireandblast.com

Table 6-10 Probit equations for the fatality effects of thermal radiation.

Probit equation constants

Source
a b

Eisenberg et al -14.9 2.56

Tsao and Perry -12.8 2.56
Lees -10.7 1.99

The extent of exposed skin has an important effect on survivability in high radiation environments.
Thus reducing the burned area as a result heavy duty, well designed and specified clothing can
provide significant mitigation. Even without a hat and gloves an individual wearing a one piece long
sleeved overall and shoes will have an exposed body area of <20 %. With only the hands, face
and neck exposed this is further reduced to about 15 %. Such exposures, even with full depth
burns, significantly reduce the level of fatality.

The issue is then to avoid ignition of clothing. This issue is not well understood and further work is
required. For example Hymes (1996) [6.71] has examined the ignition properties of various grades
of clothing and counter intuitively he has predicted that fire retardant cotton will ignite more easily
than other clothing types. All useful clothing, for example man made fibres may melt and as a
result may increase exposure by melting on to the skin.

6.7.4.1.4 Hyperthermia

Simple hyperthermia involves prolonged exposure (>15 minutes) to heated environments at

temperatures too low to cause burn injury. This means temperatures below 120 °C and 80 °C in
dry and saturated air respectively. The main effect is a gradual increase in core temperature. When
this is raised to 40 °C consciousness becomes blurred, temperatures above 42.5 °C cause death
in minutes. The time taken to reach such a state depends on a number of factors including the heat
flux exposure, level of activity, air movement, humidity and amount of clothing. The latter may
reduce tolerance since it restricts mitigating evaporative cooling. This suggests that at
temperatures above about 100 °C exposures in excess of a few minutes should give concern
particularly in conditions of high humidity and if the subject is working hard as might be expected if
evacuating from a fire.

6.7.4.1.5 Convective heating

Above about 120 °C skin burns become increasingly likely. Clothing may provide some protection
but at temperatures around 200 °C pain levels become intolerable after a few minutes due to
burns. If temperature and humidity are sufficiently high to produce facial skin burns they will also
cause internal burns to the respiratory tract. Dry air at 300 °C will cause burns to the larynx in a few
minutes and breathing air at temperatures down to 120 °C will be painful and potentially cause
incapacitating burns. Humid air, steam or high heat capacity smoke may be dangerous at
temperatures around 100 ºC causing severe burns throughout the respiratory tract. Indeed there is
some data to suggest that the highest temperature of breathable 100 % saturated air is as low as
60 °C. Clearly in a fire there will be significant water produced this is an important area for further
study.

In practice heat flux and temperature tenability limits intended to protect victims from incapacitation
from skin burns should be adequate to protect from burns to the respiratory tract.

6.7.4.1.6 Conducted heat

The handling of hot objects can produce pain and severe burns. For metals for a few seconds
exposure at temperatures or 50 °C to 60 °C, 60 °C to 70 °C and ~80 °C can produce discomfort,
partial thickness and full thickness burns respectively.
152-RP-48 Rev 02, Feb 2006 Page 188 of 261
fireandblast.com

6.7.4.2 Effects of smoke

Purser (2002) [6.72] has summarized current knowledge on the varied human reaction to the
various constituents of smoke and should be consulted for a comprehensive treatment of the
subject.

The human response to some smoke constituents (e.g. CO) can be described in terms of an
accumulated toxic dose given by the product of concentration and time. The effect thus builds over
time.

W = Ct ........................................................................................... Equation 6-10

Where W is a constant dose and t is an exposure time. The units of W are generally ppm min.

The effect of other constituents including most irritants is concentration dependent and the effects
are felt immediately. The response to other materials such as carbon dioxide and low oxygen
concentrations is a combination of dose and concentration.

The concept of a fractional effective dose (FED) has been introduced to allow the combined effects
of combustion product mixtures to be examined. For FED the Ct product for small periods of time
during exposure are divided by the Ct product dose causing the toxic effect. This can be done for a
number of components. The fractional doses are then summed until the fraction reaches unity
when the toxic effect is predicted to occur. Thus:

FED = Dose received at time t (Ct)/Ct dose to cause incapacitation or death

Similar calculations for a fractional incapacitating dose (FID) and fractional irritant concentration
(FIC) can be carried out. A FID or FIC =1 generally indicates a state of partial incapacitation. Full
incapacitation is predicted for a FID or FIC ~ 3-5.

The effects of many fire plume constituents are felt in the lung so the rate of breathing is important.
This is dependent on activity. Thus for an average man running or walking uphill as might be
expected in an escape situation the rate of breathing increases almost 6 fold. Similarly some plume
constituents, notably carbon dioxide produced in all fires, produces a three fold increase in
breathing rate at concentrations of about 5 %.

The effects of some of the different plume constituents are known to be additive. Thus those of CO
and HCN are and CO2 increases up take of these products in proportion to its effect on the
breathing rate. Similarly the effects of oxygen hypoxia are considered directly additive to the
combined effects of CO and HCN. However, the asphyxiant effect of CO2 acts independently of
other gases. The effects of irritants are considered additive.

The effects of some of the main smoke constituents are:

Carbon monoxide: CO causes suffocation by blocking oxygen transport in the blood

haemoglobin. The effects are dose dependent but take up is dependent on breathing rate. For a
normal adult at rest or partaking in light activity full incapacitation occurs after about 21 or
5 minutes respectively at 5000 ppm. Death will occur at a concentration of 12-16000 ppm for a
5 minute exposure.

Hydrogen cyanide: The effects of hydrogen cyanide depend partly on uptake and dose. The
effects increase from zero at about 80 ppm to loss of consciousness and full incapacitation in a few
minutes at 180 ppm.

Low oxygen hypoxia Again the effects of lack of oxygen are both concentration and does related.
The main effects are felt at concentrations below about 14%.Thus:

>14 % No significant effects

152-RP-48 Rev 02, Feb 2006 Page 189 of 261
fireandblast.com

14.4-11.8 Slight effects on memory, reduced exercise tolerance

11.8-9.6 % Severe incapacitation, lethargy

<9.6 % Loss of consciousness, death

Carbon dioxide: The asphyxiant effects of carbon dioxide are only felt at high concentrations
above about 5 % and then follow a dose response relationship. Below this figure the main effect is
of hyperventilation which acts to increase the uptake of other gases. At concentrations of 6-7 %
individuals suffer severe respiratory distress and dizziness. Loss of consciousness occurs at
concentrations between 7 and 10 %

Irritants: Irritants produce two levels of harm:

• Sensory irritation pain to the eyes, respiratory tract and lungs to some extent.

• An acute pulmonary response including edema and inflammation in the respiratory system.
This may lead to death 6-24 hours after exposure.

The former is concentration dependent while acute damage only occurs above a threshold
concentration and then is dose dependent.

The main irritants are acid gases including HCl, SO2 and NOx and simple aldehydes such as
acrolein and formaldehyde. There is little data on irritants for humans. Some data for HCl and
acrolein indicate disturbing irritation to the eyes and upper respiratory tract occurs at
concentrations of 75 - 300 and < 5 ppm respectively. Acute pulmonary response may be induced
by exposures in excess of 12000 and 500 ppm for five minutes respectively.

Particulate smoke: Smoke can be either irritant or non-irritant. Smoke causes disorientation and
thus acts physically to reduce escape speed. They make way finding difficult and reduce the
visibility of escape signage. Studies have shown that walking speed is reduced from 1.2 to
0.3 m s-1 for non irritating smoke. There is also a psychological effect in that some individuals will
not try to evacuate through smoke at a density in excess of 0.33 m-1. The effects of irritating
smokes are even more pronounced. Such smokes with densities of only ~0.2 m-1 reduced walking
speeds to 0.3 m s-1.

6.7.5 Vulnerability/harm criteria

6.7.5.1 Effects of heat

6.7.5.1.1 Radiation

A recent study (O’Sullivan and Jagger, 2004) [6.73] has taken account of the special features of
the offshore environment including its isolation, the age profile and fitness of the population, state
of dress etc and recommended that the criteria given in Table 6-11 are the most appropriate.

152-RP-48 Rev 02, Feb 2006 Page 190 of 261

fireandblast.com

Table 6-11 Thermal dose harm criteria from radiation

Harm caused Thermal dose, (kW/m2)4/3s

Escape impeded 290

(See also Table 6-9)
At permissible radiation design levels of 9.46 kW m-2 and 6.31 kW m-2 ,
a dose of 290 (kWm-2)4/3s is reached in 14.5 and 25 seconds respectively)

1-5 % fatality 1000

50 % fatality (to front and 1000
back only)
50 % fatality 2000
100 % fatality 3500

6.7.5.1.2 Convected heat

The toleration of a hot environment depends on the level of activity, extent of clothing and level of
humidity. Temperatures above 120 °C will produce both skin and internal burn injuries. For air with
a humidity <10 %, the existing work suggests a relation for time to incapacitation in a hot
environment of

tI = 5.107 T-3.4 ................................................................................ Equation 6-11

Thus temperatures of 100 and 60 °C would cause incapacitation in a matter of some 8 and 45
minutes respectively.

The time to incapacitation in air with higher water vapour contents is not well defined. It will be
significantly less that those obtained from Equation 6-11 but no data exist to allow its determination
with certainty. This is particularly important for fires offshore where there is likely to be significant
quantities of water both produced in the fire and used for fire fighting.

6.7.5.2 Effects of smoke•

6.7.5.2.1 Asphyxiant gases

Existing knowledge suggest that the tenability limits given in Table 6-12 for asphyxiant gases are
appropriate for design purposes.

Table 6-12 Tenability limits for incapacitation and death from exposure to common
asphyxiant gases

5 minute exposure 30 minute exposure

Gas
Incapacitation Death Incapacitation Death
CO 6-8000 ppm 12-16000 ppm 14-1700 ppm 2500-4000 ppm
HCN 150-200 ppm 250-400 ppm 90-120 ppm 170-230 ppm
Low oxygen 10-13 % <5 % <12 % 6-7 %
CO2 7-8 % >10 % 6-7 % >9 %

Some currently accepted 30 minute LC50 values for CO and HCN are 5700 and 165 ppm
respectively.

152-RP-48 Rev 02, Feb 2006 Page 191 of 261

fireandblast.com

6.7.5.2.2 Irritants

Two irritant gases have been taken as examples, acrolein and HCl. Existing knowledge suggests
that the tenability limits given in Table 6-13 for these gases are appropriate for design purposes.

Two levels of sensory irritancy are given;

• Level a) is for unpleasant and severely disturbing eye and upper respiratory tract
irritation,

• Level b) represents severe eye and upper respiratory tract irritation with severe pain.

For death the levels represent concentrations at which there is a danger of death occurring during
or immediately after exposure. Concentrations are in ppm.

Table 6-13 Tenability limits for sensory irritation or death from irritant substances.

Sensory irritation Death, minutes

Gas
a b 5 10 30

Acrolein 1-5 5-95 500-1000 150-690 50-135

HCL 75-300 300-11000 12-16000 10000 2-4000

6.7.5.2.3 Smoke

The ability to evacuate through smoke is dependent on a number of factors including knowledge of
the environment, levels of illumination (particularly of signage) and irritancy of smoke. Suggested
tenability limits based on ability to evacuate can be set in terms of optical density and set at 0.2
and 0.08 m-1 for small and large spaces respectively.

6.7.6 Hazards from fire protection systems

Possible interactions of fire with active and passive protection systems must be considered.

For example water mist and deluge systems will produce copious amounts of steam which will add
to the obscuration provided by smoke and hinder escape. Also humid air enhances the effects of
hyperthermia and when inhaled can significantly increase the severity of internal burns to the
respiratory tract.

Passive systems may also present hazards. Intumescent materials rely on chemical reaction for
their action and generate fumes. These fumes or their decomposition products may present a
hazard. Similar considerations apply also to binders used in other passive systems.

Many materials when treated with fire retardants are capable of resisting small ignition sources but
when faced with a large igniting fire can burn readily. The treatments themselves then add
significantly to the rate at which smoke is produced and the composition can be particularly irritant
and toxic.

6.7.7 Evacuation and mitigation

If the hazard cannot be removed then some means of separating the hazard and personnel must
be provided. This will generally be through evacuation of occupants by means of safe, protected
evacuation routes to a safe haven or temporary safe refuge. Platform layout can make a major
contribution to this.

152-RP-48 Rev 02, Feb 2006 Page 192 of 261

fireandblast.com

Careful consideration must be given to the design and routeing of evacuation paths. Their length
must be kept to a minimum and they must be routed away from high hazard areas. Should they be
likely to be subject to fire attack they must be protected with fire walls suitable for offshore duty or
water protection systems? The evacuation routes should maintain their integrity for a time sufficient
to allow even injured personnel to reach a location of safety. If likely to suffer from smoke logging
consideration should be given to other methods of way-finding. There are no particular guidelines
for evacuation routes off shore. However CIA guidance for onshore situations, suggests that
evacuation routes should not suffer incident radiant heat fluxes in excess of 6.3 kW m-2. There are
also general requirements relating to evacuation routes in public buildings and industrial premises.

Under UK legislation and as a matter of good practice, there is a need to provide temporary
refuges to serve as muster points prior to evacuation of the facility. There are no particular
guidelines for the design of such structures offshore. However, they are required to allow staff to
muster, assess the emergency and allow execution of the emergency plan. The requirement is that
the chance of loss of a TR, within the stated endurance time, will not exceed 1 in 1000 per year.
Thus there is a need to design fire resistance into the structure. Those walls likely to be exposed to
fire must be protected in such a way, either by insulation or water deluge, as to provide this
resistance. The prevention of smoke ingress must be considered and any ventilation system
should include a means to close off relevant air intakes. Similarly a means must be provided to
seal doors and other openings such as cable routes and other services.

There is currently much activity in the development of evacuation models. Traditionally evacuation
has relied on simple hydraulic formulations of people movement to derive travel speeds. These
have been corrected for travel through smoke, the use of stairs etc, and the difficulty of route
finding and an evacuation time obtained from simple combination with the length of the route. More
complex models are now available which take account of the response to alarms, other pre-
movement aspects and the varied response of a population to the threat of fire. These models
have recently been reviewed Nelson and Mowrer (2002) [6.74] and Gobeau et al (2004) [6.75].
They have been applied to a variety of situations and potentially they may be applied offshore
particularly to the design process to calculate a time for all personnel to reach a place of safety for
different plant layouts and fire scenarios.

A key issue to consider in developing evacuation and mitigation strategies to protect personnel is
the provision of Personal Protection Equipment that can supplement the fire protection and other
mitigating measures discussed in Sections 3.5 and 7.3.

The provision of equipment will consider suitable clothing, e.g. fire resistant coveralls as a
minimum requirement and should also consider whether breathing apparatus is required. Various
models covering types and durations are available on the market and the requirement should be
determined by the hazard and the function of the team to which they are being supplied. For
example, for normal operating teams who are making their way to safer muster areas prior to
disembarking will need lightweight equipment of short duration. Emergency Response teams who
may be required to recover colleagues in the early stages of an incident will require longer duration
sets.

Dedicated fire-fighting teams will require specialist fire-fighting suits and will be trained to use the
full range of portable fire-fighting equipment on the installation. This equipment should have been
specified to be suitable for the range of hazards that the team are expected to respond to, for
example, rescue teams for helicopter crashes.

152-RP-48 Rev 02, Feb 2006 Page 193 of 261

fireandblast.com

7. Detailed design guidance for fire resistance

7.1 General
Despite the complexity of the fire phenomenon and the many areas of uncertainty still
acknowledged by the industry, experience shows that, with care, offshore fire risks can be kept to
acceptable levels. This is achieved by designing with fire-related issues in mind throughout every
stage of a design project.

This section on design guidance for fire resistance seeks to pull together in one place guidance on
existing best practice for a two-pronged approach to fire protection i.e.
• Designing the process systems to minimise both the occurrence and the magnitude
of fires.
• Designing effective fire protection systems to detect, control and mitigate the
remaining fire risk once all reasonable efforts to minimise through good process
design.

Section 7.2 guides engineers towards designing out problems and reducing risks early in design,
where significant changes can be made relatively cheaply. This assumes that sufficient time for
creative thought and corrective action is allowed in the project schedule. Failure to provide time
and resource for this could result in the need for very expensive fire-protection systems or failure to
meet risk targets without extensive QRA input and/or remedial design.

There is a legal obligation to base decision-making for health and safety on risk assessment.
Project managers need to understand that risk assessment is not a one-off activity but a
continuous process, best done at regular intervals throughout the design process. Failure to do this
courts a risk of missing safety or financial targets and having difficulty demonstrating ALARP.
These risk assessments do not always have to be complicated, quantitative, or time consuming,
but should be appropriate to the problem being assessed. Targets for risk are set at the beginning
of a project, but the desired information for QRA (where justified) is generally not be available until
later in the design. Thus early decisions on concept and layout may be based on ‘quick estimate’
assessments.

It is important that design decisions are taken in the light of an understanding and assessment of
the Cost vs. the Risk Reduction in order that the justification can be recorded for the ALARP
demonstration. If this process is followed, it is far less likely that problems requiring expensive
solutions will be identified at the eleventh hour when the final QRA results for the installation are
produced.

There will always be a trade-off between cost and safety. Senior Management is responsible for
approving new projects or major modifications and may ultimately be called to account for their
decision. Two key safety issues to be addressed are:

1. Can this installation be built and operated to make a reasonable profit with an
acceptable level of safety?

2. Does the project documentation fully record the basis on which the decision to sanction
the project was made?

The cost of continuing to operate the installation safely once the revenue from the installation has
dropped to a fraction of its peak rate must not be forgotten. Some issues for older platforms
nearing the end of their life cycle are discussed in Section 3.10.

152-RP-48 Rev 02, Feb 2006 Page 194 of 261

fireandblast.com

Senior managers will look to their project managers, who will in turn look to their discipline
engineers for the detailed back-up to support the sanction decision. One of the aims of this section
is to highlight to both project and discipline engineers the extent to which they can influence the
type of fires and well as the effectiveness of the fire management measures as part and parcel of
their discipline design effort.

7.2 The design sequence – minimising fire hazards throughout the design
7.2.1 Introduction

The recommended Fire and Explosion Hazard Management processes are laid out in Part 0 of this
guidance. Part 0 is aimed at safety specialists. The objective of this section is to provide some
additional, qualitative, pragmatic, guidance on designing to reduce fire risk at each step of the
design process. This section is written for discipline engineers and project managers.

Each of the following stages of the design process should schedule safety reviews appropriate to
that particular stage into the project schedule.

7.2.2 Project appraisal & concept selection

At the first stage of design, a number of different concepts will be put forward for consideration. A
simple evaluation of which concept offers the smallest fire risk should be made. At concept stage
there will be only very basic well information, production flow rates, vessel inventories, utility
requirements and layout data, so only basic comparisons can be made. In addition, it must be
recognised that there is always a balance to be struck between safety, cost and practicality. The
discipline of recording the basis for the concept selection decision forces project teams to ensure
the balance of cost vs. safety is appropriate and in line with Company Safety Policy. If the cost of
the safety facilities necessary to maintain the Safety of any proposed concept within acceptable
bounds makes the installation unprofitable, then that concept should be rejected.

Key items to consider at concept selection stage are:

• To ensure that the wells, risers and process equipment are located such that;
• Their associated hazards conform to a “hazard gradient”, with respect to areas of greater
safety (e.g. TR and evacuation areas), and include the effects of prevailing wind in terms of
spread of impact (dispersion of gas or smoke).
• Potential escalation paths are minimised where possible within the confines of the layout,
and certainly concerning the TR and evacuation facilities?
• Future risers should be considered where at possible, for example, gas lift risers can
provide a considerable hazard in later years of operation as the reservoir pressure declines,
but may not have adequately considered in the original design.
– Evacuation from a small, unmanned NUI is just as important as evacuation from a
manned installation. Efforts should be undertaken to reduce the relative complexity of
the topsides processes. Greater complexity often implies a higher leak frequency (and
higher overall fire risk) and also requires a larger or more regular workforce to meet the
maintenance demands.
– The flammable and toxic inventories should be minimised to reduce the duration of
release and fire scenarios.
– The balance between designing for fire hazards and explosion hazards (also see the
discussions in Section 4) is logically thought through, for example, enclosed or partially
enclosed modules containing process equipment present serious fire risks but are more
readily managed through a mixture of ventilation control and fire protection. Whereas,
open module design facilitates better dispersion and dilution of released gas or vapour
inventories and provides less containment for explosion overpressure generation.

152-RP-48 Rev 02, Feb 2006 Page 195 of 261

fireandblast.com

– The full range of fire hazards have been designed for, for example, considering fires on
the sea surface, external flaming effects and associated fire sources (e.g. shuttle tanker
fires during offloading from F(P)SOs).

– Inventory removal and containment concepts/philosophies have been carefully

considered within the context of other ER planning (for example, inventory containment
allows helicopter access at all times whereas rapid venting effectively excludes
helicopter approaches).

– The range of supporting equipment that will be active over the installation lifetime, for
example identifying where cranes, boats and drilling rigs will be required to operate and
ensuring that pipelines, risers, wells etc. are located away from areas of high activity.

– Where cranes, boats and drilling rigs will approach or operate in relation to pipelines
and risers?

The outcome of the review should be presented in a discussion meeting so that engineers and
managers can understand how the options were compared. In this way, the benefits of each
concept can be adopted to improve on the chosen selected concept. The less effort put into control
of fire at source at concept stage, the higher the likely cost of the fire protection systems found
necessary at a later stage in design.

As a general rule, large installations with complex process plant can expect higher leak
frequencies so understanding of all the fire escalation issues should be a focus point right from
concept selection. These installations also tend to have a higher POB.

It is now known that heat build up from fires in confined modules is both more severe and more
rapid than was appreciated in the 1990s if a sufficient supply of air continues to be available. A key
finding of recent research work is that fires from even relatively small hydrocarbon releases
(around 1 to 3 kg s-1) in enclosed or partially enclosed modules can generate a layer of very hot
gases (temperatures in excess of 1000 °C) in the top few metres of the module within a few
minutes of ignition. Structural failure, damage to high level process and safety equipment and
smoke and flames reaching well beyond the module boundaries are all realistic consequences to
be considered. To control the consequences of sustained pressure-release fires requires higher
deluge rates and more passive protection than have been traditionally used in the North Sea in
such modules. A further option is to investigate a greater degree of hermetic sealing to reduce air
ingress, although this has traditionally been difficult to achieve and certainly difficult to maintain on
ageing installations. At concept stage however, many of the causes and consequences can be
designed-out thus reducing costs. This is done by:
• Not placing process equipment that can sustain severe fires into partially enclosed
modules, Gas cloud and smoke plumes from unignited releases and fires affect EER.
Consider the effect of weather on plumes/cloud behaviour and EER.
• In open modules, analysing where the heat, smoke and flame will go, and designing in the
light of this knowledge,
• Ensuring that all structure potentially exposed to high heat loads is examined and either the
structural concept changed or the structure adequately protected by PFP,
• Enclosed design requires high application rates, very rapid activation systems and
extensive protection to high level support structure and blowdown facilities to control
escalation so the cost will be higher. However, open module design may also require high
deluge supply rates if several areas could be initiated at once,
• Where enclosure of process plant is unavoidable, provide for the rapid removal of inventory
and high levels of protection against the high heat loads at ceiling level (see Section 7.3
“Best practice for fire protection systems”).

152-RP-48 Rev 02, Feb 2006 Page 196 of 261

fireandblast.com

On large installations personnel can rapidly distance themselves from a major fire incident. The TR
and evacuation points can be far enough away to allow safe evacuation, provided the decision to
evacuate is made very rapidly. Evacuation risks on small, open, gas installations can sometimes
be acceptable because of low production rates, very simple process or small inventories. Small,
single jacket installations with complex process plant however need extremely close attention.
Where wells, risers, process and blowdown facilities are all in close proximity to each other, and to
the TR and evacuation points, an innovative, well-informed design is needed to make them safe..
Innovative, well-informed design is needed to make them safe. In such cases a separate
accommodation jacket or unit may prove the only feasible option.

Some normally unmanned very small gas satellite platforms in the Southern North Sea have ended
up with relatively high risk levels and ‘minimum facilities’, based on the philosophy that the
installation would only be manned for an absolute minimum time. The high risk stems from the fact
that these are small open installations with minimum safety features, and ignited gas jet fires are
large in comparison to the installation footprint. There is limited shelter for personnel before or
during evacuation. Such installations need to have lower risk targets to take account of satellite
team personnel who may spend their time visiting a succession of similar facilities. The platform-
specific risk becomes high, although not excessive if viewed in isolation. However the cumulative
individual risk for satellite team members becomes high.

Once the design concept is selected, and a basic layout proposed, a layout review should be
undertaken. Optimising the layout with regard to fire potential can minimise the likelihood of
release and ignition, and the subsequent impact on exposed equipment, critical systems or
personnel.

The layout fire review should be a multidiscipline activity, addressing at least the topics and
associated considerations listed in the table below. Given that no two installations are alike, there
will be many variations on the list of issues to be covered. The table is intended to highlight key
considerations to be addressed. If such layout issues are not addressed until late in design,
improvements are far more costly to implement. The table below covers the review of the platforms
normal operational phase. The objective is to explore whether the locations of key items which
contribute to fire safety can be improved without incurring disproportional cost.

Separate, shorter layout reviews should be considered, with appropriate discipline attendance for
other stages of the installation lifecycle (e.g. installation, commissioning, major drilling / workover
programmes, decommissioning etc). This would ensure that key layout considerations for other
lifecycle phases are not missed.

Topsides issues - Concept

Item Fire considerations

Wells Location and segregation for all anticipated types of well operation (including drilling
and workover) and maintenance during field life.
Location, accessibility and vulnerability of automatic and manual isolation valves in
fire situations
Location of artificial lift arrangements, inventories (including down hole gas lift
inventories) and isolation
Risers / pipelines Riser and riser isolation valve locations – vulnerability to fire attack
Risers and Pipelines as source of release and potential for escalation.
Riser vulnerability to passing and attendant vessel collision especially during cranes
operations
Future risers, e.g. gas lift risers or other proposed tie-ins

152-RP-48 Rev 02, Feb 2006 Page 197 of 261

fireandblast.com

Topsides issues - Concept

Item Fire considerations

Process & piping Location of major inventories

Location of relief, blowdown and flare and/or vent lines
Number and rough location of process ESDVs and BDVs
Location of overboard discharge lines or atmospheric vents (in worst case process
upset condition) with respect to ignition points
Location of fuel-gas piping and potential for fires/explosions outside main process
locations (especially turbine enclosures)
Exposure of personnel and equipment (including piping, instrumentation and safety
critical elements) in closed or open module designs needs due consideration
Structures and supports Location of tall structures or structural supports vulnerable to fire attack with severe
consequences
Points of ignition Consider ignition potential for all release scenarios (see factors listed in
Section 2.2.4)
Especially consider the location of all non-certified equipment with respect to releases
and associated gas plumes (e.g. cranes and generator or motor enclosures.
Egress, escape and For potential fire scenarios:
evacuation routes
• Consider egress routes, checking for trap points or need for protected muster
point alternative to TR;
• Consider location of escape routes to sea;
• Consider time to escalation Vs time to muster, appraise and evacuate;
• Consider impairment of TEMPSC loading area and helideck access routes.
TR and alternate Location of air supply ducts
protected muster points
Vulnerability to heat/smoke
Vulnerability of TR supports to fire scenarios
Communications Location and vulnerability of any critical communications hardware
UPS Check for vulnerability to fire
Fire Protection Location of firewalls and PFP
Vulnerability of fire pumps and ring-main to damage in fire scenarios
Vulnerability of deluge piping inside module and supply lines. Location of back-up
supply lines.
Discharge location for oil and firewater drained to sea in fire incident.

152-RP-48 Rev 02, Feb 2006 Page 198 of 261

fireandblast.com

Specific subsea or marine issues

Subsea Understanding of leak durations and isolation provision
layout
Position of pipeline routes to minimise damage potential
Position of subsea isolation to minimise inventory loss
Subsea Location of control interface and vulnerability to fire attack
tiebacks
and control
F(P)SOs See Section 3.8
Time for escalation of process events to vessel threatening events
Diversity of escape routes for all fire scenarios (especially process/storage scenarios)
Location of evacuation facilities for sea-fire scenarios
MODUs Drilling units – vulnerability to drilling fire scenarios, especially survivability of ballast control
arrangements
Floating Production Units (converted MODUs) – consider vulnerability of hull to internal and
external process fire scenarios
Vulnerability of emergency pull-off arrangements in fire scenarios (drilling and production units)
For Jack-ups, vulnerability of legs to fire scenarios in both standalone drilling operations and
drilling operations over production installations-

7.2.3 FEED stage

At this stage, fire management input can still have a major impact on the overall risk levels for the
personnel and the TR impairment. This is the stage where the process control, ESD and
blowdown/dump systems are developed. The fire and gas detection and protection system
philosophies will be set. These systems must not be designed in isolation. Whichever particular
philosophy is followed the aim should always be to:-
• Raise alarms, shut down and isolate plant rapidly on fire or gas detection
• Provide the facility to remove all significant hazardous inventories from the fire zone
quickly without local manual intervention.
• Optimise design of multiple escape routes and muster areas to ensure POB reach a
place of greater safety with minimised risk for the hazardous scenarios identified.
• Ensure full emergency evacuation can be achieved under all weather conditions and
wind directions before the incident escalates to a platform-threatening event.
Evaluation may be delayed, particularly on large installations, due to the need to
carry out search and rescue operations for personnel not appearing at muster.
Partial evacuation may be initiated. This may impact on TEMPSC numbers and
locations.

At the start of FEED stage the basic process design parameters are set down and the key plant
items and protection systems identified and sized. The process and the safety engineers need to
work together to:
• Develop a draft ESD and blowdown philosophy document;
• Examine the design for potential escalation points;
• Develop draft fire and gas detection and protection philosophy documents, identifying the
goals of the key SCE’s for fire control i.e. how is each release or fire scenario prevented,
detected, stopped or controlled
• Clarify the fire areas and location of fire walls with respect to plant & the TR;
152-RP-48 Rev 02, Feb 2006 Page 199 of 261
fireandblast.com

• Decide what types of passive and active fire protection best suit the fire scenarios;
• Compare escalation times with evacuation, search and rescues times;
• Design egress routes including stairways, ladders etc. to the sea, TR and
muster/embarkation areas;
• Review the isolation and blowdown systems to minimise the fire impact and escalation
potential ( a number of reiterations of the design may be needed);
• Carry our coarse fire risk assessment;
• Carry out FEED stage HAZID and HAZOP studies. These may identify new fire related
issues to be considered as well as other safety issues.

European Standard EN ISO 13702:1999 [7.1] entitled ‘Petroleum and natural gas industries –
Control and Mitigation of fires and explosions on offshore production installations – Requirements
and Guidelines’ provides more guidance on layout, control systems, protection and mitigation
systems, EER arrangements and inspection, testing and maintenance issues for the various
systems.

NORSOK Standard S001, Rev 3 2000 [7.2] entitled ‘Technical Safety’ and its annexes, also give
the requirements for layout, structural and process design safety, fire and explosion protection
arrangements and communication systems.

7.2.4 A methodology for an initial fire QRA

An initial conservative QRA associated with the fire hazards on an installation can be undertaken
using the typical thermal loading values presented in Section 5.4 and the relevant response
methodology of Section 5.5. Such an assessment should consider:
• A range of fire scenarios and sizes – particularly from high pressure areas.
• The impact of operation or non-operation of ESD valves.
• The impact of operation or failure of the water deluge system.
• High risk areas - where escalation might result in a short time, near escape routes,
where impact on Safety Critical Systems may occur, where structural integrity might
be affected.
• Transition to other events – escalation to a larger fire or potential for an explosion.

The focus is primarily on the risk within the first 15 minutes whilst personnel are likely to be present
and trying to escape. However, if required, this can be extended to later times when the impact on
the asset may be considered.

If this assessment suggests that the risks are well understood and broadly acceptable, then it is
likely that the installation is falling into the Type “A” category of UKOOA Framework for Risk
Related Decision Support. Otherwise, a more detailed analysis is warranted. This may mean using
mathematical models, (which should be validated against a wide range of large scale experimental
data), to predict spatial and time varying fire behaviour and thermal loading. More sophisticated
calculation techniques could also be used to predict the response of vessels and structures
impacted by these fires. Additional preventative and mitigation measures may need to be
considered and a detailed QRA undertaken.

7.2.5 Detailed design

The effectiveness of the detailed design stage is dependent on the success of the preceding
design stages. If a design concept with high fire risks or poor protection philosophies has been
selected, then detailed design is unlikely to be able to rectify the situation without major cost and
time penalties.

152-RP-48 Rev 02, Feb 2006 Page 200 of 261

fireandblast.com

7.2.5.1 Introduction

This stage of design presents many conflicting issues to be resolved. Realistically, design
decisions affecting safety have to be made by balancing the risks, and this has to be done on a
project timescale. This is only possible where the risks are honestly and openly brought up for
discussion between the various disciplines affected and the project management. Some of the
common fire-related issues for each discipline area are outlined below.

7.2.5.2 Structural design

The fire scenarios for the installation will have been identified in the FEED study. They should
already have been minimised as far as possible at concept and FEED stages.
Key structural supports (or vessel hulls in the case of floating installations) either need protecting
against the remaining fire effects or redundancy provided in the design. The effects on the
structure of external, as well as internal flaming in confined but ventilation controlled modules must
be assessed. The escalated fire effects can be serious enough to lead to progressive collapse of
the topsides.
Structural redundancy, while costly in the short term, has other longer term benefits e.g. for
collision protection, reducing inspection or protection against long-term structural degradation.
Locating process pipework inside structural supports should always be considered carefully as
overpressure from releases or explosions, or heating by fire could cause rapid structural failure.

An open design of platform with appropriately designed fire and blast walls to segregate process
and drilling areas from safer areas with higher occupancy is preferred. Wherever fire scenarios
within enclosed modules are identified, early failure of structural items in the roof of the module is
predicted unless passive protection and/or a very high rate of deluge application is provided. The
times to structural failure and the consequences in the absence of protection should be
investigated between the structural engineer and the safety engineer.

Grated floors greatly reduce the pool fire risks and reduce explosion overpressures. Environmental
legislation however forbids marine pollution by oil, so alternative measures to prevent operational
spillage must still be provided. Grated floors do not provide a barrier against jet fires or radiant
heat, and an understanding of the lack of protective effect should be considered during scenario
and escalation developments.

The structural design must provide for rapid egress and escape of personnel from the process
areas to sea or to the TR. Space allowance for a diversity of escape routes is essential. Escape
routes should be based on stairways not ladders. The routes must take into account all the
different fire scenarios.

7.2.5.3 Process systems

Process engineers should seek to minimise inventories, operating pressures and temperatures and
simplify their designs as much as possible. However they are limited by reservoir and export
system characteristics, residence times needed for separation and the product specification.

Where large inventories still remain in sections of the process train following ESD, blowdown
and/or dump systems to remove hydrocarbon inventories to flare, cold vent, or surge/storage
vessels should be considered. These systems themselves are not risk free and the risks need to
be balanced for every design, since designs vary enormously. The options considered and the
basis for the provision (or lack of) of safety facilities should be documented as proof that ALARP
principles have been maintained.

Process items exposed to severe fires (defined as confined pool fires or fully engulfing jet fires)
should be designed and provided with protection in accordance with the Energy Institute’s
“Guidelines for the design and protection of pressure systems to withstand severe fires” [7.3].

152-RP-48 Rev 02, Feb 2006 Page 201 of 261

fireandblast.com

Research shows that fires fuelled by 2-phase releases are far harder to control than simple pool
fires. Indeed, modelling 2-phase releases is not a precise science and the output from proprietary
codes should be managed with great care. The designers of blowdown systems must recognise
that the biggest hazards are the liquid inventories which sustain high release pressures for more
than 5 or 10 minutes. This has little to do with existing codes which require pressure reduction to
half design pressure or 7 barg within 15 minutes. Identifying the transition point at which spray
releases change to liquid releases (resulting in simple pool fires as opposed to pressurised oil-
spray fires) and designing the blow-down system accordingly, is key. Typically, this transition point
occurs at around 7 barg for oil and 4 barg for condensate. There is some evidence that in the
presence of general area coverage (of at least 12 l min-1 m2 with medium velocity nozzles) the
transition point pressure could be raised to around 15 barg for oil and 10 barg for condensate, but
the research is currently inadequate to develop proper design methodologies.

Wherever possible, systems should be designed to contain overpressure caused by process

excursions. Where this cannot be done, pressure relief to a vent system or combined vent and
blowdown system or an active containment system such as a High Integrity Pressure Protection
System (HIPPS) may be used. The choice of system should be based on the hazards and
excursion types expected and the vulnerability of the systems at risk, bearing mind that relief
systems are moderately passive and that HIPPS have to achieve suitably high integrity and
reliability.

Sand production frequently increases as reservoirs become more depleted. Many large releases
have been caused by sand erosion. An ignited release through a 17 mm hole in an oil system at
20 barg in a mainly enclosed module (but with some openings) of 8000 m3 (for example,
10 m² x 20 m² x 40 m²), [7.4] would produce a major fire with external flaming and smoke sufficient
to overwhelm the installation. Reservoir engineers as well as process engineers should consider
how they have prepared for eventual sand production in their designs.

Production chemicals can cause leaks and fires as well as adverse health effects during handling.
Chemical data sheets should always be reviewed for potential contribution to platform fire risk.

7.2.5.4 Process pipework

Piping engineers can reduce risks on an installation by:

• Locating key isolation, pressure relief and blowdown valves away from fire effects or else
adequately protecting them.

• Where valves are quick acting and fail-safe, protection may not be necessary, but the
designer needs to examine the fail-safe mechanism (with input from the instrument
engineers) to ensure they are truly fail-safe under all fire scenarios. Duplication of solenoids
or steel enclosures for control cabinets may be necessary to achieve the required reliability
within the heat-up timeframe. This information should be documented within performance
standards for the equipment.

• Protection options should be based on a clear understanding of the fire effects.

• Pipe / valve support arrangements at high level also need to be considered for fire
protection, in the light of the fire scenarios. The consequences of failure where rapid and
severe heating is a significant risk should dictate the protection requirements.

• A balance has always to be struck between minimising sources of release and allowing
safe isolation and access for intrusive maintenance. Any areas with a concentration of
potential release points in close proximity to high inventory process plant require close
scrutiny to see how the risks can be reduced through re-arrangement, use of high integrity
flanges, use of integral block and bleed valves, shielding, grating floors, etc. Areas
susceptible to vibration or sand erosion should be similarly considered.

152-RP-48 Rev 02, Feb 2006 Page 202 of 261

fireandblast.com

• Ensuring that failures emanating from piping runs, piping and vessel connections, small
bore tappings etc. do not present jet or pool fire hazards to less-obvious targets, for
example, pipe flange joints in line with safety critical control panels or utility systems, non-
process flammable inventories etc.

7.2.5.5 Instrumentation and control

• Instrumentation is a common leak source and should be minimised where possible

• Design of safety critical control systems needs to be checked for common mode failure
problems which cause releases, ignite releases or could occur as a result of fires.

• The safety integrity level (SIL) requirement of safety critical instrument or systems must be
determined. As part of this process, the consequences of failure are considered and
maintenance/testing frequencies established. The SIL assessment should be a
multidiscipline activity, chaired by a practical engineer with experience of such
assessments. Good SIL assessments often help to reduce un-necessary instrumentation
and should be carried out in accordance with the BS EN 61508 [7.5] or 61511 [7.6] as
appropriate.

• The consequences of rapid heating causing simultaneous failure of all mid to high level
instrumentation in modules which could suffer from prolonged engulfment should be
considered. Where this will lead to catastrophic or extreme events the design needs
scrutiny to ensure risks are ALARP either through more rapid, higher rate water, failsafe
design, better redundancy, or managing the heat build-up by altering the module openings.

• Setting realistic performance standards for safety critical instruments or systems is usually
a re-iterative process, requiring input from process mechanical, safety and instrument
disciplines. Sufficient time for discussion must be included in project schedules.

• Instrument tappings can be prone to fatigue failure in the presence of pipework vibration
and unsupported instrument loads. This fatigue damage and subsequent failure can occur
very rapidly.

7.2.5.6 Fuel gas and lubrication lines

Power generation systems fuelled by conditioned process gas or diesel can be a source of both
fuel releases and ignition. Fuel gas lines should be designed to tolerate failures at the HP/LP
interfaces in the system. Design should minimise inventory in the system and minimise routes
through process areas or areas of high mechanical damage risk. Provision for rapid isolation
and/or disposal of fuel inventory is required.

Provided proper maintenance and condition monitoring takes place, serious mechanical failures of
rotating equipment, leading to projectiles and serious fires are rare. The system design should
make system shut down as soon as it deviates from its safe operating envelope. Early intervention
allows the situation to be brought back under control.

Escalated fires inside any enclosures, given some air ingress, can be severe. Lube-oil or diesel fire
produce smoke which migrates to other areas. The layout should take into account the possibility
of sudden mechanical failure and smoke generation and locate enclosures where such events are
less likely to escalate to process fires.

7.2.5.7 Power generation and electrical systems

Existing standards of protection against the occurrence of electrical fires on offshore installations
have proved adequate over time. Early automatic electrical isolation on overload is usually
sufficient to prevent development of serious cable fires and subsequent escalation.

152-RP-48 Rev 02, Feb 2006 Page 203 of 261

fireandblast.com

Electrical equipment can provide a source of ignition in the event of a process hydrocarbon
release. Detailed design should minimise the risk of hydrocarbon releases coming into contact with
uncertified electrical equipment. Open design of process modules allows migration of large gas
releases. Best practice is to locate uncertified electrical equipment inside enclosed areas which
contain no process plant and to which the air supply can be shut off if gas is detected at the inlets.
Location of non-certified electrical equipment in open deck areas should be either avoided or
adequately justified, for example by gas dispersion modelling.

During a fire event, main power generation usually switches over to emergency arrangements.
Often initial emergency power is from diesel and then ultimately by battery power, shedding non-
essential loads at each stage. In a major fire event, UPS batteries power communications and
essential shutdown/process/F&G data, plus life support and evacuation systems. Batteries can
only supply power for a limited time. Design must be compatible with the fire, emergency response
and evacuation timescales. Power for each fire pump is usually independently supplied. The
location and redundancy arrangements need to be designed in full cognisance of the fire scenarios
and how they are influenced by interaction with the weather.

The effect of power loss on the operation of all safety critical items should be reviewed early in
detailed design.

7.2.5.8 Fire and gas detection

Fire & Gas detection systems monitor and provide early warning of fires and flammable or toxic
gas releases on the installation. The detectors are required to detect the presence of fire or gas as
rapidly as possible. They provide information on the location of the gas cloud or fire and then raise
an appropriate level of emergency alarm to the operating teams and executive action where
required. The alarms should also indicate whether the event is confirmed by other detectors, by
virtue of their voting arrangements, combined with detector location identification, the operating
teams should be able to start to piece together what the fire or gas event is doing.

It is important that the value of gas detection remaining functional following an incident is realised
in the design and the ER arrangements. To provide the response teams and operating teams with
adequate information to plan responses and ultimately to investigate safely the pre-cursors to the
accident are extremely valuable.

Generally, flammable gas detectors should be located throughout the process areas and locations
such as:
• Open process areas;
• Non-hazardous area HVAC air intakes, ventilation air intakes of equipment
enclosures; and
• Any enclosed/semi-enclosed space where gas may accumulate.

Plus the location of the gas detectors should take into account:
• Leakage sources within the area and areas for potential gas accumulation;
• Potential gas or vapour cloud size;
• The gas or vapour composition, temperature (on release) and density;
• Access for maintenance and calibration of the detectors (so that they retain their
performance standard);
• The location of personnel access routes and especially escape routes (to identify
potential impairment).

The aim of the detection systems should be considered carefully, and that they detect the events
postulated for the installation and act as a coherent component of an overall fire hazard

152-RP-48 Rev 02, Feb 2006 Page 204 of 261

fireandblast.com

management strategy. An illustration of how this approach supports safety is in the increasing use
of improved smoke detection in accommodation areas. The traditional protection method for
accommodation units was to supply sprinkler systems, in line with onshore hotel practice, however
investigations have shown that there can be significant smoke generation without much heat in
small smouldering fires of nominally domestic material. The potential for injuries arising from
smoke inhalation is significant. An alternative strategy has been to improve the sensitivity of smoke
detectors and enforce a “no smoking” policy within the accommodation, thus implementing a
preventative strategy.

Newer technology applications such as acoustic gas detectors are available and these will detect
leaks regardless of whether ventilation systems or open modules disperse the leaked material.
Current acoustic detection equipment can be shielded against turbine, compressor and air tool
sourced ultra-sonic noise. In addition, there are also fibre optic laser devises available that are
calibration free and non-energetic.

7.2.5.9 Fire protection (active and passive)

In most major fire accident hazards, the active fire protection system primarily relies on automatic
and remotely activated fire protection systems. Manual fire fighting facilities are only relied upon in
circumstances where the fire hazard is readily controllable, where evacuation in the event
escalation can be implemented very rapidly or as has been found in the UK Southern North Sea on
NUIs, that the maintenance load of the safety equipment added to the risk to which the crew were
exposed.

Nevertheless, manual fire fighting facilities (e.g. hydrants, hose reels and fire extinguishers) are
often provided in all areas to permit rapid intervention on small fires or to support the rescue of
injured or trapped personnel.

Fixed active fire protection systems are based on firewater pumps feeding a firewater distribution
network, the network can be supplemented by foam-concentrate systems (tanks and pumps
feeding a foam-concentrate distribution network). Some areas, notably helidecks, will also have
monitors and hydrants to provide adequate coverage. In addition, where appropriate, such as
control rooms, total flood gaseous or water mist extinguishing systems can be be used.

The passive fire protection arrangements (PFP) will take the form of structural barriers, insulation
or fire retardant coatings and will be used to protect walls, decks and structural members. They
should be used to protect against defined credible fire hazards that are capable of causing failure,
and should take into account the fire size, duration, location and intensity. Passive protection
measures will often be used in critical areas where the assumed 100 % reliability of PFP is
required. Refer to Section 7.3.2.2 for further details.

7.2.5.10 Drains

The drain system design should be carefully checked. There have been many fatalities and near
misses due to hydrocarbon ingress to safe areas via drains. Specifically:
• Never mix separated process water and drains in one caisson;
• Water seals in drain systems are unreliable protection devices;
• Never allow process hydrocarbons into open drain systems;
• Use of process pressure by operators to ‘blow down’ liquids to the closed drains
system should be forbidden unless the system is specifically designed for this
practice;
• Accommodation and sewage drains should be independent from any other drains;
• Deluge operation must be taken into account in drain system design;

a) HAZOP of drain systems is essential on large, integrated platforms;

152-RP-48 Rev 02, Feb 2006 Page 205 of 261
fireandblast.com

b) Drains capacities must take account of the vessel inventories in their specific areas and
effects of bund systems.

7.2.5.11 HVAC

HVAC has a key function in dispersing and controlling gas and vapour releases, for example,
preventing gas clouds from coming into contact with ignition sources or diluting toxic releases such
that they pose a lesser hazard to personnel. There are key design features that enable the HVAC
systems to achieve these roles, some of these are listed below. It should be noted that with such
functions that the HVAC systems will be designated as Safety Critical Elements:
• Locate HVAC intakes optimally with respect to gas releases and fire scenarios.
• Penetrations between such areas should be kept to a minimum and any
penetrations for piping, cables, ducts, etc. should be adequately sealed. For
heating, ventilation and air conditioning (HVAC) penetrations, dampers where
provided, or ductwork should be of the same fire integrity as the boundary through
which any ductwork passes.
• The duties of extraction systems from enclosed hazardous modules should be
carefully considered, they may be required to effect extraction of gases or
hydrocarbon vapours and their eventual exit point should not contribute further to
any escalation..
• The continued operation of the HVAC system may be required to be safety critical
(for example, for a control room within a process module following a gas release).
Suitable safety measures to protect the system and ensure its continued function
and survivability will be required.
• Deciding on the optimal ways to protect against gas ingress, by generating positive
pressurisation in “safe” areas or sealing the areas via the use of HVAC dampers.
However, experience has shown that HVAC dampers are often difficult to access
and may suffer from reduced reliability as they age. If used, access to and
maintenance of dampers should be considered very carefully.

7.2.6 Construction/commissioning phases

During construction many minor alterations take place. Some may have potential for negating
designed-in safety features. It is thus important during commissioning to:
• Monitor construction for on-site changes to design;
• Ensure that personnel installing safety systems (PFP application, valve installation
etc) are competent and properly supervised;
• Ensure installation personnel have easy access to the design engineers so they can
check out any reservations/problems they have during installation/commission;
• Use checklists, punch lists etc are used to ensure all items are finished, tested and
properly handed over to operations.

7.2.7 Operational phase

Despite all the money that is spent during the design and construction of offshore facilities, the
transfer of key fire-safety information from the design team to frontline offshore staff (OIM,
supervisors, emergency response personnel) is often neglected. This should be separately and
adequately budgeted for at the outset of the project:

• Operational and maintenance staff and contractors based offshore will take over the
operation and maintenance of the safety systems. Supervisors need to be given an
overview of the fire scenarios and told about the design intent of the safety systems
they inherit. Offshore supervisors are under considerable time pressures offshore. It
152-RP-48 Rev 02, Feb 2006 Page 206 of 261
fireandblast.com

is not reasonable to expect them to absorb this information from the risk
assessment documents and the Safety Case is unlikely to provide the level of detail
required.

• Without the above knowledge there is potential for work permit approvals or on-site
risk assessments to miss important issues.

• Maintenance and testing of SCEs must be adequate to prevent degradation of the

installed systems. The impact of degradation may not be obvious without the above
training.

• The fire and explosion scenarios and the escalation timeframes must be captured
and incorporated into the platform-specific emergency response plans. Scenario-
based, platform-specific emergency response exercises should be carried out
periodically throughout field life. The quality will depend directly on the quality of the
engineering input to these exercises.

7.2.8 Plant modifications

Equipment, plant and personnel changes should be monitored and their impacts on fire hazard
management assessed. The changes may be significant such as a substantial change of
inventory, or they may be a revision to maintenance schedules that potentially reduces the
reliability of detection or protection systems.

The “soft” changes such as personnel changes with subsequent loss of experience, or loss or
records are the most difficult to control and track. Management practices may impact a system in
ways that will only become evident after some considerable time unless they are specifically
reviewed with respect to influence on fire hazards.

Some changes can be properly planned as they are regular and predictable, change-outs of OIMs
and supervisors are frequent and it easy to track and enforce the maintenance of skill levels (if not
knowledge levels), by providing new personnel with the same (or better) level of training as the
original personnel.

7.3 Best practice for fire protection systems

7.3.1 Introduction

Although every effort may be made to minimise topsides inventories and likelihood of leaks, there
is always some level of hydrocarbon fire risk left. Thus fire protection systems need to be provided
for the benefit of personnel, plus protection of the asset and the reputation of the company.

The design philosophy for fire protection systems has changed over the last decade and a half
from being code-based to scenario-based. The design of a fire protection system for any area of
the installation must now be shown to be appropriate for the potential fire loads and resultant
consequences. This is a very different approach from the code-driven approach where water
deluge requirements were set for different parts of the installation. This ‘one size fits all’ code-
based approach is no longer acceptable. Design must start with understanding the type of fire, the
period for which it may persist, the time-line for all the potential fire escalation events, times to
structural failure and effects on escape and evacuation of personnel.

Once the fire, and its interaction with the safety of personnel and the preservation of the asset is
understood, the most appropriate combination of active and passive fire systems to achieve the
necessary degree of protection can be considered. Generally, the use of passive protection is
preferred over active protection, due to its inherent reliability. On a typical platform there may be
several different active protection systems (including manual fire fighting equipment) plus different
types of passive protection. These measures are discussed further in Section 7.3.2.
152-RP-48 Rev 02, Feb 2006 Page 207 of 261
fireandblast.com

Examples of the types of protection system in common use are given in the table below.

Table 7-1 Fire types and common methods of protection

Type of fire Type of Protection Aim of Protection

Jet fire impinging on PFP cladding on vessel Protect vessel against BLEVE until blowdown
process vessel complete
Pressurised liquid PFP cladding on roof support Delay structural failure of roof beams until platform
spray fire in partially beams plus high rate deluge evacuated. Suppress fire and cool process and
enclosed module (24 l min-1 m-2) application to safety equipment.
module.
Pool fire in open Low rate deluge Control/extinguish fire by cooling oil pool and putting
process module with (10 l min-1 m-2) with AFFF layer of AFFF on pool surface. Cool process
solid floor equipment to prevent further leaks. Reduce smoke
plus wash spill to deluge drains
Spray fire across Firewall (or escape tunnel on Protect people escaping to TR from spray-fire and
escape route F(P)SO) radiant heat effects
Gas jet fire in vicinity Mesh screens on stairwell Reduce radiant heat on stairs
of stairwell
High pressure jet fire PFP on export ESDV plus all Delay escalation to riser fire until after platform
in export module sections of downstream evacuation completed
export pipework in module

The table demonstrates how the protection has to be specific to the requirements of a number of
differing fire scenarios. Recent research on deluge systems has emphasised the importance of this
approach. Potentially there are 3 main roles for deluge:
1. Cooling of exposed process and safety equipment
2. Cooling and control of pool fires through suppression of fuel vaporisation
3. Cooling of the high hot zone through interaction with the combustion process

These approaches require totally different design philosophies and one “catch-all’ design for
deluge systems cannot achieve them all.

7.3.2 Fire protection design

7.3.2.1 General

This section discusses some design issues associated with particular applications of passive and
active fire protection.

7.3.2.2 Passive systems

7.3.2.2.1 Firewalls

Design of firewalls is well understood. They should be designed to a specific fire rating compatible
with the fire scenario for which they offer protection. Wherever a firewall is placed, due
consideration needs also to be made for any deflection of flame by the firewall, plus the movement
of the smoke and hot gases that accompany the flame. Products of combustion do not disappear
when they encounter a firewall but build up or migrate. All firewall ratings and the extent of the
firewall whether jet fire rated or only A0 rated, should be indicated on the appropriate drawings The
design basis must be clearly recorded for future reference– other wise justification of worthwhile
future changes becomes difficult. Penetrations and doors must be designed to the same rating as
the firewall itself.

152-RP-48 Rev 02, Feb 2006 Page 208 of 261

fireandblast.com

Firewalls are often provided for area segregation. On many installations combined fire and blast
rated walls divide the process areas from the wellbay and the wellbay from the utilities and
accommodation areas giving multi-barrier protection across the platform from the high hazard
process end to the low hazard accommodation end. This strategy is simple and effective when
designed in at concept stage. Blast walls with superimposed PFP must be assessed for the
integrity of the PFP following deflections of the wall during an explosion.

TR/ accommodation and control room wall are usually fire-rated. The rating must be defined by the
potential fire exposure. On NUI platforms where TRs are often very small, the TR may be located
behind a firewall segregating the open process areas from the enclosed units such as the
control/electrical room and TR/day room. It needs to be large enough to provide real protection.
Smoke and radiant heat effects around the edges of the wall and the effect on people leaving the
TR to evacuate the installation must be considered in the design.

Firewalls are usually composite items consisting of a structural part and an insulating part, both
parts need to retain their integrity for the life of the installation. Discussions of firewalls and other
PFP can be found in Sections 3.5.1 and 3.5.2.

7.3.2.2.2 Mesh screens

These reduce heat radiation on escape routes by approximately 50 %, provided the flame is not
actually impinging on the route. They are frequently used to protect open stairways. They are
cheaper than firewalls and offer less protection, but have their place for gas jet scenarios provided
good diversity of escape routes is available.

7.3.2.2.3 PFP on structures and structural supports

Before design starts it is important to understand the temperatures at which structural failure will
start and the consequences as the fire continues and heat increases.

Whatever the design basis, the redundancy in the structure and the consequences of failure during
a fire should be explored in discussions between the structural or marine engineers, the safety
engineer and the designer of the passive fire protection system. Derivation of fire loadings and
response of steelwork to fire attack is covered in Sections 5 and 6 respectively.

Attachment systems for the PFP must be given detailed consideration in view of the cycles of
expansion, contraction and flexure experienced by steelwork in offshore applications.
Disintegration and separation of heavy PFP cladding materials from walls or other structural
supports is still causing problems on existing older installations. Likewise retrofitting of PFP
offshore e.g. externally to the underside of TRs on small gas platforms has proved both costly and
temporary. Modern methods of attachment are much improved however. Best practice requires
close attention to detail, especially in meeting the requirements of the manufacturers specification
for installing the PFP. Wherever possible, PFP should be installed onshore, under controlled
conditions. Modern trends for smaller topsides that can be fabricated onshore and installed in one
heavy lift make this a much more viable option.

High pressure gas jet fire impingement on PFP, particularly of the early intumescent epoxy type
has been found to cause rapid degradation of the material. PFP systems are now available which
are resistant to jet fire attack. Where jet fire impingement is likely, and could be sustained for more
than a one or two minutes, type-testing of the selected PFP system should always be specified. A
Jet fire test standard has been developed in the last few years based on industry research and at
time of writing is becoming available as a draft ISO standard (22899-1). A jet fire rating equivalent
to an A or H rating has been proposed in the latest draft version of the ISO, (based on the jet fire
test criteria proposed in ISO 13702) specified as: Type of application / Critical temperature rise (ºC)
/ Type of fire / Period of resistance (minutes).

152-RP-48 Rev 02, Feb 2006 Page 209 of 261

fireandblast.com

Floating structures have a different structural design basis (widespread use of integrated, stressed
skin designs) to that for a fixed steel jacket with modular topsides construction. Where fire or
explosion in these areas is catastrophic the possibility of occurrence should be designed out,
rather than reliance placed on protection systems. For this reason pipework containing process
hydrocarbons should be avoided inside support columns or pontoons unless they can withstand
the predicted fires/explosion overpressures.

All PFP applications must take account of the need for periodic inspection of key parts of the
underlying structure. This can be catered for by providing inspection hatches. However, it must be
emphasised that PFP integrity must be sufficient to prevent the ingress of water and subsequent
corrosion under the insulation and that the application of inspection or access points must not
degrade the “water-tightness” of the PFP.

7.3.2.2.4 PFP on process vessels

PFP is the preferred method of protecting vessels from heating up and failing when exposed to fire.
Water cooling is possible but not as reliable and requires large amounts of water. Leaks from
vessels caused by heat distortion are often capable of adding large inventories to existing fires and
if the fire exposure is severe, unprotected vessels could BLEVE with devastating consequences.

The main concern with PFP on vessels is that it makes NDT of the vessel difficult. Given that
ongoing corrosion monitoring is an essential feature of most asset integrity programmes this has
been seen as a major drawback. Removable PFP is sometimes used, but this is susceptible to
water ingress under the cladding and can lead to external corrosion. Also it can become custom
and practice to leave large parts of the vessel bare of cladding for long periods for ease of
inspection (especially where the vessel is already known to suffer corrosion problems), thus
reducing the availability of the protection.

Where the primary concern is BLEVE protection, and given that it is the gas space of the vessel
that needs protection rather than the liquid space, recent ideas are that cladding may not need to
be provided to the base of the vessel, to obtain the BLEVE protection. This is because the liquid
inside the vessel provides protection against rapid heat-up of the vessel walls. This is subject to
careful analysis and understanding of liquid levels under all process conditions.

Research in the last few years has shown that for vessels subject to severe fire impingement, the
existing API codes 520 [7.7] and 521 [7.8] are inadequate for specification of the pressure relief
arrangements to prevent BLEVE. Vessels protected in accordance with these codes have burst
resulting in a BLEVE within 5 minutes following attack by jet flame or engulfment by confined pool
fire. New guidance has been produced setting out the design considerations for process vessels
and their pressure relief systems for BLEVE protection. For design against BLEVE events
engineers should design in accordance with the Energy Institute Guidance Document “Guidelines
for the design and protection of pressure systems to withstand severe fires” [7.9] which was
published in March 2003.

As noted above, the integrity of “water-tightness” of PFP is a key issue and loss of water-tight
integrity has been found to generate problems of accelerated corrosion on ageing installations.
There is an added issue with piping and vessels where there is the possibility of temperature
cycling, condensation may accumulate under the insulation. Inspection points will be required to
monitor such systems.

7.3.2.2.5 PFP coating of risers

Additional considerations for the application of PFP are discussed in Section 3.5 of this document.
Consideration of protection for riser barrier valves and other emergency isolation valves is covered
below in the sections on PFP Enclosures and PFP Wrappings.

Water tightness of risers is a key issue when the PFP goes down to the “splash zone”, issues of
water ingress are added to potential damage by wave action.
152-RP-48 Rev 02, Feb 2006 Page 210 of 261
fireandblast.com

7.3.2.2.6 PFP enclosures for safety critical items

An alternative method of protection for safety critical items such as ESD valves and their actuators
is installation of a PFP enclosure around the item. Design considerations for enclosures are:
• Because they usually have to be have to be custom designed to suit the duty, the size
and the location, costs can be high;
• They have to be designed to resist explosion overpressures for the particular area (and
on some platforms potential for wave-slam has also to be considered);
• In-situ installation may be complicated by access problems, although for new build
projects this can be done early, before access problems are created;
• They have to be removable or otherwise designed to allow entry for essential repair and
maintenance. The design also has to take into account that after repair/maintenance the
unit will have to be restored to its original design specification. The costs of proper re-
instatement offshore throughout field life need to be considered from the outset of
design.

Most importantly, it is no use protecting a specific item of safety-related equipment if escalation will
then take place through failure of the pipework on either side of the fire protection. In designing any
PFP system, an holistic view of the whole module, must be taken. Design of protection for just
‘safety critical’ items in isolation can lead to inefficient safety spends.

7.3.2.2.7 PFP wrapping / blankets

In recent years soft wrapping jackets for protection of valves or critical piping sections have
become popular as, by comparison with box-type enclosures, they are relatively cheap, easy to
design and install, and can be removed to allow inspection. The potential for such systems to
promote external corrosion of the protected item remains but the extent of the corrosion can be
visually monitored when the wrapping is removed for maintenance etc. The paint or coating system
under the lagging should nonetheless be to a high specification.

Such systems tend to be rated for short-term protection e.g. 5 or 10 minutes. Thus, they can give
useful protection where inventories are small, or rapidly blown-down. With respect to enclosures,
they must be re-instated after every disturbance for maintenance/repair/inspection by personnel
who have been suitably trained for the task. It should be noted that offshore inspections indicate
that they are easily damaged and repeated removal and re-wrapping tends to damage their
fastenings but that their use is successful if trouble is taken to ensure proper fixing and re-fixing.
The key issue is to ensure that the wrap is securely and properly fastened, otherwise it may come
off or be damaged in an explosion and hence not be able to provide the required fire protection
during any subsequent escalation.

7.3.2.3 Bunding and draining for liquid fires

Bunding and draining is also considered a form of passive fire protection. Bunding is used to
contain oil pool fires which would otherwise spread to other areas and/or prevent any AFFF in the
deluge system from working effectively. Designers must also ensure that bunds provided primarily
for environmental purposes do not potentially concentrate a pool fire around an area of plant,
exposing it to a higher level of risk.

Drain design must take into account the interaction and disposal of both the fuel and the deluge
release. Where drains are critical for fire hazard management, they must be designed for easy
inspection, maintenance and testing so that their performance standard is always met. Offshore
drains are susceptible to blockage and the design should aim to minimise this.

152-RP-48 Rev 02, Feb 2006 Page 211 of 261

fireandblast.com

7.3.2.4 Active systems

7.3.2.4.1 Firewater system design

In the 1980’s and early 1990’s firewater system design was code-based and the now-repealed
SI 611 [7.10] laid out water application rates for different area of an installation. Best practice is
now to design for the specific fire scenarios in the area to be protected. Firewater tests carried out
at Spadeadam in Cumbria in the late-1990s identified that deluge rates required for fire control
depend on the type of fire, not just the area designation.

The deluge application rates recommended in view of the findings of both the above research and
earlier Norwegian research into the characteristics of confined hydrocarbon fires, are summarised
in the following table.

Table 7-2 Deluge application rates

Hydrocarbon Fire
Deluge Application Rate Additional Comments
Type

Oil Pool Fires 10 l min-1 m-2 Suitable provided the cause of the pool fire is not a
two-phase (spray) release. Addition of AFFF is
beneficial
Hydrocarbon jet or General area deluge not Key items (e.g. riser sections, riser ESDVs,
spray fires suitable for protection of vessels with BLEVE potential) should be protected
(impingement) specific items against by other means (PFP or targeted, very high rate
impinging jet fires deluge)
Jet or spray fires 20 l min-1 m-2 AFFF can help control residual hydrocarbon pool
(radiant heat exposure) general area cooling for fires, but does not contribute to cooling of heat-
plant exposed to radiant exposed plant
heat from jet fire in vicinity
Well head fires 400 l min-1 m-2 per wellhead The objective is to prevent fires on one wellhead,
affecting adjacent wellheads
Gas-only jet fires Where gas jet is large in This is often the case for small, open, normally
comparison with size of unmanned gas platforms. Money here may be
module or installation, better spent on rapid detection, isolation and
deluge may be of limited blowdown coupled with PFP of key valves.
benefit.
Directed deluge on 100 l min-1 m-2 Horizontal cylindrical storage vessels should be
tanks impacted by protected by means of open medium velocity
flashing liquid propane sprayers, not less than 6 mm bore, operating at
jet fires pressures between 1.4 and 3.5 barg and should
have cone angles between 60° and 125°.
Fire Office’s Committee’s “Tentative rules for
medium and high velocity water spray systems”
[7.11]

Reference should also be made to Section 5.2 for further discussion on the issues of deluge rates
with respect to different fire types.

For fires giving free flame volumes in the order of 25 % to 35 % of module volume, there will be
widespread and simultaneous heat input to the top half of the module. This has implications for
safety systems, structural supports and process equipment (especially the tops of process vessel
which could suffer a BLEVE) located at high levels in most process modules.

152-RP-48 Rev 02, Feb 2006 Page 212 of 261

fireandblast.com

Hydrocarbon fires generate a very hot layer, of partially burnt gases a few metres deep at ceiling
level from releases of a relatively small size (with a burn rate from around 1 to 3 kg s-1) in enclosed
modules, whether partially or fully ventilated. This occurs for any hydrocarbon fire whether all gas
or all liquid. However non-pressurised liquid releases burning as pool fires are much easier to
control by deluge than fires fuelled by 2-phase pressurised releases.

The layer of hot gases can reach 1000 ºC within a few minutes if the fire is sustained for that
period. Tests have shown that dry deluge systems can be destroyed by the heat prior to their
operation; designers should consider some of the following issues in their design requirements.
• Where enclosed modules are desirable for other reasons or otherwise unavoidable, the
process should be designed for isolation and blowdown to prevent or minimise ongoing
severe fires;
• Safety control components and systems should not be vulnerable to damage from
heat build-up effects while they are in operation;
• The risk of structural failure at ceiling levels should be taken into account;
• The design of deluge systems should recognise and mitigate the consequences of
these scenarios, that is;
o Provide systems that deliver the necessary deluge rates as fast as possible;
o Provide mechanical support systems that will not fail before the deluge
brings the fire under control;
o Consider installing fine spray deluge specifically to cool the top few metres
of ceiling space.

Once the flame volume in the module exceeds around 25 % of the module volume, it is very likely
that flame and smoke will occur beyond the confines of the module such as at the locations of any
openings in the module walls. When the flame volume reaches 100 % most of the combustion will
be taking place beyond the confines of the module as the partially combusted hot gases reach a
source of oxygen. This effect exposes other areas to the fire risk and can also set off the other
areas’ deluge systems, thus potentially reducing the fire protection to the source module. The
design of the deluge system and the structural protection needs to consider these escalation
scenarios.

In general, with the exception of riser inventories, it is the liquid inventories that are capable of
producing and sustaining these high flame volumes after ESD and blowdown. Temperatures close
to the flame can be around 1350 °C, with heat fluxes in excess of 350 kW m-2. The overall platform
process design should remove the potential for large, sustained, pressurised hydrocarbon fires,
however, the combined design of deluge and PFP systems, to mitigate against the remaining
scenarios, may be expensive in view of the need to control the consequences of such fires.

In unpublished reports of tests, it has been found that a deluge rate of 12 l min-1 m-2 for a
pressurised jet fire had little impact on hydrocarbon gas jet or spray fires, but did reduce the heat
fluxes at ceiling levels from around 300 kW m-2 to 200 kW m-2. Increasing the deluge rate to
24 l min-1 m-2 reduced peak ceiling fluxes from 350 to 60 kW m-2, suppressed the flaming
considerably and changed the smoke from dense black to a grey mixture of steam and entrained
carbon particles. It is not clear whether these benefits arose because the water droplets at the
higher deluge rate were smaller, or because the water rate doubled.

In the same reports, the heat imparted to process vessels/pipework by an impinging sonic gas jet
flame was found to be little reduced by general area coverage of 24 l min-1 m-2. This rate did
however reduce the rate of heat input from an impinging simulated live crude pressurised spray
release. It was not possible to confirm whether this reduction was sufficient to prevent eventual
failure. Specific deluge at 10 l min-1 m-2 directed to the vessel using a conventional array of
nozzles, in conjunction with 24 l min-1 m-22 general area coverage appeared to halt the rate of rise
of the vessel surface.
152-RP-48 Rev 02, Feb 2006 Page 213 of 261
fireandblast.com

A general area deluge of 12 l min-1 m-2 should be able to control the burning of pool fires, but with
some reservations concerning the actual water volume reaching the flaming surface. (For more
detailed discussion, refer back to Section 5.5.3.4.1).

Again, unpublished reports of tests have indicated that for vessels exposed to pool fires, specific
deluge coverage as per NFPA 15 [7.12] (10 l min-1 m-2) provided effective heat exposure
protection.

7.3.2.5 Component – specific design issues

A brief discussion of design issues associated with key components of typical North Sea deluge
systems is presented in the paragraphs below:

7.3.2.5.1 Fire pumps

Modern designs are based on an absolute minimum of 2 x 100 % fire-pumps, each capable of
supplying the entire system needs. On open- design installations, especially where deluge is
activated on gas detection, this must take into account the fact that more than one or two areas
may be set off simultaneously. This enables the platform to continue operating when one pump is
out for maintenance. A variety of alternative fire pump configurations (e.g. 4 x 50 % pumps), are
possible, based on analysis of vulnerability to fire scenarios, cost, operating characteristics,
maintainability, flexibility and system start-up reliability. ‘Cross-over’ valves allowing service water
to be diverted for fire-fighting use can be useful, with appropriate safeguards against reverse flow
and over- pressure. Fire pumps and their power units should be located diversely, in safe
locations, in order to reduce the possibility of a major accident event rendering the entire system
inoperable. Materials of construction must be suitable for the marine operating environment and
the life of the installation. Parts that may fail early should be identified in advance and spares held
or ensured readily available.

The pumps need to be independently powered as the platform main power generation system is
generally designed to shut down in serious fire and gas release situations. Modern pumps are
usually electric submersible pumps, located in firewater caissons and powered by topsides diesel-
generator sets. Older pumps tend to be traditional diesel fire-pumps, taking suction from pipes run
inside firewater caissons, terminating below wave action depth. Start-up reliability is crucial and
can be a deciding factor in determining the number of pumps in the systems. Although design is
always for automatic start-up, back-up manual starting arrangements are generally required and
should be tested regularly.

Experience shows that fire pumps slowly deteriorate (i.e. they exhibit a gradual drop-off in peak
delivery capability) over the years, regardless of the fact they spend only a fraction of their life in
actual operation. They are started-up and discharged to hydrants or overboard dump lines at
regular intervals to prove their continued readiness for service.

7.3.2.5.2 Firewater ring mains

On most platforms the fire pumps all discharge (at different places) into a firewater ring main,
which runs around the perimeter of the installation at a low level. In this position advantage can be
taken of the protection from fire and blast damage offered by main structural support beams.
Pipework then rises off the top of the ring main to distribute water to the deluge sets (which supply
specific modules), hydrants, hose reels and sprinkler or water curtain systems. Several isolation
valves are provided on the ring main. The advantage of this fairly standard ring main type of design
is that if one area becomes damaged, the affected section of the ring main can be quickly isolated
and supply continued through the undamaged sections. Ring main isolation valves may be locally
or remotely operated, but they must be clearly identified, easily maintained and accessible for
operation in an emergency. Some operators also provide secondary ring main riser pipework either
to critical areas or where the primary riser supply to an area is vulnerable to fire/explosion damage.

152-RP-48 Rev 02, Feb 2006 Page 214 of 261

fireandblast.com

One of the most important considerations for an offshore firewater system is speed of initiation. To
keep delays to a minimum, ring mains are filled with seawater and held at pressure ready for
immediate use. Any significant drop in pressure, caused by a demand on the firewater system (e.g.
fire detection activates a deluge valve, thereby supplying water to the deluge pipework) initiates
automatic start-up of the fire-pumps. To prevent pressure fluctuations in the system frequently
starting and stopping the main firewater pumps, the pressure is held at around 8 to 12 barg, by a
small pump supplied from the service water system.

Because firewater ring mains are usually large-bore and contain salt water they are not lagged or
heat traced. However in extreme winter conditions freezing is not unknown. As an added
precaution, many systems provide for a continuous slight circulation within the system by dumping
a small flow back to sea. The smaller pipework rising off the ring main is usually lagged and heat
traced. In smaller systems, dry ring mains are often used as long as the time taken for fire water to
reach deluge or monitor nozzles is acceptable. The use of dry ring mains does eliminate corrosion
and freezing issues (see the next Section 7.3.2.5.3).

Ring-main and riser pipework corrosion is a major issue, thus Cunifer is the usual material of
choice for the wet parts of the system. Older platforms with carbon steel ring mains run the two-fold
risk of wall thickness loss and build-up of corrosion products throughout the system. Designers
choosing steel over Cunifer in the past for cost saving have passed the cost of replacing or
maintaining such systems onto operational staff working on a diminishing budget ten or so years
later. Linings or surface treatments for carbon steel ring-main pipework have been used with mixed
success. Corrosion inhibition can be used, but consideration must be given to treating the dead-
legs in the systems, such as the wet riser pipe sections between the ring main and the deluge
valves.

Composite materials such as GRP or specially developed fireproof elastomers have also been
used for firewater piping. These can possess significant corrosion, weight, flexibility and price
advantages. Key concerns for such alternative materials remain.
• Can they be properly installed, maintained and repaired in-situ (some need
specialist installation)?
• Will they melt in the event of serious fire attack, either before of after deluge water
reaches the distribution pipework and nozzles?

As an alternative to traditional ring-main design, some operators arrange their fire-pumps to

directly supply different parts of the installation directly. Choice of system has to be justified with
respect to effectiveness for the specific fire-scenarios, vulnerability to fire damage, and the
reliability requirements for the system.

7.3.2.5.3 Deluge valves and dry pipework

The deluge valves separate the wet part of the system from the dry pipe network that supplies the
firewater nozzles. These valves are usually air-activated either by loss of air when fusible links or
bulbs are breached by fire, or when solenoids are activated by the fire and gas detection system to
dump air. The valve opens to feed water into the dry pipework that leads to the firewater nozzles.
Design needs to focus on maintaining the air pressure for very long periods (i.e. the whole of field
life). Any leaks or pressure accumulator failures in later life will trigger off the deluge system in the
affected section. Repair downtime on safety critical systems is likely to be expensive.

Deluge valves need careful design and maintenance since their operation is complicated especially
for valves which have AFFF proportioning as part of their function. Deluge valves may be at the
junction of the Cunifer and steel parts of the system, so dissimilar metal corrosion protection must
be designed in. Valve sets should not be located immediately outside the area they are designed
to protect. A manual operation lever, very clearly labelled in large writing, should be provided. This
allows for override of the deluge valve should it fail to operate, or if water is needed as a priority
elsewhere on the installation.

152-RP-48 Rev 02, Feb 2006 Page 215 of 261

fireandblast.com

Hydraulic shock within the system can result either when main firewater pumps kick in, or when
deluge valves suddenly open. The shock can cause damage to the small-bore end-piping in the
system and its supports. It is important to consider and quantify this problem as part of the design.
Pneumatic dampers may need to be used. Slowing down the opening of the valves is not a good
idea if it means a delay in getting water through to the dry pipework. Minimising the delay time is
critical for 2 reasons:
1. The faster a fire is cooled the easier it is to bring under control and the chance of rapid heat
(and smoke) build-up is reduced.
2. The dry pipework and its pipe supports are mostly located high in the module and are
vulnerable to high temperatures. Small bore dry Cunifer or GRP pipe (depending on the exact
specification) may melt rapidly in a jet fire thus stainless steel or titanium alloys would be
preferred. Once water flow is established the pipework is provided with internal cooling.

Firewater pipework supports are also vulnerable to heat and may be unprotected by deluge
application, thus they require careful design attention.

The time between detection and getting water to the region of the fire should be minimised. Many
new designs are capable of getting water to the fire within 30 or 40 seconds of detection. NFPA 15
sets a target of 40 seconds for response time. Research has shown that for large fires severe heat
build-up can occur within one or two minutes of ignition.

Some systems in current operation have to rely on regular flushing either with firewater or potable
water in order to control build-up of corrosion products, salts, powder deposits (in some drilling
storage areas), scales etc. This is expensive and time consuming, especially where the
requirement was never envisaged or provided for, without flushing, the system can clog up but
sometimes the regular flushing accelerates the rate of corrosion. Modern designs now tend to use
larger ‘self-cleaning’ nozzles, less susceptible to blockage. These bring benefits in terms of higher
water application rates but also imply larger pumps and bigger supplies of expensive AFFF.

The grid of firewater nozzles covering a module or an area is designed to produce a specific range
of water droplet sizes The nozzles generally used for deluge are high or medium velocity nozzles.
The smaller the droplet the more likely it is to be evaporated or blown away between emerging
from the nozzle and reaching the fire. This is of concern for droplets under 0.5 mm diameter. and
an important factor in more modern, open platform designs. The larger the droplet the less affected
by wind and the more water provided to the fire for cooling, but the bigger the pump required. High
velocity nozzles produce droplets over 1 mm diameter. A large module may require a few hundred
such nozzles for adequate coverage. The pipe sizes may range from around 10” at pump
discharge to 1” and 2” at the nozzles. A full hydraulic analysis of the system is necessary to ensure
the necessary water distribution throughout the module will be achieved. Periodic testing of active
fire protection systems, both to ensure initial suitability (new systems) and continued compliance
with the stated performance standards (existing systems) is mandatory under the UK North Sea
legislation (PFEER).

7.3.2.5.4 Reference areas

The design of firewater systems in the 1980s and early 1990s was based on reference areas,
which were, generally speaking, hazardous areas of the platform bounded by firewalls. Typically
most reference areas were enclosed modules. Fire pumps were designed to supply only one or
two reference areas plus the helideck in a fire situation. With the move to more open platform
design this approach is usually not appropriate. Platforms are now divided into ‘fire zones’, each
defined both by area and fire characteristic and not necessarily bounded by walls. The fire
protection (or combination of protection systems) in each zone must be suitable for the fire
characteristics. With open platform design, a fundamental issue to address is how many different
zones could be triggered by each different release or fire scenario.

Where firewater in a number of different zones could be activated almost simultaneously the
pumps need to able to meet that demand. The alternative is to attempt to manage the supply so
152-RP-48 Rev 02, Feb 2006 Page 216 of 261
fireandblast.com

that it targets the right place by remote manual operation of valves or inhibition of a second fire
zone on activation of the first. Remote manual operation of valves in a fire situation is problematic
since it requires accurate feedback on the fire development to allow for decision making plus the
availability of a suitably trained emergency response and/or fire team. On some platforms, neither
may be available.

Reliance on local manual intervention to supplement the automatic fire system response has to be
realistically evaluated and only used where it does not expose the person(s) operating the valve to
danger from the fire/smoke. Huge firewater demands can be more easily avoided with proper
attention to:
• process isolation and blowdown;
• layout of plant and escape routes; and,
• passive protection of potential escalation points.

7.3.2.5.5 AFFF design considerations

Addition of AFFF to firewater systems can bring great benefits where used for liquid pool fires. It is
less effective for running pool fires. AFFF, and other types of foam, work by creating a layer on the
surface of the burning hydrocarbon pool, cutting off contact with the air. This reduces the fire and
smoke generation significantly, and may extinguish the fire altogether in some situations (e.g.
bunded fires). Foams, sometimes in combination with dry power application are important for
fighting aviation fuel fires. Design of foam systems should take into account affect of high winds
during application. Application must be possible from at least opposite quadrants.

Foams are expensive, especially in the quantities needed offshore. Good design of storage
facilities will avoid costly early degradation. Stored foam should be sampled and tested regularly.

Foam are injected either just downstream of fire pumps or at deluge valve locations or into the fire
hoses directly at the hydrant. Proportioning equipment of various designs, for injecting foam at the
right concentrations into the firewater supply, have proved unreliable in the past. The vendors of
such equipment should be asked to provide evidence of reliability and maintainability for their
systems and show they have a good track record in operation.

7.3.2.6 Area cooling and extinguishing systems

7.3.2.6.1 Water curtains

Water curtains have been used as a solution to reducing heat exposure of people on escape
routes, or critical plant items. Their advantage is that they do not exacerbate explosion
overpressure problems, but they have several disadvantages:
• The delay in activation means they are of limited use for immediate ignition
situations – but could be useful in delayed escape situations;
• In open locations they are affected by wind;
• There is limited research, but water application rates for effective operation were
found in tests to be high – in the region of 25 to 40 l min-1 m-2. A continuous screen
of water is required, achieved by flat plates or a combination of flat plates and
nozzles.

Further reference should be made to Sections 5.2 and 5.4 for discussions on the use of water
curtains. The attenuation of heat radiation by general area deluge is noted from research work to
be considerable. However at the time of publication there are no design methods for calculating the
personnel protection effect.

152-RP-48 Rev 02, Feb 2006 Page 217 of 261

fireandblast.com

7.3.2.6.2 Ceiling cooling

Where there remains a possibility of heat build-up at the roof level within an enclosed or partially
enclosed module, which could still be the case on some existing installations, new systems are
becoming available specifically to reduce heat at high levels within the module.

These systems are based on heat-resistant rubber-type tubing that can be easily site- laid and
fixed to the structural beams. Being flexible they will withstand considerable deflection without loss
of function during an explosion event, and they do not suffer from the same corrosion problems as
steel-based systems. They generate fine water sprays which provide cooling through evaporation
of the water droplets. The steam generated also retards the combustion process.

7.3.2.6.3 Water mist design

These systems are now widely used as the replacement for Halon protection of power generation
or fire pump enclosure. A variety of water mist systems have been developed over the 3 to 5 years
and are available on the market. They work by injecting bursts of very fine water mist into the
enclosure once fire has been detected. The mist evaporates, reducing heat and rate of burning.
They work in enclosed, limited inventory conditions. They do not offer protection against fuel gas
explosions in gas turbine enclosures, protection against explosions relies on a combination of
forced ventilation, early detection of gas build-up, and rapid isolation of the gas supply

7.3.2.6.4 Inerting and extinguishing systems

Halon is no longer used for offshore inerting / extinguishing systems. A few installations have
provided CO2 flood systems for extinguishing electrical fires, with appropriate safeguards against
asphyxiation, as a replacement. Many operators have removed the Halon previously provided in
switch-rooms and control rooms and replaced it with a VESDA (very early smoke detection and
alarm) system instead for better protection of personnel against electrical fires, (see Section 3.4).
This is in addition to the more traditional smoke detection systems in such areas.

7.3.2.6.5 Manual fire fighting equipment – hydrants and monitors

Previous legislation required hose stations to be provided in modules for use by fire teams. Teams
were trained to run hoses from nearby hydrants to supplement the fixed automatic systems if
necessary. More recent practice is to keep personnel in a safe place away from the fire and leave
the automatic systems to provide the all the necessary protection. Manual systems on newer
installations should be provided only where a legitimate specific need has been identified (for
example to cover temporary well test equipment on a top deck), the protection will be suitable for
the specific scenario, and a team of trained and competent fire or emergency response personnel
are available to operate the equipment.. The prime example of this is provision of helideck fire-
fighting equipment and personnel. Hydrants and hoses or fixed monitors (often fitted with an
automatic oscillating mechanism as well as manual control) are still provided where overhead
deluge systems are not practical e.g. on drilling rigs to target water onto escape routes and well
fires from a safe distance, or for protection of equipment on exposed upped decks where strong
winds could prevent proper deluge coverage. Manual hose facilities can also be useful in securing
large un-ignited spills with an application of aspirated foam

7.3.2.6.6 Manual fire fighting equipment – hose reels, trolleys and hand extinguishers

Manual firefighting equipment such as fire extinguishers, fire hose-reels and fire trolleys are still
provided offshore for use by personnel in the event that someone discovers a small fire which can
be safely bought under control by manual means. The main change in provision of such equipment
in recent years is that:
• Platforms are now occupied by much smaller workforces;
• Platforms no long support large fire teams;

152-RP-48 Rev 02, Feb 2006 Page 218 of 261

fireandblast.com

• Few installations run 24 hour operations;

• Small fires are less likely to be found and dealt with by a passing member of the
workforce, especially at night;
• Hot-work and intrusive maintenance work on some platforms is very infrequent;
• Oversupply of extinguishers etc places a significant burden on small offshore crews.

Account needs to be taken of all the above in deciding the appropriate level of manual equipment
to be provided.

7.4 Human factors – man / machine interface

7.4.1 Introduction

This section describes the ways in which operators and maintenance personnel are able to
implement and maintain the systems and practices put in place to manage fire hazards. The
following areas will be reviewed:
• Ergonomics;
• Working conditions;
• Working environment;
• Information presentation;
• Information availability;
• Organizational factors;
• Organizational culture.

The designers of fire hazard management systems should optimise the allocation of system tasks
and functions between humans and technology. However, taking tasks away from personnel is not
always the best solution as a number of considerations are involved, for example:
• The potential consequences of human failure;
• The flexibility that the human can bring to the situation;
• The long-term well-being of the human, the feeling of “being of value and needed”;
• Interest levels and boredom thresholds (leading to enthusiastic engagement to the task or
potentially dangerous disengagement);
• Design to minimise fatigue;
• Clarity and consistency of instrumentation;
• Layout of man/machine interface; and
• Clarity of emergency procedures.

In all areas but especially where the performance of safety critical elements (managing a major
hazard such as fire) is at stake, it is essential to set operational tasks within the limits of human
operators. Physical stress levels must be set at acceptable levels, for example for turning, lifting,
reaching etc. The presentation of information and the issuing of instructions or advice must be
obviously prioritised and unambiguous.

The response of personnel to emergency conditions (following Emergency Preparedness and

Emergency Response procedures) must be planned for in the context of the hazard. The
application of Human Factors techniques applied to planning for fire conditions will have a direct
potential to save lives and reduce the probability of injury.

152-RP-48 Rev 02, Feb 2006 Page 219 of 261

fireandblast.com

7.4.2 Assessment techniques

7.4.2.1 Overview

Several different types of analyses may be used in order to identify and analyse scenarios leading
to or arising from fires. The first two describe means of identifying tasks, allocating them logically
and then defining potential errors that may result from erroneous actions. The latter two
assessment techniques are from normal risk analysis approaches and may be expanded to include
human error and response.

Commonly applied techniques include;

1. Task analysis,

2. Human error analysis,

3. Fault tree analysis,

4. Event tree analysis.

The two specific Human Factors analysis techniques (items 1. and 2.) are discussed in more detail
below.

7.4.2.2 Task analyses

Task analyses support the identification of error modes, criticality and potential improvements by:
• Adding details to the scenario description;
• Specifying the context in which important actions (task steps) take place;
• Identifying aspects in relation to information, control and co-ordination which contribute to
performance shortfalls.

Task analyses would be the premier technique to use to confirm that operational and maintenance
tasks on fire hazard management tools and systems were achievable. The application of task
analysis would confirm that the implementation of the emergency response plans could happen
within the time frame of an escalating incident and it would identify preferred steps to be taken to
intervene to assist the control of any escalation.

Hierarchical Task Analysis (HTA) and Tabular Task Analysis (TTA) are the two variants of task
analysis techniques that may be applied.

Hierarchical Task Analysis describes the relevant task or operation from its overall objective down
to individual operations.

Tabular Task Analysis identifies the context in which important task steps take place and the
aspects which may be improved. The TTA format concentrates on:
• Cues; which indicate to the operator that a task step can/should be initiated;
• Feedback; which indicates the effects of carrying out a task step;
• Traces; which indicate to the operator that the task step has actually been
performed and finalized successfully.

152-RP-48 Rev 02, Feb 2006 Page 220 of 261

fireandblast.com

7.4.2.3 Human error analyses

Human Error Analysis provides a framework for understanding human errors, their causes and
consequences. Human error analysis is often referred to as the slips, lapses, mistakes and
violations model.

The Action Error Mode Analysis technique resembles the Human HAZOP and identifies human
errors for each task to be analysed. For each task step, possible erroneous actions are identified
using guide words such as ‘omitted’, ‘too early’, ‘too late’, etc. Possible abnormal system states are
identified, in order to consider the consequences of carrying out the task step (correctly or
incorrectly) during abnormal system states (e.g. specific hardware failures). The consequences of
erroneous actions, combinations of erroneous actions, abnormal system states and possibilities for
recovery are identified and described in order to support criticality ratings.

The application of the human error models would provide an understanding of the pressures on the
maintenance team to “get the job done” and would assist the operating and emergency response
teams to understand their role during a fire hazard emergency.

7.4.3 Awareness and competence

For fire hazard management to be successful, both in terms of initial design and continued
operation throughout installation lifecycle, key personnel at different levels of the organisation must
understand and fulfil their respective contributions to the fire safety of the installation. Although
many people will have many roles in design and operation, the following key personnel have some
essential requirements with respect to fire hazard management:

Project managers need to understand:

• The iterative nature of the fire-safety design process;
• The need to build contingency into time and cost estimates for reiterations;
• The importance of documenting the decision process for ALARP demonstration.

Safety engineers need to understand:

• That their role is to keep the discipline engineers fully involved in the fire hazard
management process;
• The importance of passing their knowledge of the key safety issues to offshore personnel.

All discipline engineers need to be aware of:

• Basic fire / smoke & explosion science;
• The “inherent safety / prevent / detect / control / mitigate /respond protection hierarchy.

OIMs need to understand:

• The fire scenarios, escalation mechanisms, escalation times and the role of protective
systems (including their failure to work);
• That Emergency response drills/exercises should be based on the platform specific fire
scenarios;
• Team response to fire of both trained and untrained (visitors) personnel.

Senior management need to know:

• Their legal obligations and how to discharge these duties;
• The wisdom of early consideration of, and investment in, fire issues;

152-RP-48 Rev 02, Feb 2006 Page 221 of 261

fireandblast.com

• What to budget for platform specific fire response training of OIMs and supervisors
transferring from one platform to another. (Very few platforms are alike, this is especially
important for older installations, which may have a lower level of fire-safety provision than
new ones).

7.5 Industry & regulatory authority initiatives

7.5.1 Fire and explosion guidance

The knowledge gained from the fire and explosion studies sponsored by the industry and HSE in
the aftermath of the Piper Alpha disaster was pulled together in the FABIG document “Interim
Guidance Notes for the Design and Protection of Topsides Structures against Explosion and Fire”
[7.13] issued in 1993.

The objective of the four-part Fire and Explosion Guidance (of which this document is part 2) is to
update the 1993 Guidance notes in the light of the research work carried out since 1993. This
4 - part Guidance is sponsored by UKOOA and HSE.

A number of other types of initiative relating to fire issues have been undertaken and brief details of
these and where to go for further information are presented below.

7.5.2 HSE internal guidance on fire and explosion

HSE has published a number of documents offering explanation or guidance in fire and explosion
areas for their own inspectors. These documents lay out the principles and methodologies which
HSE expect to be followed by Duty Holders in their design process in compliance legislation and
demonstrated in the Safety Case. These documents also assist offshore oil and gas industry
engineers, who can use these documents to ensure that their designs meet the expectations of the
regulatory authority.
• Fire and Explosion Strategy – This document presents an overview of the current state of
knowledge with respect to fires and explosions. As would be expected, it is focussed
around the hazard rather giving any specific guidance on designing against it. It highlights
that there is still much uncertainty in certain topic areas and suggests further work in a
number of areas. This document can be accessed at www.hse.gov.uk/offshore/information.
• Fire, Explosion and Risk Assessment Topic guidance - The aim of the guidance is to
promote greater consistency and effectiveness in the assessment of safety cases and
greater transparency for duty holders. It gives guidance to HSE specialist inspectors
assessing those sections of the safety case addressing fire and explosion issues. It serves
as a useful checklist for all persons involved in analysis, design or assessment of fires or
explosions and associated protection methods, to ensure fire and explosion issues are
covered in line with HSE’s expectations. This document can be accessed at
www.hse.gov.uk/offshore/information.
• Guidance for the Topic Assessment of the Major Accident Hazard Aspect of Safety Cases
(GASCET) – This document is intended primarily to assist topic assessors in undertaking
Safety Case assessment activities. It addresses the fire and explosion hazard as well as
other hazard topics and contains useful references to codes and standard that HSE expect
to see Operators using in their design processes. The document is still at internal
consultation stage; however the section on the Fire and Explosion topic is expected to be
largely a reproduction of that given under the preceding bullet point.
• Assessment Principles for Offshore Safety Cases (APOSC) – Paragraphs 26 to 34 of this
document set out the various aspects of the identification, analysis and protection for fire
and explosions hazards that the HSE expect to see demonstrated within the Safety Case.
The document is available from HSE bookshops as booklet HSG181 [7.14].

152-RP-48 Rev 02, Feb 2006 Page 222 of 261

fireandblast.com

7.5.3 Guidance on design and protection of pressure systems to withstand

severe fires

Following research work on the development of BLEVEs, the Energy Institute has published
guidance on design and protection of pressure systems to withstand severe fires. The research
showed that for certain fire scenarios the guidance provided by API RP 520 and API RP 521 is
insufficient to protect against BLEVE, or other severe fire events. The guidance is entitled
“Guidelines for the design and protection of pressure systems to withstand severe fires.” Further
details are available at www.energyinst.org.uk/publicationsdatabase.

7.5.4 Guidance on preventing hydrocarbon releases

Following analysis of the statistics collected by the HSE on offshore hydrocarbon releases since
1994, three guidance documents were produced through the Institute of Petroleum. In an
additional effort to disseminate the learning throughout the industry, the document entitled
“Hydrocarbon Release Reduction Toolkit” [7.15] was produced by UKOOA’s Hydrocarbon Release
Reduction Workgroup and through the Step Change website.

The IP Guidance addresses the most common causes of loss of containment in process related
systems. These are:

• Corrosion, erosion and fatigue in steel pipework;

• Vibration or mechanical failure in instrumentation;

• Improper make-up of flanges or other types of joints;

• Use of flexible hoses.

As a result of investigating and understanding the most common failure modes in these areas the
following IP guidelines were issued to assist in avoiding releases:
• Management of Integrity of Bolted Pipe Joints;
• Flexible Hose Management Guidelines;
• Guidelines for the Management, Design, Installation and Maintenance of Small Bore
Tubing Systems.

A fourth guidance document was produced by the Marine Technology Directorate:

• Guidelines for the Avoidance of Vibration Induced Fatigue in Process Pipework.

In the similar vein of working to reduce the frequency of occurrence of leaks, HSE have worked
with BP and a leading wellhead manufacturer on development of an inherently safer wellhead
design. This work was presented at the Offshore Europe Conference in Aberdeen in 2003, in a
paper entitled ‘Improving the Fundamental Safety of Xmas Trees and Wellheads for Platforms’ by
M. Copland, J. McKenzie and P. Webb [7.16]. The paper can be accessed via the SPE
(Paper no. 83997).

7.5.5 Improved ignition modelling

An updated ignition probability model is in the final stages of development, sponsored by UKOOA
and the Offshore Safety Division of HSE. It is based on input from OIR12 data.

7.5.6 Research on effects of PFP degradation

Work is being carried out to better understand the impact of degradation of PFP on its
performance.

152-RP-48 Rev 02, Feb 2006 Page 223 of 261

fireandblast.com

7.5.7 Collation of existing technical guidance relating to offshore major accident

hazards

The industry has recognised that while there is a wide range of informative technical guidance,
codes and standards available to the industry, a concise catalogue of this key information has
hitherto not been available to the industry and the HSE.

A catalogue has now been compiled through the Energy Institute, and is available from
www.energyinst.org.uk/offshorecatelogue.

152-RP-48 Rev 02, Feb 2006 Page 224 of 261

fireandblast.com

8. References
Reference titles to be inserted

152-RP-48 Rev 02, Feb 2006 Page 225 of 261

fireandblast.com

Annex A Acronyms, abbreviations etc.

To be added

152-RP-48 Rev 02, Feb 2006 Page 226 of 261

fireandblast.com
Annex B Glossary
Acceptance criteria
Stated limits, thresholds or boundaries of
performance and/or behaviour within which
performance is deemed to be acceptable to
the various stakeholders.
Accident
See 'incident'
Accidental event (AE)
Event or chain of events that may cause loss
of life, or damage to health, the environment
or assets
NOTE 1 - The events that are considered in a
risk analysis are acute, unwanted and
unplanned. For instance; planned operational
exposure that may be hazardous to health or
to the environment, are usually not included
in a risk analysis.
Active fire protection
A fire protection method that requires
activation – switching on, directing, injection
or expulsion – in order to combat smoke,
flames or thermal loadings.
Active mitigation
Mitigation technique in which the release of
suppressant is triggered as a result of flame
or gas overpressure detection.
ALARP
As Low As Reasonably Practicable, a
concept that forms the primary basis for
determining the tolerability of risks and the
adequacy of arrangements for managing
risks to health and safety. Duty holders (The
owner or operator of an existing installation or
the designer of a new one) have a
responsibility to reduce risk to ALARP.
152-RP-48 Rev 02, Feb 2006
ALARP
To reduce a risk to a level which is 'as low as
reasonably practicable' involves balancing
reduction in risk against the time, trouble,
difficulty and cost of achieving it. This level
represents the point, objectively assessed, at
which the time, trouble, difficulty and cost of
further reduction measures become
unreasonably disproportionate to the
additional risk reduction obtained.
Artificial ventilation
That ventilation which is not supplied from the
action of the environmental wind alone
As low as reasonably practicable (ALARP)
ALARP expresses that the risk level is
reduced (through a documented and
systematic process) so far that no further cost
effective measure is identified. The
requirement to establish a cost effective
solution implies that risk reduction is
implemented until the cost of further risk
reduction is grossly disproportional to the risk
reducing effect.
Auto-ignition temperature
The minimum temperature of a vapour and
air mixture at which it is marginally self
igniting.
Availability
The proportion of the total time that a
component, equipment, or system is
performing in the desired manner.
Availability
The probability of the system being available
to perform the function when required.
Page 227 of 261
fireandblast.com
Average individual risk (AIR)
The average chance of any individual in a
defined population sustaining a given level of
harm from incidents which are considered to
be limited to that population. (Sometimes
called Individual Risk – IR)
Blast relief panel
Parts of a module wall, ceiling or roof which
are designed to increase the area of venting
in an explosion by being opened or removed
by the force of the explosion.
Blast wall
A structural division which has been designed
expressly for the purpose of resisting blast
loads.
Blast wave
A pressure pulse formed by an explosion.
BLEVE
Boiling Liquid Expanding Vapor Explosion;
the result of a catastrophic rupture of a
pressurized vessel containing a liquid at a
temperature above its normal boiling point.
Simultaneous ignition of the vaporizing fluid
gives a short duration, intense fireball.
Blockage factor
The fraction of an area which does not
provide open venting or free passage for a
flame.
Blowdown
The rapid controlled or accidental
depressurization of a vessel or network.
Blow-out (ignited)
A form of jet resulting from ignition of a high
pressure flow of oil and/or gas issuing from
an uncontrolled well, possibly with a
substantial fallout of heavy fractions which
may also ignite on or around the platform as
pool fires.
152-RP-48 Rev 02, Feb 2006
Boiling liquid expanding vapour explosion
(BLEVE)
The sudden rupture due to fire impingement
of a vessel system containing liquefied
flammable gas under pressure. The pressure
burst and the flashing of the liquid to vapour
creates - a blast wave and potential missile
damage, and immediate ignition of the
expanding fuel-air mixture leads to intense
combustion creating a fireball
Burning velocity
The rate at which the flame consumes the
unburnt gas/vapour. Also the velocity of the
flame relative to the unburnt gas/vapour.
Caisson
A vertically aligned pipe, running from the
module deck to a sub sea level, forming a
service line for seawater suction or
sewage/drilling disposal.
Can
Verbal form used for statements of possibility
and capability, whether material, physical or
causal
Cellulosic fire
A fire with a fuel source predominantly of
cellulose (e.g. timber, paper, cotton). A fire
involving these materials is relatively slow
growing, although its intensity may ultimately
reach or exceed that of a hydrocarbon fire.
Chemical composition
The proportion by weight of constituent
elements in a particular batch of steel as
determined by ladle analysis.
Coatback
The extension of PFP from protected primary
members along secondary , teriary or plate to
prevent heat conduction from a flame
impingement reaching welded joints and
causing a weakening of those joints.
Common mode failure
The failure of components from the same
cause
Page 228 of 261
fireandblast.com
Company
An organisation engaged, as principal or
contractor, directly or indirectly, in the
exploration for and production of oj I and/or
gas. For bodies or establishments with more
than one site, a single site may be defined as
a company.
Compartment fires
A fire that starts and continues within a
confined volume on the installation, such as a
contained process area, equipment enclosure
or designated room (e.g. control room).
Computational fluid dynamics (CFD)
A mathematical model in which the region of
the flow is subdivided by a grid into a large
number of control volumes.
Confinement
A measure of the proportion of the boundary
of the explosion region which prevents the
fuel/air mixture from venting or being
released to the external atmosphere.
Congestion
A measure of the restriction of flow within the
explosion region caused by the obstacles
within that region.
Confined Explosion
An explosion of a fuel-oxidant mixture inside
a closed system (eg vessel or module).
Contractor
Person, company or other association that
performs work for an Operator or in other
ways is a supplier of products or services to
the Operator.
Control
Means of intervention permitted by the design
(eg. pressure relief valves, emergency power
supplies) safety hardware (eg. dump tanks,
coolant sprays), or the presence of manually
or automatically initiated ESD procedures
which are intended to contain a developing
situation so that escalation and a major
accident may be avoided.
152-RP-48 Rev 02, Feb 2006
Convection (Heat)
Heat transfer associated with fluid movement
around a heated body; warmer, less dense
fluid rises and is replaced by cooler, more
dense fluid.
Convection
Transfer of material (fluid or gas) from one
place to another.
Convective heat flux
The measured or calculated heat flux
crossing a boundary or surface due to
convection heat transfer only.
Cost benefit analysis (CBA)
A quantitative technique to assess the overall
value of a proposal taking into account its
likely benefits and detriments.
Creep
The time dependent straining of a material. It
is measured under a constantly applied load
and, in the context of this report, at a fixed
temperature.
Criticality (of SCEs)
Defined by the criticality classes 1 (highest)
to 3 (lowest) with respect to the explosion
hazard and the consequences of failure. In
particular the impact on the TR, EER systems
and associated supporting structure.
Decision basis/bases
The basis/bases for assessing the
performance of decision options. These
range from technical codes and standards
based ways of assessing options to values
based assessments based on company or
wider societal values and stakeholder
expectations and perceptions.
Decision context
The background or environment in which the
decision needs to be made. The decision
context affects the importance of the various
decision bases. For the purposes of the
model the context is represented as a
gradual transition from a technical basis to a
values basis.
Page 229 of 261
fireandblast.com
Decision factors
Aspects of performance or influencing factors
that can have a bearing on the decision,
either because they directly affect option
performance or because they determine the
context in which the decision needs to be
made.
Decision framework
The decision framework consists of the
model and accompanying guidance on the
decision context and means of calibration. It
provides the practical tool to aid decision
making.
Decision option(s)
The different options or solutions which are to
be considered as means to resolve the
problem.
Deflagration
Mechanism for propagation of an explosion
reaction through a flammable gas mixture
which is thermal in nature. It is a relatively
slow process and the velocity is always less
than the speed of sound in the mixture (see
Detonation).
Deflagration
The chemical reaction of a substance in
which the reaction front advances into the
unreacted substance at less than sonic
velocity. Where a blast wave is produced
which has the potential to cause damage, the
term explosive deflagration may be used.
Design accidental event
An accidental event for which SCEs on the
installation should perform their function as
designed.
Design basis checks
Design basis checks consist of checking the
basis of the existing design for the installation
and determining if the methods used for the
design are acceptable in the context of the
explosion hazard.
152-RP-48 Rev 02, Feb 2006
Design explosion loads
Explosion loads used for design. SCEs must
be designed to resist these load levels within
the constraints of the associated element
specific performance standards.
Detonation
Mechanism for propagation of an explosion
reaction through a flammable gas mixture
which is more mechanical in nature and acts
through shock pressure forces. It is a very
rapid process and velocity is always greater
than the speed of sound in the mixture (see
Deflagration).
Detonation
An explosion caused by the extremely rapid
chemical reaction of a substance in which the
reaction front advances into the unreacted
substance at greater than sonic velocity.
Detonation limits
The range of fuel-air ratios through which
detonations can propagate.
Diffracted wave
That component of the blast wave which
propagates into the sheltered region behind
the structure.
Diffusivity
An expression relating to the range of mass
transmitted through a given medium to that
absorbed by the medium. It has units m2 s-1.
Dilution
Addition of inert gas to flammable mixture.
Dimensioning accidental event (DAE)
AEs that serve as the basis for layout,
dimensioning and use of installations and the
activity at large, in order Ito meet the defined
RAC.
Dimensioning accidental load (DAL)
Load (action) that is sufficient in order to
meet the risk acceptance criteria.
Page 230 of 261
fireandblast.com
Dimensioning explosion loads
Explosion loads which are of such a
magnitude that when applied to a simple
elastic analysis model, the code check results
in members dimensioned to resist the ductility
level explosion.
Dirivent
An HVAC system whereby increased mixing
is achieved by way of directed jet nozzles.
Dose
The accumulated exposure of an individual to
harmful conditions,
Drag coefficient
An empirical multiplying constant used to
relate the drag load on a structure to the
stagnation overpressure.
Drag force
The drag load on a small obstacle due to the
movement of gas past a small obstacle less
than 0.3 m in the direction of flow, form drag
– Presented Area x Pdrag.
Ductility level blast (DLB)
Representative peak overpressure used in
design (10-4 to 10-5 p.a. frequency level) –
Pduct.
Ductility level design event
See DLB.
Ductility ratio
The ratio of the peak deflection to the
deflection at first effective yield.
Ductility ratio µ
The ratio of the maximum displacement of
the element to the deflection required to
cause first yield at the extreme fibres.
Duty holder
The organisation, or company responsible for
the safety of the installation or its design
under UK legislation.
152-RP-48 Rev 02, Feb 2006
Dynamic pressure
Representative peak out of balance loads
over target area, includes drag, pressure
difference and gas acceleration effects. Used
for calculation of loads on equipment and
piping – Pdyn, sometimes referred to as
dynamic overpressure.
Effectiveness analysis
Analysis which documents the fulfilment of
performance standards for safety and
emergency preparedness.
NOTE - Effectiveness analyses in relation to
technical performance standards for essential
safety systems are carried out in relation to
risk analyses. It is therefore a prerequisite
that quantitative risk analyses in relation to
design include quantitative analyses of
escape, evacuation and rescue. Similarly,
effectiveness analyses of emergency
preparedness measures are done in
connection with emergency.
Element specific performance standard
Measurable performance standard for
specific key items or systems relating to
systems’ functionality, availability and
survivability. (sometimes referred to as low
level performance standard).
Emergency preparedness
Technical, operational and organisational
measures that are planned to be
implemented under the management of the
emergency organisation in case hazardous or
accidental situations occur, in order to protect
human and environmental resources and
assets.
Emergency preparedness analysis (EPA)
Analysis which includes establishment of
OSHA, including major AEs, establishment of
performance standards for emergency
preparedness and their fulfilment and
identification of emergency preparedness
measures .
Page 231 of 261
fireandblast.com
Emergency shutdown system
A safety shutdown system comprising
detection, signalling and logical control,
valves and actuators, which can, in tandem
with alarm and direct control mechanisms,
enable the safe and effective shutdown of
plant and machinery in a controlled manner.
Emergency shutdown valve (ESDV)
A valve mounted in a pipeline, pipe or marine
riser specifically for the purpose of cutting of
the supply of its normal contents in an
emergency.
Emissivity
A constant used to quantify the radiation
emission characteristics of a flame.
Emissivity of a perfect black body is 1.
Entrainment
The process by which surrounding fluid is
drawn into a jet to cause its dilution.
Environment
The surroundings and conditions in which a
company operates or which it may affect,
including living systems (human and other)
therein.
Environmental effect
A direct or indirect impingement of the
activities, products and services of the
company upon the environment, whether
adverse or beneficial.
Environmental effects evaluation
A documented evaluation of the
environmental significance of the effects of
the company's activities, products and
services (existing and planned).
Equivalent static overpressure
An overpressure derived from
overpressure trace with respect to a target
which gives the same peak deflection when
applied as a static load as the original trace.
152-RP-48 Rev 02, Feb 2006
Escalation
Consequences subsequent to an explosion
or other major hazard.
Essential safety system
System which has a major role in the control
and mitigation of accidents and in any
subsequent EER activities
Establishment of emergency
preparedness
Systematic process which involves planning
and implementation of suitable emergency
preparedness measures on the basis of risk
and EPA
Exceedance curve
A plot of the value of a variable against the
plot of the probability or frequency of
exceedance of that variable.
Expansion ratio
The ratio of burnt to unburnt gas volumes of a
given mass of gas.
Explosion
A release of energy which causes a pressure
discontinuity or blast wave. (see gas
explosion)
Explosion risk
risk from the initiating event and possible
subsequent escalation.
External explosion
External or secondary explosions which may
result as an unburnt fuel/air mixture comes
into contact with the external (oxygen rich)
atmosphere as it is vented from a
compartment.
Extreme (residual) events
an
Events for which design is not reasonably
practicable may result in loss of functionality
of SCE’s
Page 232 of 261
fireandblast.com
F Factor
The fraction of the net combustion energy of
a flame transmitted as radiation.
Fail-safe valve
An actuated valve which automatically
assumes a safe position (open or closed
depending on the needs of the system) in the
event of loss of power to the actuator.
Finite element (analysis)
FEA consists of a computer model of a
material or design that is stressed and
analyzed for specific results.
Fire
A process of combustion characterized by
heat or smoke or flame or a combination of
these.
Fire
A process of combustion characterized by
heat or smoke or flame or any combination of
these.
Fire and explosion risk analysis
The analytical study of the likelihood and
severity of both defined fire hazard and
explosion hazard scenarios.
Fire ball
This phenomenon, which may occur as the
result of a deflagration of a vapor cloud that
does not result in a blast wave. Alternatively,
a fire, burning sufficiently rapidly for the
burning mass to rise into the air as a cloud or
ball.
Fire curve
A temperature/time curve devised for a fire
tests that is intended to represent (but not
necessarily reproduce) the temperature
development of a ‘real’ fire, either cellulosic
or hydrocarbon.
152-RP-48 Rev 02, Feb 2006
Fire endurance
The length of time that an element can resist
fire either up to the point of collapse or
alternatively to the point when the deflection
reaches a limiting value.
Fire point
The temperature at which a liquid fuel flashes
and then marginally sustains a flame.
Fire prevention
Measures taken to prevent the outbreak of
fire at a given location.
Fire protection
Measures taken to minimize effects of
damage from fire should it occur.
Fire protection system
An integrated detection, signalling and
automated fire control system.
Fire risk analysis
The analytical study of the likelihood and
severity of defined fire hazard scenarios.
Fire test
A test designed to quantify the resistance to
fire of elements of construction and/or
materials applied thereto. Conventionally,
such tests are carried out in purpose-built
furnaces operating to a defined
temperature/time curve.
Fire wall
A designated partition, which by nature of its
construction and certification status, is
warranted to resist a standard or hydrocarbon
fire test for a particular time period. The term
can apply to a floor or roof panel.
Fire Water pump
A submersible electric or diesel pump,
mounted in or capable of being lowered into a
fire water pump caisson, which feeds into the
firewater ring main.
Page 233 of 261
fireandblast.com
Flammability limits
The range of fuel-air ratios which can support
non-detonative combustion such as laminar
and turbulent flames. It therefore, includes
both lower and higher flammability limits.
Flash fire
The combustion of a flammable vapour and
air mixture in which the flame passes through
the mixture at less than sonic velocity, such
that negligible damaging overpressure is
generated.
Fire hazard analysis
The application of hazard analysis techniques
solely to fire hazards.
Flash fire
The combustion of a flammable vapour and
air mixture in which flame passes through
that mixture and negligible damaging
overpressure is generated.
Flash point
The flash point of a liquid is the temperature
at which the vapour and air mixture lying just
above its vaporizing surface is capable of just
supporting a momentary flashing propagation
of a flame prompted by a quick sweep of a
small gas pilot flame near the surface.
Flashing
The rapid evaporation of a volatile liquid
when suddenly released from pressurized
storage.
Flow stress
Flow stress (a combination of UTS and
elongation stress)
Forced ventilation
Ventilation by mechanical means, e.g. a fan.
Free flame release
The flame resulting from a gas or liquid
release but that subsequently has no
impingement on any other bodies (such as
equipment or structure).
152-RP-48 Rev 02, Feb 2006
Frequency
The number of occurrences per unit of time.
Fuel controlled fire
A fire in which the rate of fuel consumption is
controlled by the rate of supply of fuel to the
fire, rather than the availability of oxygen for
combustion.
Functionality
The capacity of a system to perform the
function required of it during and after a major
accidental event.
Fundamental burning velocity
The burning velocity of a laminar (non-
turbulent) flame under stated conditions of
composition, temperature and pressure of the
unburnt gas.
Fusible
The basis of protective devices with a
component of valves or detectors causes the
protective device to function when the
component melts in the early stages of a fire
hazard in that locale. Includes fusible links,
plugs and loops.
Gas explosion
Gas explosions can be defined as the
combustion of a premixed gas cloud
containing fuel and an oxidiser that can result
in a rapid rise in pressure
Gas oil ratio
The ratio of gas to oil within the hydrocarbon
fluid, a high GOR indicates a high gas
content which has implications for the
potential for gas fires from a depressurisation
and release.
Gauge points
Points defined in a CFD analysis where
information on overpressure/dynamic
pressure time histories are derived.
General platform alarm
A platform wide alarm indicating the onset of
an emergency.
Page 234 of 261
fireandblast.com
Harm criteria
Statements of adverse (environmental)
conditions such as heat, degradation of air
quality or introduced toxic substances which
will start to cause harm (both short and long
term) to the average individual.
Often linked with vulnerability.
Hazard
A physical situation with a potential for
human injury, damage to property, damage to
the environment or some combination of
these.
Hazard
The potential to cause harm, including ill
health or injury; damage to property, plant,
products or the environment; production
losses or increased liabilities.
Hazard
A physical situation with a potential for
human injury, damage to plant/equipment,
damage to the environment or some
combination of these.
Hazard analysis
The identification of undesired events that
lead to the realisation of a hazard, the
analysis of the mechanisms by which these
undesired events could occur and usually the
estimation of the extent, magnitude and
likelihood of any harmful effects.
Hazardous substance
A substance which by virtue of its chemical
properties constitutes a hazard.
HAZID
Hazard identification exercise, usually a
brainstorm review of the potential hazards
that may impact an installation.
Health, safety and environmental (HSE)
management plan
A description of the means of achieving
health, safety and environmental objectives.
152-RP-48 Rev 02, Feb 2006
Health, safety and environmental (HSE)
management review
The formal review by senior management of
the status and adequacy of the health, safety
and environmental management system and
its implementation, in relation to health,
safety and environmental issues, policy,
regulations and new objectives resulting from
changing circumstances.
Health, safety and environmental (HSE)
policy
A public statement of the intentions and
principles of action of the company regarding
its health, safety and environmental effects,
giving rise to its strategic and detailed
objectives.
Health, safety and environmental (HSE)
strategic objectives
The broad goals, arising from the HSE policy,
that a company sets itself to achieve, and
which should be quantified wherever
practicable.
Health, safety and environmental
management system (HSMES)
The company structure, responsibilities,
practices, procedures, processes and
management system (HSEMS) resources for
implementing health, safety and
environmental management.
Heat Flux (heat density)
The rate of heat transfer per unit area normal
to the direction of heat flow. A convenient unit
is kW/ /m2/s (1 kW m-2 /s = 317 Btu ft-2 h-1). It
is a total of heat transmitted by radiation,
conduction and convection.
Heating rate
The rate, measured in degrees C per minute,
that a sample is heated.
High (Higher) risk methodology
Methodology of assessment appropriate for
High risk installations or compartments as
defined in this Guidance.
Page 235 of 261
fireandblast.com
Homogeneous
In two-phase flow the vapor and liquid
phases are assumed to be traveling at the
same speeds and to be mixed uniformly
throughout.
Human factors
The study and assessment of the impact of
systems, equipment and hazards on human
beings. Includes, ergonomic issues, human
reliability and human error assessment.
See also Man Machine Interface
Hydrocarbon
A hydrocarbon is a molecule comprised of
carbon and hydrocarbon atoms.
Hydrocarbon fire
A fire fuelled by hydrocarbon compounds,
having a high flame temperature achieved
almost instantaneously after ignition. A
hydrocarbon fire will spread rapidly, burn
fiercely and produce a high heat flux.
Hydrocarbon fire test
A furnace fire test using a time/ temperature
curve which supposedly represents a
hydrocarbon fire and which results in an ‘H’
rating for successful specimens.
Hyperthermia
Prolonged exposure to heated environments.
Impulse
The integral of a force or load over an interval
of time.
Incident
An event or chain of events which has
caused or could have caused injury, illness
and/or damage (loss) to assets, the
environment or third parties.
(The word 'accident' is used by some writers
and organisations to denote an incident
which has caused injury; illness and/or
damage, but the term also has connotations
of 'bad luck' in common speech, and is
therefore avoided by others. In this guidance,
152-RP-48 Rev 02, Feb 2006
only the term 'incident' has been used-in the
above sense which embraces the concept of
'accident'.)
Incident heat flux
The total heat flux from within the flame on an
exposed pipe, equipment, vessel or structure
to heat transferred by all heat transfer
mechanisms.
For analyses within this guidance, these
constitute mainly a combination of heat
transferred by radiation and convection.
Incident wave
The blast wave as it approaches a structure
just before it impacts on its surface.
Individual risk
The frequency at which an individual may be
expected to sustain a given level of harm
from the realization of specified hazards.
Individual risk (IR)
The frequency at which an individual may be
expected to sustain a given level of harm
from the realization of specified hazards.
Inergen ©
A proprietary medium used to prevent
continue escalation of fires by restricting the
oxygen available, whilst maintaining
adequate oxygen to sustain life.
Infrared
The non-visible red end of the visible
spectrum of light.
Inhibitor
Substance which reduces explosion
overpressures by chemically interfering with
combustion.
Initiating events
The events which initiates an explosion
event.
Page 236 of 261
fireandblast.com
Intumescent
An epoxy coating, sealing compound or paint
that swells up under thermal loading to
produce a fire resisting covering.
Inventory
The quantity and type of fuel stored. A
platform inventory lists the fuel types and
total volumes stored on board an installation.
The term inventory is also used to describe
the quantity and type of fuel stored in vessels
and pipe assemblies.
IR flame detectors
Flame detectors functioning in the infrared
region of emitted light from a flame.
Jet fire (flame)
The combustion of material emerging with
significant momentum from an orifice.
Jet flame
The combustion of material emerging with
significant momentum from an orifice.
Jetting length
The length of a jet flow over which the effects
of its initial momentum are dominant.
Laminar flame
A smooth surfaced flame with low burning
velocity.
Large deflection analysis
A type of non-linear structural analysis based
on the final deflected shape of the structure
rather than the initial, undisplaced shape.
Life safety risk
Risk to life.
Lift-off
That region of a jet flame where the jet
discharge has not adequately mixed with air
to combust.
152-RP-48 Rev 02, Feb 2006
Lift off distance
The distance from the discharge point (hole)
to where flaming starts.
Liquid spray release
High pressure release of a liquid hydrocarbon
which gives rise to a suspension of the fuel in
the air similar to a gas cloud which is capable
of deflagration on ignition.
Logit equation or model
See Probit equation or model
Loss prevention
The general term used to describe a range of
activities carried out to minimize any form of
accidental loss, such as damage to people,
property or the environment or purely
financial loss due to plant outage.
Loss prevention
A systematic approach to preventing
accidents or minimizing their effects. The
activities may be associated with financial
loss or safety/environmental issues.
Lower flammability limit (LFL)
The lower level of gas concentration which
will result in combustion of the gas. This is
the same as Lower explosive limit (LEL).
Low level performance standard
See element specific performance standard.
Low risk installation/compartment
An installation or compartment identified as
being low risk by the risk matrix and
screening method described in this
Guidance.
Major hazard
An imprecise term for a large-scale chemical
hazard, especially one that may be released
through an acute event. Or, a popular term
for an installation that has on its premises a
more than a prescribed quantity of a
dangerous substance.
Page 237 of 261
fireandblast.com
Man machine interface
The interaction of human beings with
equipment and control systems, covering
issues of ergonomics but also information
and alarm management.
Mass burning rate
The mass burning rate of a pool fire is the
mass of fuel supplied to the flame per unit
time, per unit area of the pool. Units are
typically kg/m2/sec.
May
Verbal form used to indicate a course of
action permissible within the limits of a
standard
Means of calibration
Means of checking or benchmarking the
performance of a decision option with respect
to a given decision basis. For example what
is thought to be 'good practice' or sound
‘engineering judgment’ can be checked by
peer review and benchmarking of practices in
other parts of the industry. Similarly,
stakeholder consultation can be used to
assess the values of the company or society
at large.
Medium risk installation/compartment
An installation or compartment identified as
being low risk by the risk matrix and
screening method described in this
Guidance.
Mitigation
Means taken to minimise the consequences
of a major accident to personnel and the
installation after the accident has occurred.
Monitoring activities
All inspection, test and monitoring work
related to health, safety and environmental
management.
Muster area
The area (notionally safe) where the crew
congregate whilst awaiting instructions
whether to return to the main areas of the
152-RP-48 Rev 02, Feb 2006
installation (i.e. when safe) or whether to
effect an evacuation.
Natural period
The time required for a freely vibrating
structure to complete one cycle of motion.
Natural ventilation
The ventilation of an enclosure by natural
means, either through the action of an
external wind or gravitational forces.
Nominal explosion frequency
The frequency of occurrence of a release
which is ignited and results in detectable
overpressure (>50 mb). This is used as the
top point in the simplified generation of an
exceedance curve - Prexp
Nominal explosion loads
Representative nominal overpressures and
nominal dynamic pressures on equipment.
ranges, outliers and sensitivity measures.
Nominal overpressures
Nominal overpressures are defined as peak
representative overpressures by
installation/module type determined on a non-
statistical basis from acquired experience or
simulation for a demonstrably similar
situation.
Nominal value
Value assigned to a basic variable
determined on a non-statistical basis,
typically from acquired experience or physical
conditions.
Non-linear analysis
A type of structural analysis that allows the
geometry and/or the material properties to be
non-linear.
Offtake
The process by which tankers or other
mechanisms unload the stored hydrocarbon
from a floating production installation.
Page 238 of 261
fireandblast.com
Overpressure
The excess pressure above ambient
conditions.
Overpressure
In a pressure pulse (blast wave), the
pressure developed above . atmospheric
pressure at any stage or location is called the
overpressure. Overpressure is also
sometimes used to describe exposure of
equipment to internal pressure in excess of
its design pressure, but the term
over-pressurisation is preferred.
Overpressure loading
Loading imparted to a body as a result of
overpressure acting normal to the surface of
the structure.
Passive fire protection (PFP)
A coating, cladding or free-standing system
that provides thermal protection in the event
of fire and which requires no manual,
mechanical or other means of initiation,
replenishment or sustenance.
Passive mitigation
Mitigation technique that is ‘non-triggered’
and generally utilized the kinetic energy of an
explosion to disperse an extinguishing agent
or suppressant.
Peak overpressure
The maximum overpressure generated at a
given location.
Penetration seal
Purpose-made seals, or seals formed in situ
to ensure that penetrations to firewalls do not
impair fire resistance.
Performance criteria
Performance criteria describe the measurable
standards set by company management to
which an activity or system element is to
perform.
(Some companies may refer to performance
criteria as 'goals' or 'targets'.)
152-RP-48 Rev 02, Feb 2006
Performance standard
A statement which can be expressed in
qualitative or quantitative terms of the
performance required of a system, item of
equipment, person or procedure and which is
used as the basis for managing the hazard.
Performance standards for safety and
emergency preparedness
Requirements to the performance of safety
and emergency preparedness measures
which ensure that safety - objectives, RAG,
authority minimum requirements and
established norms are satisfied during design
and operation
NOTE - The term 'performance' is to be
interpreted in a wide sense and Include
availability, reliability, capacity, mobilisation
time, functionality, vulnerability, personnel
competence, expressed as far as possible in
a verifiable manner.
Phenomenological models
Simplified physical models, which seek to
represent only the essential physics of
explosions.
Plastic deformation
That deformation which occurs following
yield.
Plastic hinge
A plastic hinge is a zone of yielding due to
flexure in a structural member.
Plastic regime
That region of structural behaviour dominated
by plastic response rather than elastic
response. It is associated with plastic strain
and large plastic deformations.
Plastic strain
Strain beyond the elastic limit.
Pool fire
The combustion of material evaporating from
a layer of liquid at the base of the fire. May be
pon solid flooring or on the sea surface.
Page 239 of 261
fireandblast.com
Potential loss of life (PLL)
The (fractional) no of individuals predicted to
become fatalities over a specified period of
time – usually one year.
Practice
Accepted methods or means of
accomplishing stated tasks.
Preparedness analyses
The analysis has to be traceable and will
normally - though not necessarily - be
quantitative.
Pressure burst
The rupture of a system under internal
pressure, resulting in the formation of
missiles which may have the potential to
cause damage, and perhaps a blast wave.
Pressure difference
The pressure difference across an obstacle
greater than 0.3m in the direction of flow,
calculated from the pressure time histories at
the front and back of the obstacle. - Pdiff
Prevention
Means intended to prevent the initiation of a
sequence of events which could lead to a
hazardous outcome of significance (ie major
accident). Such means include management
systems applied to the design, engineering
and construction standards, the operation of
the installation, its inspection and
maintenance.
Primary means of escape
The means of escape which was assumed
during design.
Primary structure
The structural components, whose failure
would seriously endanger the safety of a
significant part of the installation.
Probability
A number in a scale from 0 to 1 which
expresses the likelihood that one event will
succeed another.
152-RP-48 Rev 02, Feb 2006
Probit equation or model
A probit model is a model in which the
dependent variable yi can be only one or
zero, and the continuous independent
variable xi are estimated in Pr(yi=1)=F(xi'b).
Where b is a parameter to be estimated and
F is the normal cumulative distribution
function.
The logit model is the same but with a
different cumulative distribution function for F.
Procedure
A documented series of steps to be carried
out in a logical order for a defined operation
or in a given situation.
Procedure
Established and documented step by step
activity which allows a specific task to be
completed.
Proof stress
The stress at which the plastic strain of a
material reaches a particular value, for
example 0.2%. Proof stress, is a valuable
concept in materials which do not exhibit a
sharp yield point.
Quantified risk analysis
The quantitative evaluation of the likelihood
of undesired events and the likelihood of
harm or damage being caused, together with
the value judgements made concerning the
significance of the results.
May also be referred to as quantitative risk
analysis or with assessment used
interchangeably with analysis.
Quality assurance
All systematic actions that are necessary to
ensure that quality is planned, obtained and
maintained.
Quality control
That part of the Quality Assurance which,
through measurements, tests or inspections,
ascertains whether a product, service or
activity is in accordance with specified
requirements.
Page 240 of 261
fireandblast.com
Quality
A product, service or activity's ability to fulfil
specified requirements.
Radiation
Thermal radiation involves the transfer of
heat by electromagnetic waves confined to a
relatively narrow region of the
electromagnetic spectrum.
Radiative heat flux
The measured or calculated heat flux
crossing a boundary or surface due to
radiation heat transfer only.
Redundancy
The performance of the same function by a
number of identical - but independent means.
Redundancy analysis
The structural analysis indicating which
members can be removed without the
collapse of the structure.
Release
The type and quantity of fuel which can
possibly be ignited.
Reliability
The probability that an item is able to perform
a required function under stated conditions
for a stated period of time.
Reliability
The probability that an item is able to perform
a required function under stated conditions
for a stated period of time or for a stated
demand.
Representative peak overpressure
Time averaged over 1.5ms and space
averaged over explosion affected area. –
Prep
Required endurance time
The estimated time for people to travel from
their work stations to the TR, then to the
primary or secondary means of escape,
152-RP-48 Rev 02, Feb 2006
allowing for the possibility of helping injured
colleagues.
Residual events
Initiating events which cannot be eliminated
by design or operating procedures.
Rise time
The time taken for the overpressure to
increase from zero to the peak overpressure.
Risk
The product of the chance that a specified
undesired event will occur and the severity of
the consequences of the event.
Risk
The likelihood of a specified undesired event
occurring within a specified period or in
specified circumstances. It may be either a
frequency (the number of specified events
occurring in unit time) or a probability (the
probability of a specified event following a
prior event), depending on the
circumstances.
Risk
Combination of the probability of occurrence
of harm and the severity of that harm
NOTE - Risk may be expressed qualitatively
as well as quantitatively. Probability may be
expressed as a probability value (0-1,
dimensionless) or as a frequency, with the
inverse of time as dimension. The definition
implies that risk aversion (i.e. an evaluation of
risk which places more importance on certain
accidental consequences than on others,
where risk acceptance is concerned) should
not be included in the quantitative expression
of risk. It may be relevant to consider on a
qualitative basis certain aspects of risk
aversion in relation to assessment of risk and
its tolerability. The implication of the definition
is further that perceived risk (i.e. subjectively
evaluated risk performed by individuals)
should not be included in the expression of
risk-
Page 241 of 261
fireandblast.com
Risk acceptance criteria (RAC)
Criteria that are used to express a risk level
that is considered tolerable for the activity in
question
NOTE - RAC are used in relation to risk
analysis and express the level of risk which
will be tolerable for the 9 activity, and is the
starting point for further risk reduction
according to the ALARP-principle. Risk
acceptance criteria may be qualitative or
quantitative.
Risk analysis
The quantified calculation of probabilities and
risks without making any judgements about
their relevance.
Risk analysis
Use of available information to identify
hazards and to estimate the risk
NOTE The risk analysis term covers several
types of analyses that will all assess causes
for and consequences of AEs, with respect to
risk to personnel, environment and assets.
Examples of the simpler analyses are SJA,
FMEA, preliminary hazard analysis, HAZOP,
etc.
NOTE 2 - Quantitative analysis may be the
most relevant in many cases, involving a
quantification of the probability and the
consequences of AEs, in a manner which
allows comparison with quantitative RAC.
Risk assessment
The quantitative evaluation of the likelihood
of undesired events and the likelihood of
harm or damage being caused together with
the value judgments made concerning the
significance of the results.
Risk assessment
Overall process of risk analysis and risk
evaluation
Risk evaluation
The evaluation of the likelihood of undesired
events and the likelihood of harm or damage
being caused, together with the value
judgements made concerning the
152-RP-48 Rev 02, Feb 2006
significance of the results and their
tolerability, including issues of risk perception
where appropriate.
Risk Issues
Issues that impact on the nature and
perception of safety related risks and the role
of risk based analysis techniques
Robustness
Insensitivity of response to variations of load.
Safety critical element (SCE)
Any structure, plant, equipment, system
(including computer software) or component
part whose failure could cause or contribute
substantially to a major accident is safety-
critical, as is any which is intended to prevent
or limit the effect of a major accident.
Safety objective
Objective for the safety of personnel,
environment and assets towards which the
management of the activity will be aimed
Safety plan
All documented policies, standards and
practices which the Operator shall initiate to
ensure the activity is planned, organized,
executed and maintained to achieve safety
and protect the environment in accordance
with the acts or regulations
Safety-critical elements (SCEs)
Those elements of the installation which are
critical to safety.
Screening criteria
The values or standards against which the
significance of the identified hazard or effect
can be judged. They should be based on
sound scientific and technical information and
may be developed by the company and
industry bodies, or provided by the
regulators.
Secondary means of escape
Means of escape which should be available if
the primary means of escape is not available.
Page 242 of 261
fireandblast.com
Section factor
The ratio of heated perimeter (Hp) to cross-
sectional area (A).
Serviceability limit
A design limit beyond which the structure
may become unserviceable, for example, a
specified maximum deflection.
Shall
Verbal form used to indicate requirements
strictly to be followed in order to conform to
the standard and from which no deviation is
permitted, unless accepted by all involved
parties
Shock load
The load imparted to a structure by a passing
shock wave.
Shock wave
A pressure pulse formed by an explosion in
which a sharp discontinuity in pressure
travels as a wave through a gas at a
supersonic velocity.
Should
Verbal form used to indicate that among
several possibilities one is recommended as
particularly suitable, J without mentioning or
excluding others, or that a certain course of
action is preferred but not necessarily
required
Shuttle tankers
The tankers undertaking the offloading of the
stored oil from a floating installation.
Significant overpressure
An overpressure > 50m bar. This is the
pressure at which pressure relief panels
should operate.
Single-phase flow
A flow consisting of either a liquid or gas.
152-RP-48 Rev 02, Feb 2006
Skin friction
The frictional force caused by the passing
fluid flow which acts tangentially to the
surface of the body.
Skyscape©
A proprietary evacuation mechanism based
on folding Kevlar screens, not permanently
deployed but unfolded when required.
Societal risk
The relationship between frequency and the
number of people suffering from a specified
level of ham1 in a given population from the
realization of specified hazards.
Smoothed overpressure
Overpressure trace which has been
smoothed by using a moving average over a
period of 1.5 milliseconds (1 millisecond or
ms equals one thousandth of a second)
Source terms
The characteristics (prior to ignition) of a fluid
which affect its combustion, i.e. the
composition, pressure, temperature.
Space averaged overpressure
A peak overpressure for a compartment/area
or installation which is the average of all
measured or simulated peak overpressures
within a compartment. It is assumed in the
case for measured overpressures that they
have been smoothed.
Specific heat
The amount of heat, measured in Joules,
required to raise one kilogram of a substance
by one degree C. Units are Joules/kg/ºC.
Stagnation overpressure
The excess pressure above that in the
approach flow which occurs on the front face
of a surface where the gas velocity is brought
to rest.
Page 243 of 261
fireandblast.com
Standard fire test
A furnace fire test using a time temperature
curve which simulates a standard fire and
which results in an ‘A’ or ‘H’ rating for
successful specimens.
Steady state
Conditions which do not change with time.
Stoichiometric mix
Air/fuel mixture is such that it contains exactly
the required amount of oxygen to completely
consume the fuel.
Stoichiometric mixture
A mixture of air and fuel such that complete
combustion may just occur.
Strain hardening (work hardening)
The tendency of an elastic-plastic material to
exhibit increased resistance to high strains.
Strength level analysis
An explosion response assessment where
the SCEs including structure and supports
are required to remain elastic. An elastic
method is used for structural response with
code/utilization checks as the performance
standard.
Strength level blast (SLB)
Representative peak overpressure used to
test robustness of equipment and structure.
Elastic structural analysis is appropriate.
Suppressant
Substance which reduces explosion
overpressures by removing heat from the
flame, chemically interfering with combustion
or diluting the flammable mixture.
Surface emissive power
The heat flux emitted from the surface of the
flame by thermal radiation.
152-RP-48 Rev 02, Feb 2006
Survivability
The ability of a system to function in the
conditions of an accidental event for the time
required.
System audit
Planned and systematic examination of
systems to ensure that these have been
established, followed and maintained as
specified.
Temporary refuge
The place of “greater safety” on an offshore
installation, required in UK law as a place for
crew members to congregate prior to
evacuation or to withstand the major
accident.
Tenability (limits and/or analysis)
An analysis of 3 components of fire and
smoke exposure, 1) the source of the
combustion products, 2) the transport of the
products; and 3) the effect of the exposure.
Thermal analysis
A calculation in which the results are
temperature distributions for a given heat
input. The heating may be described in
terms of either temperatures or radiation
levels.
Thermal capacity
The ability of a material to store heat.
Thermal conduction
Heat transfer through a medium via random
molecular motion.
Threshold overpressure
Peak overpressure below which explosion
assessment need not be performed.
Time domain
A solution technique for structural dynamics
in which results are obtained at regular time
intervals when a time variable force or other
load is applied.
Page 244 of 261
fireandblast.com
Transmissivity
The fraction of the radiated heat that
transmits through a medium (usually the
atmosphere).
Turbulence
Rapid irregular local fluctuations in physical
variables, such as velocity or concentration,
that arise due to the presence of eddies
within the flow.
Turbulent burning velocity
The burning velocity of the flame when
turbulence is present in the flammable
mixture.
Turbulent flame
A flame burning in a turbulent flammable
mixture.
Two-phase flow
A flow in which both the liquid and vapour
phases co-exist within close proximity.
Ultimate overpressure
Peak representative overpressure resulting
from a CFD simulation where it is assumed
that the area is engulfed in a stoichiometric
gas cloud and ignited at the worst position
and time. – Pult.
Ultimate tensile strength
The highest load applied in breaking a tensile
test piece divided by the original cross-
sectional area of the test piece
Ultra-violet
The non-visible violet end of the visible
spectrum of light.
Unconfined vapour cloud explosion
Defined as for VCE and is an imprecise term
(see below).
Unity checks
A summation of non-dimensional terms in an
equation in structural design, each of which
relate to a component of loading or structural
152-RP-48 Rev 02, Feb 2006
response. A summation greater than unity
indicates failure of the member.
Upper flammability limit (UFL)
The fuel concentration above which
combustion will not occur. Same as upper
explosive limit (UEL).
UV flame detectors
Flame detectors functioning in the ultra-violet
region of emitted light from a flame.
Vapor cloud explosion (VCE)
The preferred term for an explosion in the
open air of a cloud made up of a mixture of a
flammable vapour or gas with air.
Vapour cloud explosion (VCE)
The preferred term for an explosion of a
cloud made up of a mixture of a flammable
vapour or gas with air in open or semi-
confined conditions.
Vent
An opening through which gas escapes from
a confining enclosure as a result of the
expansion caused by combustion.
Ventilation
The process by which an enclosure is
supplied with fresh air. Ventilation rates are
often given for an enclosure in units of air
volume changes per hour.
Ventilation controlled fire
A fire in which the combustion rate is
controlled by the availability of oxygen rather
than the supply of fuel.
Venting
The escape of gas through openings (vents)
in the confining enclosure.
Verification
Examination to confirm that an activity,
product or service is in accordance with
specified requirements.
Page 245 of 261
fireandblast.com

View factor Yield point

The proportion of the field of view of a
receiving surface that is filled by a flame.
Volume blockage ratio
The ratio of the volume occupied by the
obstacles to the total volume.
Volume production
The overall rate of increase in volume caused
by the combustion process.
The stress at which a steel sample departs
from linear elastic behaviour to plastic
deformation in a standard tensile test.
Yield, Dynamic
The apparent yield stress exhibited by metals
such as steel when they are strained at a rate
which is significantly faster than the normal
testing rate.
Yield, effective

Wake region For materials which exhibit no clear yield

point – such as mild steels at elevated
The region on the downstream side of the temperatures, the stress corresponding to a
structure. particular plastic strain, often 0.2% (see also
Proof Stress).
Water deluge system

A network of small bore pipe work nozzles

connected to the firewater main which is
capable of delivering the design water spray
to the protected area.

Water screen

A series of wide angle and/or mist spray

nozzles connected to the firewater main that
protect a specific area in the module from the
passage of heat, smoke and billowing flames.

Wellbay

The area of the topsides structure which

accommodates the wellheads.

Worst case (explosion) scenario

CFD or phenomenological simulation where it

is assumed that the explosion area or
compartment is filled with a stoichiometric
gas cloud ignited at the worst position and
time.

Written scheme of examination (or

verification)

The detailed, formally submitted and

monitored scheme of verification required in
the UK.

152-RP-48 Rev 02, Feb 2006 Page 246 of 261

fireandblast.com

Annex C Details on legislation, standards and guidance

C.1 UK legislation
This section details major legislation covering explosion risk. It is not exhaustive as any legislation
covering general safety or requiring a safety risk assessment to be performed, will be relevant
where the potential for a fire event exists. Legislation may be added during the lifetime of this
guidance.

The primary legislation governing safety in the workplace is the ‘Health and Safety at Work Etc. Act
1974 (HASWA)’.[C.1] This imposes a responsibility on the employer to ensure the safety at work
for all employees. Employers have to take reasonable steps to ensure the health, safety and
welfare of their employees.

Various regulations are enacted under the HASWA. These include the ‘Management of Health and
Safety at Work Regulations 1999’, MHSW [C.2] which place an obligation on the employer to
actively carry out a risk assessment of the workplace and act accordingly. Risks assessed will
include those from fire and explosion.

More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and
Emergency Response on offshore installations (PFEER) [C.3] Regulations which place on the Duty
Holder the requirement to take appropriate measures to protect persons from major hazards
including fires and explosions. Regulations 9 to 12 of PFEER specify the types of measures which
are required for prevention, detection, communication and control of emergencies. The regulations
also require mitigating measures to be specified and put in place and for performance standards to
be set for safety critical measures to prevent, control and mitigate explosion hazards.

The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur in
the case of an explosion event (see Regulations 14 to 17 of PFEER).

The Safety Case Regulations SCR [C.4] require that all installations in UK waters have an
acceptable Safety Case. Information regarding the following issues is required to be addressed in
the Safety Case:-

Identification of major hazards;

• evaluation of risks associated with the identified hazards;
• details of appropriate measures taken to reduce these risks to as low a level as is
reasonably practicable;
• details of the Duty Holder’s (Safety) Management Systems.

fireandblast.com ltd +44 (0)1561-378383

8-10 High Street admin@fireandblast.com
Laurencekirk http://www.fireandblast.com
Scotland AB30 1AE
fireandblast.com

The Design and Construction Regulations DCR [C.5] amend the SCR by placing a responsibility on
duty holders to prepare a suitable verification scheme for their installations to ensure independent
and competent evaluation of those elements of the installation which are critical to safety (known
as safety-critical elements - SCEs). Performance standards are used to define the functionality and
integrity of these safety critical elements. They define how these SCEs are expected to function
during and after explosion events.

C.2 Assessment principles for offshore safety cases

The ‘Assessment principles for offshore safety cases’ document (APOSC) [C.6] provides guidance
for duty holders on how the regulator intends to enforce the SCR and its supporting regulations,
PFEER, SI 1995/743, Management and Administration Regulations MAR-1995 [C.7] and the DCR
1996. The APOSC document requires the following be demonstrated for Major Accident Hazard
assessments:

Acceptable safety cases will demonstrate that a structured approach has been taken which:
• identifies all major accident hazards (APOSC paragraphs 38-48);
• evaluates the risks from the identified major accident hazards (APOSC paragraphs 49-74);
• describes how any quantified risk assessment (QRA) has been used and how uncertainties
have been taken into account (APOSC paragraphs 75-82);
• identifies and describes the implementation of the risk reduction measures (APSOC
paragraphs 83-89);
• describes how major accident risks are managed (APOSC paragraphs 90-112);
• describes the evacuation, escape and rescue arrangements (APOSC paragraphs 113-144).

The structured approach listed above is generic, so that there are no specific requirements for how
an assessment of fire hazards should be carried out.

C.3 Codes, standards and guidance

C.3.1 Introduction
Guidance documents are available from the Health and Safety Executive for the legislation
mentioned above. The most relevant North Sea oriented guidance published by the industry are
the Interim Guidance Notes (IGN’s) [C.8].

There are additional codes, standards and guidance are available covering elements related to the
hazard, namely:

For general fire and explosion hazard management;

• UKOO FEHMG (now re-issued as Part 0 of this Guidance)

• ISO 13702:1999 Petroleum and natural gas industries -- Control and mitigation of fires and
explosions on offshore production installations -- Requirements and guidelines

For ignition prevention and Hazardous Area Classification;

• Institute of Petroleum, ‘Area Classification Code for installations handling flammable fluids’,
August 2002, (IP15) [C.9].
• The ATEX (Atmospheric Explosion) Directives 94/9/EC [C.10] and 1999/92/EC [C.11] cover
electrical and mechanical equipment and protective systems, which may be used in
potentially explosive (and ignitable) atmospheres.

152-RP-48 Rev 02, Feb 2006 Page 248 of 261

fireandblast.com

• BS EN 60079-10. ‘Electrical apparatus for explosive gas atmospheres Part 10.

Classification of hazardous areas’, [C.12].
• For equipment in hazardous areas ‘BS EN 1127-1: 1998 Explosive atmospheres. Explosion
prevention and protection’ [C.13] is available.
• BS 5958 : 1991 ‘Code of practice for control of undesirable static electricity’, [C.14]

These documents only cover operational leaks rather than accidental releases. They do not define
the extent of hazardous areas from the point of view of explosion and fire risk.

Alongside UK legislation, EN ISO 13702 [C.15] also addresses the need to develop a fire and
explosion strategy (FES) which describes the role, essential elements and performance standards
for each of the systems required to manage possible hazardous events on the installation.

Guidance on the demonstration of ALARP is available throughout this Guidance and from the
following sources, but it should be noted that they are not specifically oriented towards the offshore
sector;

Policy and Guidance on reducing risks to ALARP in Design [C.16]

http://www.hse.gov.uk/dst/alarp1.htm

Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced Risk as
Low as Reasonably Practicable [C.17]. http://www.hse.gov.uk/hid/spc/perm12.htm

HSE Books have published a guide which sets out an overall framework for decision taking by the
HSE (R2P2) [C.18].

C.3.2 Recent developments (to 2005)

In this section, three documents which are currently under development are discussed, compared
and contrasted. These are:-

A. The three-phase project sponsored by UKOOA and the HSE to develop updated guidance for
the treatment of fire and explosion hazards of which this document is Part 2.

B. ISO development of a standard dealing with accidental actions as part of ISO CD/19901-3
[C.19].

C. API Recommended Practice (API RPFB) [C.20] for the Design of Offshore Facilities against
Fire and Blast Loading.

Whilst the status, scope and applicability of these documents varies, it is still possible to compare
the technical content and approaches in a meaningful way. It has been an aim that all three
documents should adopt compatible approaches as they reflect the same underlying hazards and
confront common issues.

There is now widespread recognition that a multidisciplinary approach to design and assessment is
required, involving structural, mechanical, process, control and instrumentation and other
engineering disciplines.

In the case of fire hazard analysis, probabilistic methods appear to be of lesser importance than for
explosions, as the extreme events are not so disproportionately severe and can largely be
prevented or designed against.

In Fire assessment, nominal fire loads and modified code check methods have been in widespread
use for some years. Recent developments have given rise to the consideration of similar
techniques for application in the explosion case.

152-RP-48 Rev 02, Feb 2006 Page 249 of 261

fireandblast.com

C.3.2.1 The new API RPFB

In 2001 it was agreed that the existing guidance on fire and blast engineering which formed part of
the 21st edition of API Recommended Practice (RP-2A-WSD) [C.21] should be augmented by a
new separate RP on fire and explosion engineering.

This document is limited largely to a discussion of consequence assessment, with philosophy and
hazard management, including mitigation, dealt with by reference to API and other reference
documents.

The required scope of assessment for both conceptual and detailed design may be limited for
installations that can be considered less safety-critical. Simplified assessment methods are
described.

C.3.2.2 ISO 19900 update

The new suite of ISO codes for offshore structures is currently being prepared by a large number
of national and international experts. Resistance to fire and explosion is covered particularly in ISO
19901-3 for Topside Structures [C.22].

The section on Accidental Actions includes requirements and useful guidance on fire and explosion
hazard management as well as vessel collision, dropped objects and helicopter crash scenarios.
(Natural hazards such as extreme weather and earthquake are dealt with in other codes.).
Although the code will have a very wide audience, ISO 19901-3 is written with practising project
engineers in mind. It makes full use of (and reference to) recently validated research so as to set
out the minimum requirements and to indicate current good practice for design. Part of the code is
Normative (mandatory), whilst the remainder is Informative to provide additional information about
other considerations and to indicate sources of guidance.

Like the API code, which is proceeding in parallel, the ISO code recognises that the significance to
life from fire and explosion events depends to a large extent on mitigation by the structural barriers
that are fitted to protect the people and safety critical equipment on board an installation.

There is agreement that the ISO codes for offshore structures should apply across the European
Union and other countries in place of any specific European (CEN) standards.

Table C-1 illustrates the coverage of the subject areas in each document.

Table C-1 ................. Scope and range for the new guidance documents

Subject area UKOOA Guidance API RP ISO

Explosion and Fire Parts 1 and 2 API 75 ISO 13702 and 19900
Philosophy
Explosion and Fire Hazard Parts 1 and 2 Refers to the API ISO 13702, 19900 and
Management 14 Series 19903
Interaction of Explosion and Parts 1 and 2 Refers to the API ISO 19901-3
Fire Hazard Management 14 Series Informative and 13702
Explosion and Fire Loads Part 3 (preliminary treatment API RP ‘Fire and ISO 19901-3
Parts 1 and 2) Blast’
Design Explosion Loads Part 1 To be addressed ISO 19901-3
Response of structures to Part 3 (preliminary treatment API RP ‘Fire and ISO 19901-3
Fires and Explosions in Parts 1 and 2) Blast’

152-RP-48 Rev 02, Feb 2006 Page 250 of 261

fireandblast.com

C.4 References
[C.1]

[C.2]

[C.3]

[C.4]

[C.5]

[C.6]

[C.7]

[C.8]

[C.9]

[C.10]

[C.11]

[C.12]

[C.13]

[C.14]

[C.15]

[C.16]

[C.17]

[C.18]

[C.19]

[C.20]

[C.21]

[C.22]

152-RP-48 Rev 02, Feb 2006 Page 251 of 261

fireandblast.com

Annex D Review of models

D.1 Introduction
Traditionally large-scale experiments were carried out to study fires. However, mathematical
modelling of fires is now becoming the preferred tool, due to the high cost associated with large-
scale experiments. Computational Fluid Dynamics (CFD) modelling done properly is not cheap and
there are outstanding uncertainties associated with the physical sub-models implemented in the
code. Modelling and experiments are mutually exclusive, but should be viewed as complementary
tools.

The very rapid development of faster computer processors and more memory at reasonable prices
enables the user to use finer meshes that will yield to solutions that are more accurate. The
development of physical sub-models is not as rapid, but there are, nevertheless, some interesting
models coming on-stream – some of which are only now becoming feasible to use due to the
improved performance of the computers.

There are two important steps to complete before any model can be used in anger and its results
to be trusted: verification – ensuring that the correct equations with correct source terms are
solved, and validation – showing the model’s accuracy. It is rare to find that the models are not
verified. The validation process is time-consuming, expensive and laborious – validation is often
incomplete. The lack of validation of the fire models was recognised by the Model Evaluation
Group, part of a CEC sponsored project on fire modelling D.1]. The outcome of the Modelling
Evaluation Group was a number of documents outlining minimum requirements for validation of jet
fire models. The pool fire models did not undergo the same level of scrutiny, though most of the
points made on jet fire model validation also apply to pool fire models.

D.2 Types of model

D.2.1 General:
There are a number of mathematical models of varying level of complexity that can be used for
modelling hydrocarbon fires on offshore installations:
• Probabilistic models
• Empirical models
• Zone models
• CFD models
• Evacuation models
• Video analysis

D.2.2 Probabilistic models

Probabilistic models have as yet found limited use for modelling fires on offshore installations.
These models work on defining an event tree and assigning different levels of probability of an
event occurring, thus taking into account uncertainties in the underlying processes. There is little or
152-RP-48 Rev 02, Feb 2006 Page 252 of 261
fireandblast.com

no reliance on fluid flow models with inaccurate or incomplete representation of the fire. However,
these models do rely on the identification of all credible events and their associated probabilities.

Another application of probabilistic models is to provide a realistic heat release rate. A probabilistic
approach to estimating the heat release rate could be used to ensure that the heat release rates
used in make CFD simulations are more realistic. An extrapolation of the probabilistic heat release
rate model to other scenarios, i.e. jet fires on an offshore installation, may not be straightforward.

D.2.3 Empirical correlations

Empirical correlations are based on experiments. Empirical correlations are easy to use and yield
results instantaneously. The correlations provide information such as heat fluxes, wall
temperatures as functions of distance through a material, etc. Empirical correlations are very useful
for a quick assessment of the problem.

There are limitations with empirical correlations. Only very simple configurations can be modelled.
The models cannot take account of buildings and other structures, or the topography of the site.
The estimates could be conservative, but it cannot be guaranteed to be the case for all situations.
This type of model is only valid for the fuels and conditions that were studied in the experiments.
One should therefore be wary of extrapolating the results to situations not covered in the
experiments.

D.2.4 Zone models

Zone models are also based on empirical information, but these models also incorporate some
flow physics. The flow is divided into different zones that can exchange information, e.g. mass,
momentum and heat. A set of ordinary differential equations for mass, momentum, energy and
species mass fractions is solved for each zone. These models require more input from the user,
but tend to have short computer run times, usually (much) less than an hour. The output from zone
models would include heat fluxes, wall temperatures, species concentrations, temperatures,
pressure and velocities. This type of model is very useful as a scoping tool, to identify scenarios
that require the use of more sophisticated tools, i.e. CFD models.

Zone models are also limited to modelling relatively simple geometries. The models should not be
used for fuels or conditions that were not covered in the experiments. Zone

D.2.5 Computational fluid dynamics models

CFD models are the most complex of the fluid flow modelling tools. A number of strongly coupled
non-linear partial differential equations provide a more realistic representation of the flow physics.
There are uncertainties associated with modelling turbulent flow and combustion, as well as in the
definition of the fire source and ambient conditions. The output from a CFD simulation includes
velocities, density, pressure, fluid and wall temperatures, species concentrations (mean and
fluctuating component), heat fluxes, etc. There is still a reliance on empirical data, especially for
combusting flows, but the CFD models are by far the most generally applicable and flexible tools.
Furthermore, the more realistic representation of the physics comes at a cost. It can be time-
consuming to define a CFD model, the run-times can be very long, up to the order of weeks, and
the simulations will not always converge. CFD is a knowledge-based activity and the user of CFD
must have a thorough understanding and experience of a range of topics, including fluid
mechanics, chemical kinetics, and numerical mathematics.

152-RP-48 Rev 02, Feb 2006 Page 253 of 261

fireandblast.com

D.2.5.1 Industry standard

Routine calculations are usually carried out using either the k- model, k-ζ model or Menter’s SST
model. The weaknesses of these models are well documented. The models are sometimes applied
in situations where it would be advisable to use some other turbulence model. Nevertheless, these
models do quite well in many applications. While the models might not be able to provide very
accurate results at all times they nevertheless provide the opportunity to study trends, i.e. how
geometrical changes might affect the solution.

D.2.5.2 State of the art

State of the art in turbulence modelling is Large-Eddy Simulation (LES) or Detached-Eddy

Simulation (DES). These techniques were originally aimed at (external) aerodynamic flows, but are
now finding widespread use for other applications. LES requires fine meshes in order to resolve all
relevant length scales. The LES simulations must also be carried out for a long time, in real-time,
to build up reliable flow statistics. It is also necessary to provide a sensible initial guess for
fluctuating velocities, etc. There are also problems with the treatment of walls in wall-bounded
flows, since there are no large-eddy structures in the near-wall region. DES is a hybrid approach
where a simple turbulence model, like Spalart-Allmaras, is used in the near-wall region and LES is
used in the free shear flow. DES is not as computer intensive as LES, while still providing the same
amount of flow information.

It might be sensible to reduce the problem size, by only considering a subset of the installation. It is
not feasible to model the whole offshore installation, including parts of the surroundings, as well
combustion, multi-phase or single-phase flow, phase change in the vessels subjected to impact of
a jet fire with a CFD model. The run times would be prohibitively long. There are also large
uncertainties in some of the physical sub-models in the CFD codes that make the use of CFD less
attractive.

A more in-depth description of the various modelling techniques is presented in the report prepared
by the Health and Safety Laboratory [D.2] – both in terms of current industry standard and of state
of the art. The emphasis is on the CFD models as these incorporate the most realistic
representations of the physical processes. There is a definite need to revise the assessments of
applicability of the modelling techniques as the models and the available computer resources
develop further.

D.2.6 Evacuation models

Evacuation models have been used in conjunction with CFD models, but can also be run on their
own. The evacuation models can be run as a post-processor, since it is usually assumed that the
movement of people does not affect the flow significantly, though this is not always the case. Some
of the models are becoming sophisticated in that relationships between individuals can be
prescribed; individuals can make their decisions on which exit to use. Validation of evacuation
models is difficult, as it is very difficult to recreate in a controlled experiment the urgency,
indecision and stress brought on in an individual when being subjected to a real fire.

D.2.7 Video analysis

Statistical analysis of video footage of jet fires has been used to provide information on the
likelihood that the fire engulfs a vessel. This information has been used with empirical correlations.
This information would not normally be used on its own.

152-RP-48 Rev 02, Feb 2006 Page 254 of 261

fireandblast.com

D.2.8 Miscellaneous
In light of uncertainties with the various types of models, it might be prudent to carry out
simulations where a zone model and a CFD model can provide input to and output to each other.

Ideally a great number of scenarios, different wind directions, wind speeds, release locations,
release directions, need to be investigated. This is not feasible to do with CFD due to the long
computer runtimes. The use of simpler models as scoping tools could highlight scenarios that
warrant an in-depth investigation with CFD. It is vitally important that the simple model includes all
the important physical processes. Therefore the suitability of a simple model as a scoping tool will
have to be assessed on a case-by-case basis.

Traditionally fluid flow modelling and structural analysis have been carried out separately.
However, it would be desirable to model, say, escalation due to the collapse of parts of the
structure, i.e. Fluid-Structure Interaction (FSI). It is now more feasible to integrate the two types of
modelling due to the availability of faster computers with large memory, and FSI is therefore finding
increasingly widespread use. Nevertheless, the computer runtimes are roughly an order of
magnitude greater than for a comparable fluid flow simulation. There are a number of different
packages in which the fluid flow solver and the structures solver are fully integrated. Filters for
converting the fluid flow results into something that can be read by the structural analysis code
enabling the coupling of separate a fluid flow and structural solver are also available. Some of the
integrated fluid flow solvers are limited to inviscid flows and are thus not suitable to fire modelling.
The required outputs from the CFD code are heat fluxes, concentration of toxics, transport of toxic
products and provision of output from a fluid flow simulation using CFD in the correct format to be
used in structural analysis using a Finite Element code.

D.3 Status of the sub-models in CFD models

D.3.1 Turbulence models
D.3.1.1 Industry standard

Routine calculations are usually carried out using either the k-ε model, k-ζ model or Menter’s SST
model. The weaknesses of these models are well documented. The models are sometimes applied
in situations where it would be advisable to use some other turbulence model. Nevertheless, these
models do quite well in many applications. While the models might not be able to provide very
accurate results at all times they nevertheless provide the opportunity to study trends, i.e. how
geometrical changes might affect the solution.

D.3.1.2 State of the art

State of the art in turbulence modelling is Large-Eddy Simulation (LES) or Detached-Eddy

Simulation (DES). These techniques were originally aimed at (external) aerodynamic flows, but are
now finding widespread use for other applications. LES requires fine meshes in order to resolve all
relevant length scales. The LES simulations must also be carried out for a long time, in real-time,
to build up reliable flow statistics. It is also necessary to provide a sensible initial guess for
fluctuating velocities, etc. There are also problems with the treatment of walls in wall-bounded
flows, since there are no large-eddy structures in the near-wall region. DES is a hybrid approach
where a simple turbulence model, like Spalart-Allmaras, is used in the near-wall region and LES is
used in the free shear flow. DES is not as computer intensive as LES, while still providing the same
amount of flow information.

152-RP-48 Rev 02, Feb 2006 Page 255 of 261

fireandblast.com

D.3.2 Multi-phase flow

D.3.2.1 Industry standard

The choice of multi-phase model depends on the flow, i.e. whether it is a gas-liquid, gas-solid,
liquid-solid or a gas-liquid-solid system. The fraction of dispersed phase is also of importance when
choosing which model to use. When dealing solids and droplets that have are not mono-disperse,
i.e. distribution of different sizes, one would not normally attempt to follow each individual particle
or droplet but rather consider groups of particles, with all particles in each group having same size
and properties. Two situations that are of particular importance on an offshore installation are when
a jet release is made up of gas and condensate, where both phases are combustible, and water
mitigation. For larger problems the dispersed phase is treated as continuous, i.e. as a part of the
bulk fluid.

D.3.2.1 State of the art

A two-flow model, where the phases have different momentum, energy and heat, and the
interphase exchange of these quantities represent state of the art. However, there are great
uncertainties associated with the modelling of the interfacial information transfer between the
phases. A transported-PDF method where a velocity-scalar PDF is combined with either LES or
Reynolds Averaged Navier-Stokes could be used to model dispersed multi-phase flows.

D.3.3 Combustion models

D.3.3.1 General

There are uncertainties associated with the modelling of combustion processes. Some of these are
related to the complexity of the chemical kinetics, with a large number of intermediate species and
reactions describing the combustion of even the simplest hydrocarbons, and the lack of
understanding of the processes involved. Further uncertainty is introduced, as it is not possible to
accurately resolve the flame front for flows considered in the present report. The simpler
combustion models introduce constants that are not universally applicable and need to be adjusted
for each fuel.

D.3.3.2 Gaseous combustion

Industry standard: Routine simulations of combusting flows usually involve the use of the Eddy
Dissipation Model or, less likely, a laminar flamelet model with a prescribed PDF, for non-premixed
combustion, and the Eddy Break-Up (EBU) model for premixed combustion and the Zimont model
for partially premixed or premixed combustion. Fires are also sometimes represented by a
volumetric heat source. This will provide a means of heat release (location and magnitude) but will
not provide any information of the amount of toxic products that are produced.

State of the art techniques in gaseous combustion modelling are the Probability Density Function
(PDF) approach and the Conditional Moment Closure (CMC) model. The PDF method involves
solving a transport equation for the PDF. This is then coupled to a detailed or reduced chemical
kinetics scheme. However, these calculations place great demands on the available computer
resources. The need for detailed treatment of chemical kinetics in fires in offshore installations is
not likely to great. The CMC model can also be used to represent detailed chemical kinetics and
does not place the same demand on the computer resources as the PDF transport approaches

D.3.3.3 Liquid combustion

Industry standard: It would appear that relatively simple combustion models, such as mixed-is-
burnt or Eddy Break-Up-type models, are being used. Heavier hydrocarbons are well characterised
and will of course change with time and location of the wellhead within each reservoir. The

152-RP-48 Rev 02, Feb 2006 Page 256 of 261

fireandblast.com

complexity of the combustion of heavier hydrocarbons makes it intractable to attempt to use more
sophisticated combustion models.

State of the art: It might be possible to use a transported PDF method with either detailed or
reduced chemical kinetics or the Conditional Moment Closure model. However, no references to
combustion modelling of mixtures of heavy hydrocarbons using either of these two methods have
been found in the open literature.

D.3.3.4 Multi-phase combustion

Industry standard: One cannot afford model the combustion of each individual droplet in a spray.
However, a Eulerian-Lagrangian approach where one tracks groups of droplets, where particles in
each group have the same size and properties might be feasible. The actual combustion would be
modelled using a simple combustion model, i.e. mixed-is-burnt, Eddy Dissipation or the Zimont
model.

State of the art: The computational cost of CFD calculations for non-reacting multi-phase flows is
already high. The added complexity of the combustion processes makes modelling of multi-phase
combustion very expensive computationally for the flows considered in the present report. It might
be possible to use a transported PDF method with either detailed or reduced chemical kinetics or
the Conditional Moment Closure (CMC) model. However, no references to combustion modelling
of mixtures of heavy hydrocarbons using either of these two methods have been found in the open
literature.

D.3.4 Heat transfer models

D.3.4.1 Conduction

Conduction of heat is of great importance. One possible scenario is when a jet fire impacts on a
vessel. Passive Fire Protection (PFP), i.e. coating of process equipment and vessels, is used to
protect the equipment from the fire. However, PFP ages and is affected by the weather. There is
also a risk that the coating is removed due to the erosive effect exerted by a high momentum jet.
The subsequent heating up of the content of the vessel could lead to pressure build-up due
vaporisation of hydrocarbons.

The complexity of the problem that involves fluid flow, combustion, heat conduction (possibly with
deteriorating PFP) and phase transition makes this problem intractable for CFD models in many
cases. It might be feasible to combine the CFD model with a zone model that can provide the
conditions in the vessel.

D.3.4.2 Convection

Convection plays a very important part in the heat transfer processes from a fire. The momentum
imposed on the plume greatly affects where and how fast the hot exhaust gases travel. This has
implications for the evacuation of personnel. The use of wall functions is the industry standard for
modelling convective heat transfer at walls. These wall functions have usually been derived for
natural convection. The state of the art wall functions are the scaleable wall functions that are more
accurate than the old equilibrium wall functions. CFD modelling of smoke transport carried out at
Cambridge University and HSL showed that the choice of convective heat boundary condition
greatly affects the flow, i.e. wall functions should be modified to account for forced convection if the
heat transfer is a combination of forced and natural convection.

D.3.4.3 Radiation

Industry standard: The Discrete Transfer Model (DTM) by Lockwood and Shah (1981) [D.3] is
frequently used and offers accurate predictions at a relatively reasonable cost. Though there is a
trade-off between accuracy and speed, as more rays used will up to a point result in more accurate

152-RP-48 Rev 02, Feb 2006 Page 257 of 261

fireandblast.com

radiative flux predictions. Also frequently used are radiation models based on the Discrete Ordinate
Model, i.e. see Fiveland (1988) [D.4], Raithby and Chui (1990) [D.5] or Chui and Raithby (1993)
[D.6], which solve the radiative energy transfer equation for a number of solid angles. Another
commonly used simple model is the P1 radiation model that was developed for coal combustion.

State of the art in radiation modelling is stochastic modelling using Monte Carlo simulations with
either a narrow band or a wide band model. This is an expensive technique, but it is suitable for
complex geometries and is potentially a very accurate method. The accuracy is dependent on the
number of rays used.

D.3.4.4 Dispersion of toxics

The term “toxics” encompasses many products of combustion including carbon monoxide, soot
and smoke. It is important to be able to model the movement of these toxic substances, as it can
be used to determine how long time the occupants have before, say, the smoke concentration
becomes too high, and thus provide information upon which to draw up an emergency evacuation
plan. Dispersion of toxic products can be modelled in a number of ways. CO and smoke are
frequently treated as a single passive scalar, respectively. There are correlations that would
provide an estimate for the amount of CO and smoke produced by a particular fuel. It is also
possible to model the production of CO and smoke via a combustion model, i.e. Eddy Dissipation
model. Soot can also be modelled with a version of the Eddy Dissipation model that has been
adapted to soot modelling. A more sophisticated approach is to use a laminar flamelet method. It is
then necessary to solve two transport equations for mixture fraction and mixture fraction variance,
and two transport equations for the soot volume fraction and soot number density. LES and DES
techniques are likely to be used for modelling of smoke transport, but the high computational cost
of LES and DES will probably preclude the use of these approaches for modelling of an entire
offshore installation.

D.4 Miscellaneous issues

D.4.1 General
Committee of the European Community (CEC) sponsored a project in the area of Major Industrial
Hazards with the aim to establish suitable criteria and procedures for model verification and
validation, surveying the state of the fire models for jet fires and pool fires, and propose further
development and validation of the physical sub-models. This Model Evaluation Group (MEG) held
a number of open meetings where mode developers and academics discussed the state of fire
modelling at great length. Unfortunately, the pool fire models were never properly assessed. The
jet fire models on the other hand were scrutinised a much detail. A number of recommendations for
how the models should be validated and the results of the validation studies be reported were
presented.

D.4.2 Verification
The purpose of the verification process is to show that the correct transport equations are solved,
i.e. that all the important terms have been included in the equations.

Most CFD codes and the models implemented therein will have been verified.

D.4.3 Validation
Definition: Validation is the process of demonstrating that the model provides a sufficiently
accurate representation of the real world.

Validation is a very difficult, costly and time-consuming exercise. One of main difficulties lies in that
there are an infinite number of different scenarios that ideally should be investigated. This is clearly
not feasible. It is therefore important to select a set of representative scenarios that are run each

152-RP-48 Rev 02, Feb 2006 Page 258 of 261

fireandblast.com

time a new release of the code is due to be distributed. There should be no differences in the
results obtained with the old and news releases unless bug fixing to a particular, relevant model
has been carried out. The results should be investigated if there are any differences between two
solutions.

D.4.4 Issues affecting accuracy of predictions

There are a number of factor that influence the accuracy of the CFD model predictions. These are
listed below in no particular order:
• Mesh quality;
• Computational cell size in the near-wall region;
• Grid dependency;
• Ray dependency (radiation model), if applicable;
• Time step dependency, if transient simulation;
• Convergence;
• Sensitivity to choice of boundary conditions, if applicable;
• Settings of turbulence and combustion model constants;
• Effects of choice of spatial and temporal discretisation methods on the solution; and
• Inclusion of buoyancy in the transport equations for momentum and turbulence quantities.

These factors should always be taken into consideration in CFD simulations. It is important that
reports describing CFD modelling should also include this information, to show that the these
factors have been investigated. There are a number of guidance documents on the use of CFD for
various types of flows; ERCOFTAC has produced a document providing Best Practice guidelines
on the general use of CFD, Casey and Wintergeste (2000) [D.7]; NAFEMS has also produced
guidance document on the general use of CFD, NAFEMS (1996) [D.8] and HSL has produced a
Best Practice guidance on modelling of smoke transport, Gobeau et al. (2002) [D.9].

D.4.5 Future developments

The rapid development and availability of cheap and powerful computers with large memory will
yield more accurate results without making any improvements to the numerical algorithms and the
physical sub-models. It is therefore not sensible to make hard and fast rules about mesh sizes. A
sensitivity study comparing the results of simulations on three meshes of different fineness will
show whether the solution is grid independent. It is also not sensible to specify the number of rays
to use when modelling radiative heat transfer. A sensitivity study of the effect of changing the
number of rays on heat fluxes should be carried out.

The use LES to model combusting flows has increased greatly, though there are concerns over the

coarseness of the meshes that are used in the calculations. Many simulations using an LES
technique are also not run for a sufficiently long time (in real-time) to provide reliable flow statistics.
The DES or similar hybrid technique combining LES and a simple turbulence model will find
increased use and be applied to combusting flows, as a great deal of effort is going into further
refinement of the models. DES-like techniques are also better suited to wall-bounded flows than
LES on its own.

Combustion modelling using the CMC model holds great promise for the future. The computational
overhead with CMC model is considerably lower compared to that of the transported PDF
methods. However, it is not certain that the extra information about the combustion provided by the
CMC and the transported PDF methods is required, especially given the level of uncertainty in the
modelling and the increased computational cost. It is therefore likely that the simpler models, i.e.

152-RP-48 Rev 02, Feb 2006 Page 259 of 261

fireandblast.com

Eddy Dissipation model, the Zimont model and laminar flamelet models with prescribed PDF, will
continue to be used for the foreseeable future

There is great uncertainty in the modelling of interfacial transfer of momentum, heat and mass
between different phases. It is also very difficult to measure interfacial transfer of momentum, heat
and mass between different phases in experiments. This is an area that should see improvements
as more sophisticated measurement techniques are employed. However, it may be necessary to
be to resolve the interface between the different phases, which would significantly increase the
computational overhead, in terms of computer runtimes and memory requirement.

D.5 References
[D.1] Carregal Ferreira, J., Forkel, H, Bender, R., Menter, F. R., Improved LES-, DES- and SAS-
Models for the CFD-Simulation of Chemically Reacting Flows, EROFTAC Bulletin No. 64, pp. 57-
60, 2005.

[D.2] Casey, M., and Wintergerste, T., Special Interest Group on Quality and Trust in Industrial
CFD – Best Practice Guidelines, ERCOFTAC, 2000.

[D.3] CRC, The Handbook of Fluid Dynamics, Ed: Johnson, R. W., CRC Press/Springer Verlag,
Boca Raton, FL, USA, 1998.

[D.4] Gobeau, N. Ledin, H. S., and Lea, C. J., Guidance for HSE Inspectors: Smoke movement in
complex enclosed spaces - Assessment of Computational Fluid Dynamics, HSL Report No.
HSL/2002/29, 2002.

[D.5] Merci, B., and Roekaerts, D., Turbulence-Chemistry Interaction in Turbulent Flame
Simulations – Transported Scalar PDF Approach, ERCOFTAC Bulletin No. 64, pp. 25-28, 2005.

[D.6] Model Evaluation Group, Model Evaluation Group – Report of the Second Open Meeting,
Cadarache, France, 19 May, 1994, EU Report No. EUR 15990 EN, 1995a.

[D.7] Model Evaluation Group, Protocol for Model Evaluation, Commission of the European
Communities, DG-XII, Brussels, 1995b.

[D.8] Model Evaluation Group, Guidelines for Model Developers, Commission of the European
Communities, DG-XII, Brussels, 1995c.

[D.9] NAFEMS, CFD Analysis: Guidance for good practice, NAFEMS Document Ref. No. R0063,
1996.

152-RP-48 Rev 02, Feb 2006 Page 260 of 261

fireandblast.com

Annex E Checklists

To be added

152-RP-48 Rev 02, Feb 2006 Page 261 of 261