Professional Documents
Culture Documents
UKOOA Fire and Explosion Guidance - Part 1
UKOOA Fire and Explosion Guidance - Part 1
ISSUE 1
October 2003
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither UKOOA, nor any of its members will assume liability for any use made thereof.
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system,
or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or
otherwise, without prior written permission of the publishers.
London Office:
2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU.
Tel: 020 7802 2400 Fax: 020 7802 2401
Aberdeen Office:
9, Albyn Terrace, Aberdeen, AB10 1YP
Tel: 01224 626652 Fax: 01224 626503
Email: info@ukooa.co.uk
Website: www.oilandgas.org.uk
Foreword
This document has been prepared under a joint industry project sponsored by UKOOA and the
UK HSE. The project was managed by fireandblast.com limited, and the production of the initial
text and of the back up documentation was undertaken by a consortium headed by MSL
Engineering Ltd. The other members of the consortium were Aker Kværner, Century Dynamics,
Genesis Oil and Gas, IC Consultants, Morgan Safety Solutions and WS Atkins inc.
This document is part of a series being produced by UKOOA and HSE on fires and explosions,
the full series being:
This Part 1 document is taken from MSL Engineering Reports C26800R006 Rev 2 and
C26800R007 Rev 2.
Part 0
Part 1:- Avoidance and mitigation of Part 2:- Avoidance and mitigation
explosions Part 1 Part 2 of fires
Describes design considerations for the Describe design considerations for the
prevention, control and mitigation of explosions prevention, control and mitigation
of fires
Part 3
The treatment described in this part of the guidance draws on the experience gained during the
period since the Interim Guidance Notes [1] were prepared. This has allowed simplifications to
be made and a more clearly defined approach to be adopted in some circumstances, without
compromising safety.
This Guidance does not have the force of a Standard and contains information on good
practice which may or may not be on a firm scientific basis and may require clear justification.
Where this is the case the uncertainties are highlighted and the limitations of the methods are
identified. There is a recognized need to provide such guidance to avoid decisions being made
out of context during the explosion assessment process. The term ‘assessment’ is taken to
include the assessment of a design in progress and the assessment of an existing installation.
This part of the Guidance identifies methodologies for explosion assessment, the
circumstances in which the methods may be applied and their limitations. Part 3 of the
Guidance will deal with the detailed implementation of these and other methodologies.
Alternative methods to those presented may be used so long as they are justified by a risk
assessment and provided their use leads to reducing risks to As Low As Reasonably
Practicable (ALARP).
Contents
1 Introduction ........................................................................................................................... 7
1.1 History ......................................................................................................................... 7
1.2 Objectives .................................................................................................................... 7
1.3 Fire and Explosion Hazard Management .................................................................... 8
1.4 Overview of Guidance ............................................................................................... 10
1 Introduction
1.1 History
Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire
Engineering for Topsides Structures (Phase 1)’ was carried out between May 1990 and July
1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1] and 26
background technical reports written by the participants and published by the Steel
Construction Institute (SCI) in November 1991.
The development of the Interim Guidance Notes was a major step forward which consolidated
the then existing knowledge of fire and explosion hazards. At about this time the Fire and Blast
Information Group (FABIG) was set up and has subsequently issued a number of Technical
notes on specific aspects of fire and explosion engineering [2 to 8].
Three further phases of the Blast and fire engineering project JIP were conducted from 1994 to
2001, Phase 2 [9], Phase 3a and Phase 3b [10] consisting mostly of experiments to define and
determine explosion overpressure load characteristics and to provide a basis against which
load simulation software may be validated.
Other valuable work, mostly executed in Norway and following the probabilistic approach, has
resulted in the new NORSOK guidance documents [11,12] which are amongst the source
documents for this Guidance. The results of these and other major investigations are
summarised in the new Engineering Handbook published by CorrOcean [13].
During the same period, the HSE and others have funded approximately 300 individual projects
and a number of Joint Industry Projects (JIPs) at a cost of £31million, which have contributed
significantly to the understanding of the key issues. The relative maturity of the subject has
enabled a better defined approach to be adopted in this Guidance document relying more on
‘good practice’ which has been developed and implemented over the intervening years.
1.2 Objectives
The primary objective of this document is to offer guidance on practices and methodologies
which can lead to a reduction in risk to life, the environment and the integrity of offshore
facilities exposed to the explosion hazards.
Risk is defined as the product of the probability of an event and its consequences. Alternative
definitions are given in the Glossary, Appendix B.
Preventative measures are the most effective means of minimising the probability of an event
and its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are central
to the approach described in this document both for modifications of existing structures and
new designs.
This document consolidates the R&D effort from 1988 to the present day, integrates loading
and response development and provides a rational design approach to be used as a basis for
design of new facilities and the assessment of existing installations.
This Guidance is intended to assist designers and duty holders during the design of, and in
making operational modifications to, offshore installations in order to optimise and prioritise
expenditure where it has most safety benefit.
An additional intent of this Guidance is to move the decision-making processes within the fire
and explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’
as defined in UKOOA’s document on decision-making, the key figure of which is illustrated in
Figure 1 below [14].
Significance to decision
Making process Decision context type
Means of
calibration Codes & standards Nothing new or unusual
A Well understood risks
e
t ic
t Established practice
en
ac
Codes and standards m No major stakeholder implications
pr
d ge
d
ju
oo
Verification g
G
in
e er s is Lifecycle implications
gin n aly BA
a C Some risk tradeoffs / transfers
En ed A,
Peer review
b as . QR B Some uncertainty or deviation from
sk e.g Standard or best practice
Bench marking Ri Significant economic implications
A substantial number of installations will lie in Areas A or B of the chart resulting in an approach
which involves codes and Guidance based on experience and ‘best practice’ (as described in
this document) and supplemented by risk based arguments where required.
The philosophy of using past experience for the estimation of explosion loads has also been
applied to the definition of explosion design load cases, the estimation of dynamic pressure
loads, and to the assessment of explosion response.
• design to reduce the likelihood, scale, intensity, duration and effects of each hazardous
event;
• identification and specification of the particular prevention, detection, control and
mitigation measures needed for each hazardous event
• confirmation of the suitability and effectiveness of each of the measures selected;
• specification of the measures adopted;
• communication and implementation;
• verification;
• documentation.
The hazard management process should be employed in a timely manner and in accordance
with the type, severity and likelihood of each hazardous event. It is essential that all parties who
can contribute to the reduction of hazards, particularly design engineering disciplines and those
who will have to operate and maintain the plant, understand the hazards and are involved
during the appropriate stages of the lifecycle.
The lifecycle approach shows how to prepare and implement a strategy for the management of
fire and explosion on an offshore installation throughout its life, i.e. from design through
commissioning and operations to decommissioning. This is developed firstly by inherently safer
design, followed by prevention of identified fire and explosion hazardous events and then by
the selection of detection, control and mitigation measures. The fire and explosion assessment
process is used in the lifecycle to provide information on which to base decisions and design
systems. Thereafter, it is used to assess these arrangements to make sure that the high level
performance standards have been achieved.
• for new installations it should start during feasibility studies and be fully developed during
detail design. The results should then be communicated to personnel operating the
installation to ensure that they know the purpose and capability of all the systems, can
operate them properly and that adequate maintenance schemes are in place;
• for an existing installation the process should be applied to current arrangements and
modifications. These should be assessed to determine if the high level performance
standards are achieved and that risks are as low as is reasonably practicable.
The management of hazards to reduce the risks involves many interests which may often
appear to conflict with each other. The process is a multi-disciplinary activity, involving all levels
of personnel from senior management to junior staff from a number of different organisations. It
is important that the input and activities of these personnel are fully coordinated and managed.
The SMS of each organisation should identify the relevant roles and responsibilities.
A more comprehensive and homogeneous view of the role of fire and explosion hazard
management within the overall Hazard Management System (HMS) can be found in Part 0 of
this guidance, “Fire and explosion hazard management”.
More information on specifically fire and explosion hazard management can also be found in
Clauses 3 and 4 of this Part 1 of the Guidance.
Clause 2, ‘Explosion hazard philosophy’ [15], defines the goals which should be achieved in
designing for and managing explosion hazards. This clause sets out the process by which it is
decided what has to be done in any particular context and what factors to take into account.
This is achieved by a screening process of the proposed or existing installation so that
resources may be effectively targeted where they are needed. The principles of ‘Inherent
Safety’ are presented and appropriate methods of analysis dependent on the expected risk
level are identified. The tasks identified are linked with the relevant phase of a design project or
the stage in the life of the installation.
Clause 3, ‘Explosion hazard management’ [16], describes the features of an effective Safety
Management System, discusses the choice and management of detection, control and
mitigation systems and identifies the main characteristics of the hazard discussing minimisation
of the consequences of residual events which lead to an explosion event.
Clause 4, ‘Interactions with fire hazard management’ [17], identifies situations where fires may
precede or follow an explosion and deals with common areas in fire and explosion
management, areas of potential conflict between the management of these two types of
hazardous event and the role of deluge in the mitigation of fires and explosions.
The generation of exceedance curves is discussed along with their use in the definition of
achievable design explosion load cases for response analysis. Methods for the calculation of
drag and dynamic pressure loads on piping and equipment are given. Guidance is then given
on the information to be presented when preparing an ALARP justification. Finally a brief
review of the NORSOK protocol [12] is included.
Clause 7, ‘Guidance on detailed design’ [21], brings together the approaches identified in the
other clauses and incorporates additional design and operations experience to provide
guidance on methods of detailed design. The guidance is presented in the context of best
practice and identifies other industry initiatives which have generated detailed design and
operating practice guidance. This subject area will be re-visited in Part 3 of the Guidance.
In this Guidance, the goals which should be achieved in designing for and managing the
explosion hazard are identified. The legislative basis is reviewed and some high level
performance standards are given. (Terms in italics are defined in the Glossary given in
Appendix B).
The features of an effective Safety Management System (SMS) are identified and the choice
and management of detection, control and mitigation systems is discussed. The main
characteristics of the explosion hazard are identified and the relevant issues relating to
interaction with fire hazard management are discussed. The techniques of inherently safer
design described in this Guidance are central to the approach to eliminate, prevent and
mitigate the explosion hazard for new designs.
In order to focus effort where it is most needed, a risk screening method is described which
classifies installations and compartments according to their risk level. The measures for
frequency and consequence severity are based on process complexity and the exposure
potential for people on board. These measures are combined in a risk matrix to give low,
medium and high risk categories. The risk level is an indication of the level of sophistication to
be used in the explosion assessment process.
A number of explosion scenarios on various installations have now been assessed using the
techniques described in this Guidance. It is proposed that this data be used in the
determination of nominal overpressures or for use in the early quantification of explosion
hazards for new offshore facilities. These nominal overpressure values should be available for
inclusion in Part 3 of this Guidance. Methods of deriving useable nominal explosion loads are
discussed in 5.7.
In other situations a scenario based approach will generally be used where release scenarios
are postulated and their consequences and probabilities of occurrence determined. For existing
installations, reliable estimates of explosion loads may be available from previous
assessments.
An essential part of the process of explosion assessment is the determination of the design
explosion loads. The worst credible case of a stoichiometric cloud engulfing the whole
installation or filling an entire compartment will frequently give rise to loads which are too
severe to be reasonably practicably designed against. Design explosion loads are selected on
the basis of their frequency of occurrence and should be accommodated by the Safety Critical
Elements (SCEs) of the installation which will include parts of the structure.
Explosion loads will include both overpressure loads and dynamic pressure loads on piping and
equipment which are due to the movement of gases around them. It is suggested that the
number of SCEs which need to be considered in detail is reduced by classification into
criticality categories with respect to the explosion process.
Reducing risks to ALARP must be demonstrated in all cases, both through the justification of
the choice of design load and from a determination of the impairment frequency of the SCEs
under these loads.
The supporting structure, panels and barriers must be shown to resist the design explosion
loads without collapse and with minimal risk of impairment of the Temporary Refuge (TR),
escape routes or means of escape. The structure therefore is required, globally, to be robust
enough to resist the loads without excessive deformation and ductile enough to undergo local
deformations, preferably without rupture.
The extreme design event explosion load cases are represented by the Ductility Level Blast
(DLB). This is determined using the associated frequencies of occurrence or exceedance and
the space averaged overpressures derived for the relevant scenarios.
An acceptable level of risk should be identified within the ALARP framework, which identifies
the acceptable frequency of exceedance of the severity of these scenarios. Typically this
frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the risk to
people on board, the impact on the SCEs and the overall individual risk from all sources.
There is at present a lack of consistency in the methods used for the generation of exceedance
curves. The HSE has embarked on a study to clarify these, the results of which should be
available for inclusion in Part 3 of this Guidance.
A lesser explosion event, the Strength Level Blast (SLB), is also recommended which
examined using elastic response techniques. This additional load case may detect additional
weaknesses in a design and serves as a robustness check of the structure, other SCEs and
their supports.
Guidance is given on the information required by the response disciplines from the explosion
loading specialists. A common terminology has been developed to facilitate the transfer of
complete and unambiguous information between the disciplines.
The determination of the acceptability of the results of an assessment is also discussed. The
aspects include comparison with high and low level or element specific performance standards
and risk acceptability criteria. The guiding principle here is that risks should be reduced to
ALARP.
Guidance on detailed design is included which brings together the approaches identified in the
other sub-clauses and incorporates additional design and operations experience. Other
industry initiatives which have generated detailed design and operating practice guidelines are
presented and discussed.
This clause is based on References [15] ‘Explosion hazard philosophy and [16] ‘Explosion
hazard management’. Further detailed information on all the topics addressed in this clause
may be found in these Basis Documents. Further material has been included from Reference
[22].
This clause defines the approach to be taken in the assessment of explosion overpressures
and related phenomena and describes how those factors are incorporated into the features of
the installation to bring about a position where the risk from explosion events is reduced to as
low as reasonably practicable (ALARP).
The approach described in this Guidance will enable explosion scenario design load cases to
be rigorously defined, having previously identified the potential explosion scenarios. These
design loadings will have an associated probability of exceedance. The techniques used in
determining structural, equipment or pipework response provide results with a much reduced
variability compared with those used in the determination of the explosion loading. The load
exceedance data can therefore safely be applied to the response results, with negligible
reduction in reliability. These results can then be used in Quantitative Risk Assessment (QRA).
The structure and other Safety Critical Elements (SCEs) should be designed for the identified
explosion scenario design load cases. Where practicable designs cannot be achieved,
alternative means of explosion mitigation must be sought in order to reduce the magnitude or
risk of exceedance of those design load scenarios The structure and other SCEs should be
able to accommodate these design loads.
The philosophy is applicable to all offshore design concepts whether fixed or floating, normally
manned or unmanned. A philosophy for existing installations is also proposed where the design
explosion scenarios require to be assessed in the light of improved understanding and
modelling of explosion loads and structural, equipment or piping responses to explosion These
factors may lead to the need to assess previously determined overpressures, structural
response and consequent risk. It may then be necessary to consider further measures to
mitigate risk and reduce this to ALARP.
This clause defines the goals that should be achieved in designing for, and managing explosion
hazards. In order that these goals can be achieved the philosophy lays out the requirements for
a Safety Management System (SMS), which is the subject of the next clause. A Safety
Management System establishes a safety environment whereby hazards in general, including
explosion hazards, are identified, assessed and controlled to achieve a design where risk is
reduced to ALARP.
This guidance incorporates the findings of recent experiments particularly the full scale tests at
the Advantica Spadeadam Test site [9, 10]] . These tests have produced a large amount of data
which has enabled modelling techniques to be greatly refined to give more accurate definition
of explosion characteristics.
A number of explosion scenarios on various installations have now been assessed using these
refined models and it is proposed that this data is used, where possible, in the definition of
nominal overpressures or for use in the early quantification of explosion hazards on new
offshore facilities. Where such comparisons are not possible, methodologies are proposed for
the quantification of explosion hazards using the latest modelling techniques. Approaches for
assessing existing installations are also provided.
This clause sets out the process by which the engineer/manager decides what has to be done
in the particular context. A method of installation screening is described which enables the
general risk level of the installation to be determined, which then determines the appropriate
level of analysis sophistication which should be used.
For an explosion to occur a gas cloud with a concentration between the upper flammability limit
(UFL) and lower flammability limit (LFL) must be ignited. The overpressure caused by the
explosion will depend, amongst other things, on:
5) The congestion or obstacles within the cloud (size, shape, number, location)
7) Ignition timing
Confinement is defined as a measure the proportion of the boundary of the explosion region
which prevents the fuel/air mixture from venting which is the escape of gas through openings
(vents) in the confining enclosure.
Congestion is a measure of the restriction of flow within the explosion region caused by the
obstacles within the region.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points from 1 to 5 can affect the explosion overpressures in this type of environment.
Two types of explosion can be identified depending on the flame propagation rate:
A detonation is propagated by a shock that compresses the flammable mixture to a state where
it is beyond its auto-ignition temperature. The combustion wave travels at supersonic velocity
relative to the un-burnt gas immediately ahead of the flame. The shock wave and combustion
wave are coupled and in a gas-air cloud the detonation wave will typically propagate at 1500-
2000m/s and result in overpressures of 15-20 bar.
Most vapour cloud explosions offshore would fall into the category of deflagrations.
A typical vapour cloud explosion on an offshore installation would start as a slow laminar flame
ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion
products are created that expand to approximately the surrounding pressure. As the
surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This
turbulence increases the flame surface area and the combustion rate. This further increases
the velocity and turbulence in the flow field ahead of the flame leading to a strong positive
feedback mechanism for flame acceleration and high explosion overpressures.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of pressure in space and time. There will typically be localised high
regions of overpressure with lower values of average pressure acting on large components.
The overpressure at a location within a gas explosion will typically rise to a peak value and then
fall to a sub atmospheric value before returning to zero overpressure.
The duration of the positive phase in an explosion can vary greatly with shorter durations often
associated with higher overpressure explosions. Typical durations range from 50 to
200 milliseconds with longer durations common in large open areas such as the decks of
Floating Production, Storage and Offloading vessels (FPSOs).
For smaller objects, such as piping, the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this case
the overpressure difference will not be the only load component on the object. For this type of
object the dynamic pressure associated with the gas flow in the explosion will dominate.
Small objects may be picked up during the explosion, creating secondary projectiles. The peak
energy for typical projectiles may be calculated from the dynamic pressure load time history
and their mass.
Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact
with the external (oxygen rich) atmosphere. These can affect the venting of the compartment
and enhance the overpressure within.
A blast wave will be generated which will propagate away from the explosion region and may
impinge on adjacent structures.
It is instructive to be aware of the nature of the hazard and focus effort on the most frequent
sources of the hazard as given by the history of releases experienced to date.
The HSE document OTO 2001 055 [23] states that for the UK sector of the North Sea:
Avoidance of potential leak sources in design therefore needs to consider these above issues
in particular. The importance of operational aspects is also shown in proportion of leaks
attributable to poor inspection and monitoring.
Sources of release data include WOAD [24] , OREDA [25] release statistics published annually by
the HSE [26,27] and the HSE/UKOOA publication on the subject [28] . The Minerals Management
Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico
Further similar considerations are included in sub-clause 0 ‘Hazard identification and scenario
definition’.
• the achievement of a condition where the explosion risk for the installation is reduced to
As Low As Reasonably Practicable (ALARP)
Explosion risk is defined as risk from the initiating event and subsequent escalation.
The means of achieving this can be broken down into a number of high level goals whose
attainment will achieve the top level goal. The following high level goals therefore define what is
necessary to achieve an ‘ALARP’ design with respect to explosion hazards:
• the identification of all areas of the installation where there is potential for explosion
events to occur;
• the elimination of the potential for explosion events to occur, or if this is not achievable,
• the minimisation of the frequency of explosion events and,
• the minimisation of the consequence of explosion events
• the implementation of a safety management system which ensures that the above goals
are consistently achievable;
• the implementation of operational management systems to minimise the potential for
explosion events to occur through the life of the installation including decommissioning
and abandonment.
• the minimisation of exposure of personnel to explosion and subsequent escalation
events;
• the minimisation of the environmental impact from explosion events;
• the minimisation of asset loss from explosion events;
• the determination of key explosion hazard parameters;
• the performance of suitable and sufficient assessments of the consequences and risks
associated with the defined explosion hazards;
• the design of structures and the specification of safety critical elements (SCE’s) to
prevent, detect, control, mitigate and withstand the consequences of design explosion
events;
• the implementation of such mitigation measures that are necessary to reduce residual
explosion risk to as low as reasonably practicable (ALARP);
A further set of more specific goals ensure that personnel will reach a safe location in the event
of a major accident event:
• that one escape route to the Temporary Refuge (TR) remains functional at all times;
• the TR and its supports will maintain their integrity in all design explosion events;
• that a means of evacuation to be available at all times;
• that all large off-site inventories are isolated in the event of a design explosion event.
• the ability of personnel to escape from, and to shelter safely from the effects of an
explosion event and the ability to evacuate to a safe location where recovery can take
place is not compromised
2.4 Legislation, standards and guidance
2.4.1 UK Legislation
This sub-clause details the major legislation covering explosion risk. It is not exhaustive as any
legislation covering general safety or requiring a safety risk assessment to be performed, will
be relevant where the potential for an explosion exists. Legislation may be added during the
lifetime of this guidance.
The primary legislation governing safety in the workplace is the ‘Health and Safety at Work Etc.
Act 1974 (HSWA)’. This imposes a responsibility on the employer to ensure the safety at work
for all employees. Employers have to take reasonable steps to ensure the health, safety and
welfare of their employees.
Various regulations are enacted under the HSWA. These include the ‘Management of Health
and Safety at Work Regulations 1999’, which place an obligation on the employer to actively
carry out a risk assessment of the workplace and act accordingly. Risks assessed will include
those from fire and explosion.
More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and
Emergency Response on offshore installations (PFEER) [29] regulations which place on the
Duty Holder the requirement to take appropriate measures to protect persons from major
hazards including fires and explosions. These measures include identification of explosion
hazards and the evaluation of their consequences and likelihood (reg. 5). Regulations 9 to 12
specify the types of measures which are required for prevention, detection, communication and
control of emergencies. The regulations also require mitigating measures to be specified and
put in place and for performance standards to be set for safety critical measures to prevent,
control and mitigate explosion hazards.
The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur
in the case of an explosion event (Regulations 14 to 17).
The Safety Case Regulations SCR [30] require that all installations in UK waters have an
acceptable Safety Case. Information regarding the following issues is required to be addressed
in the Safety Case:-
The Design and Construction Regulations DCR [31] amend the SCR by placing a responsibility
on duty holders to prepare a suitable verification scheme for their installations to ensure
independent and competent evaluation of those elements of the installation which are critical to
safety (known as Safety Critical Elements - SCEs). Performance standards are used to define
the functionality and integrity of these safety critical elements. They will define how these SCEs
are expected to function during and after explosion events.
2.4.2 APOSC
The ‘Assessment Principles for Offshore Safety Cases’ document (APOSC) [32] modifies SCR
with respect to the development of PFEER[29] SI 1995/743, MAR-1995[33] and the DCR 1996[31]
The APOSC document requires the following be demonstrated for Major Accident Hazard
assessments:
Acceptable safety cases will demonstrate that a structured approach has been taken which:
These documents only cover operational leaks rather than accidental releases. They do not
define the extent of hazardous areas from the point of view of explosion and fire risk. Recent
experimental evidence is available relating to dispersion of explosive clouds [10, 39].
Alongside UK legislation, EN ISO 13702 [34] also addresses the need to develop a Fire and
Explosion Strategy (FES) which describes the role, essential elements and performance
standards for each of the systems required to manage possible hazardous events on the
installation.
Guidance on the demonstration of ALARP is available throughout this Guidance and from the
following sources;
HSE guidance relating to Gas Turbine enclosures is relevant as the principles mentioned are
applicable to explosions in general.
• ‘Control of Risks at Gas Turbines Used for Power Generation’, Guidance Note PM84
HSE.[43].
2.5 Inherently safer design
2.5.1 Introduction
Having determined the installation concept it is necessary to manage fire and explosion risk
within the constraints imposed by the subsequent offshore layout.
The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures,
systems or human intervention to protect personnel.
All control systems have the potential for failure to operate as intended – generally expressed
as the Probability of Failure on Demand (PFD). Critical loops are designed according to their
criticality in mitigating personal, environmental or commercial risk by setting a Safety Integrity
Level (SIL). In setting a SIL it is acknowledged that there is failure potential although this is
designed to be inversely proportional to the importance of the loop in risk mitigation.
There is always the potential for the systems to be damaged in a hazardous event. Inherent
safety avoids this potential by aiming for elimination rather than protection and the preference
for passive protection over active systems.
• Fewer Causes
• Reduced Severity
• Fewer Consequences
• More effective management of residual risk
The following Table 2.1 summarizes the major ‘Inherent Safety’ and control features necessary
to achieve the goals stated above:
There may be some conflict between the various features of inherent safety. For example,
increased compartmentalisation will reduce the size of a potential explosive gas cloud however
this will also decrease the potential for natural ventilation and increase confinement. The
balance between such features will be discussed further in this Guidance.
Table 2.1 details inherent safety and control features that minimise the potential for explosion
to occur, or if an explosion should occur, that minimise the consequences and risk to
personnel. These features should be built into the early design of the installation, rather than by
including mitigation measures at a later date. Further details regarding the inclusion of inherent
safety and control features are given in other sub-clauses of this Guidance.
Inherent safety carries on through the life of the installation continuing through the operational
phase by adherence to effective inspection and maintenance regimes and by ensuring that
management systems and related procedures are followed as intended.
EMERGENCY RESPONSE.
EXTERNAL systems
This indicates:-
• The use of passive rather than active control and mitigation systems
• No reliance on personnel to prevent, control or mitigate hazards
The Table below defines and expands upon some of the terms used above [44]
Type Description
Passive These are systems that act upon the hazard simply by their presence. They do
not need to react to the hazard or need operator input at the time of occurrence
in order to be effective. The only modes of failure are long-term deterioration,
physical damage or removal. They are preferred because they are inherently the
most reliable, requiring only inspection and maintenance, thereby reducing the
need for people to be in hazardous locations. Typical examples are corrosion
allowances, layout, welded connections, relief panels and natural ventilation.
Separate accommodation platform fully rated barriers and primary structure
subsea completions.
Active These are systems that may require mechanical or electrical facility, or control
signals in order to work. They are susceptible to failure and downtime of these
systems. As such, they are less reliable, particularly where their failures may not
be visible. They require inspection, testing and maintenance, and are thus
susceptible to human error or omission. They also cause increased numbers and
activity on the facility. Typical examples are, depressurization systems, fire and
gas detection and active fire and blast suppression systems.
Operational These are systems that depend primarily upon people, either to initiate the
system, or to carry out the whole function. As such they can be the least reliable
and require sufficient trained people to be on the facility in order to ensure their
operation, with associated minimum competences and procedures. Their
effectiveness is wholly dependent upon the future operator, who should agree to
the dependence on these measures. Typical examples are; maintenance,
inspection and condition monitoring.
External These are systems that depend on the correct reaction of people beyond the
company itself, and its direct workforce. There is clearly further room for error
due to the longer communication lines and frequent changes of the people
involved. Effectiveness is dependent upon effective contracts and audit.
Examples are; the dependence on the competence of a supply boat master to
avoid riser impact, and isolation of a third party feeder pipelines.
The safety management system SMS should specify the need for an HS&E Plan for all projects
where significant risk to personnel or the environment is possible. The HS&E Plan(s) will define
how health, safety and environmental issues will be handled throughout the life of the project.
More than one plan may be in place, covering different parts or phases of the project. If this is
the case an overall, bridging plan should be available to cover the interfaces between the
individual plans.
The HS&E philosophy for the project should reflect the goals listed in sub-clause 2.3.
Management of explosion hazards and Safety Managements Systems are dealt with in the next
clause.
When hazards are identified with potential to give rise to risk to personnel or the environment,
in the first instance the aim should be to eliminate or minimise the hazard and the risks
associated with it. Thereafter the aims shall be (in order):
This clause provides the engineer with the means of managing the various factors which
contribute towards;
The remaining sub-clauses focus on management of the explosion hazard itself and how an
installation may be designed to reduce risk from explosions to as low as reasonably practicable
(ALARP).
Further guidance on health and safety management can be found in the Basis Document
covering management systems [16].
3.2.1 Purpose
A Safety Management System (SMS) provides a framework whereby an organization can be
assured that So Far As Is Reasonably Practicable (SFAIRP) its operations can be undertaken
in a demonstrably safe manner.
The SMS will demonstrate the means by which the organization’s safety policy is put into
effect. The structure of the SMS should comply generally with accepted standards from the
regulator and industry [46].
3.2.2 Content
Each management system will have the same basic elements, these will include systems
relating to:-
Review Organization
Resources
Procedure
Leadership
and
commitment Risk
Implement - Identification
- Evaluation
Monitor - Management
Planning
Audit
It is general practice within the Offshore industry (for all but minor projects) to have specific
HSE Plans drafted at the earliest practicable stage, usually at the Front End Engineering
Design (FEED) stage. This HSE plan defines how safety and environmental aspects of the
project will be managed. Typical contents will include:-
• a declaration of project’s specific HSE policy statement and of the organization’s HSE
policies
• a summary of the safety criteria and targets set for HSE design
• the project’s organization and reporting structure specific to HSE issues, from board
level downwards
• details of the roles and responsibilities of those persons named in the safety
organizational structure, including all levels within the project
• details of how the technical competency of the operational and design personnel is
guaranteed
• details of the HSE activities on the project needed to ensure the appropriate level of
safety and environmental integrity
• a schedule of HSE deliverables (i.e. documentation to be produced)
• the control of quality regarding bought-in items, services and sub-contracts
• relevant legislation and procedures available to undertake the above activities
• an audit plan.
The issues noted above are also important when dealing with bought-in items and services, the
quality of work carried should match the standards expected from the company system.
The high standard of design and product may be compromised by the input of others.
The Plan should reinforce the premise that HSE is a line management responsibility, that each
discipline and each individual is responsible for the safety and environmental impact aspects of
his work. The role of the Safety Group to police the work of others beyond the usual inter-
disciplinary review of outputs cannot be relied upon. Where hazards or potential benefits are
identified it is the individual’s responsibility to identify the scenario and ensure that it is
resolved.
The Plan should be approved by the appropriate representative of management and circulated
to all disciplines for them to cascade to individual worker level. All personnel should be aware
of the standards required with respect to safety and environmental issues and what their role is
in achieving this.
3.2.4.2 Resources
In order to carry out the work in a timely manner and with the necessary degree of competence
sufficient resources must be made available. With respect to explosions the definition of the
hazard must be identified at the correct time in the design process such that actions can be
taken to accommodate it, So Far As Is Reasonably Practicable (SFAIRP).
Resources in the context of competent personnel must be available during the following project
stages;
• at concept selection stage to have safety and environmental input to ensure that the
option chosen is the one with the lowest risk, as far as is reasonably practicable;
• at the FEED stage to ensure that layout issues are handled to minimize explosion
hazard and risk;
• during the detailed design stage to ensure that control and mitigation systems are
incorporated as necessary;
• throughout the design period to quantify as necessary the overpressure that may be
encountered and the resultant risk.
Consideration of the explosion issues at different stages in the design of an installation is
discussed in sub-clause 2.5.4 of the Commentary.
Personnel undertaking the work should be suitably trained or experienced in the methods that
need to be used. With respect to explosions suitable training is particularly important as new
research is continually developing fundamental information on the mechanism as well as
innovative means of control and mitigation.
3.2.4.3 Procedures
It is one function of the SMS, to ensure that activities are carried out in a correct and consistent
manner and at the correct stage.
It is a requirement that procedures and design guides will be available for engineers to follow
and consult at all stages of the project. They should state the methods by which the activity
should be carried out, by whom the work should be done and any performance standards or
criteria that should be met. Procedures for dealing with bought-in services, should include the
process by which prospective suppliers are assessed and the criteria that need to be met to
qualify for the work.
Procedures should be available at key locations (for instance in the design office and with the
QA engineer) for consultation at any time. They should be regularly reviewed and updated as
necessary to include new systems or as a result of the findings from audits undertaken.
3.2.4.4 Leadership
Senior management should provide strong, visible leadership and commitment to HSE issues
and ensure that this commitment is translated into the provision of the necessary resources to
ensure that all the elements of the SMS as described above can be carried out effectively.
There should also be a driving force from management to achieve a continual improvement in
HSE performance. Project management should maintain a high profile for HSE issues
throughout the life of the project, with HSE issues featuring prominently at regular project
progress meetings and at meetings to all levels within the management hierarchy.
Effective leadership should also encourage involvement and participation in the HSE
management process at all levels. This should seek to promote each member of the design
team to look at the work he/she is doing and understand the effect it has, or may have, on the
overall HSE performance of the project and the end product. This should further encourage
each member of the design team to air any concerns they might have with regards to HSE
performance.
• Concept selection
• Concept definition
• Front end engineering design (FEED)
• Detailed design
• Fabrication/Construction
• Installation/Start-up
• Operation
• Decommissioning
The concept selection and definition phases are traditionally the time in which the most
significant project decisions are taken. The majority of these decisions have a significant
influence on the hazards which must ultimately be addressed by the engineering work and
subsequently during the operational phase of the project.
• Maximum safety leverage is available during the selection and definition phases.
• The cost effectiveness of safety effort expended during the selection and definition
phases is significantly better than during the later phases.
• The impact on project schedule of safety effort expended during the selection definition
phases is significantly less than during the later phases.
• Unsuccessful safety performance during the selection and definition phases may result
in failure to attain the maximum safety potential, or if it were to be attained it would be at
the expense of significant cost and schedule penalties.
Attainable
Safety
Performance
Define
Select
Concept
As described above, the demonstration of ALARP is issue specific; it is recommended that the
following general philosophy be applied for addressing explosion hazards on risk offshore
facility:
The Table below summarizes the factors affecting explosion risk by project phase
Where the risk associated with an outcome is low, any inaccuracies in determining that risk will
also be low in absolute terms. The effort expended should be proportional to the risk. It is
important therefore to have a means of early estimation of the risk level of an installation to
determine the appropriate approach to be used in installation explosion assessment.
The approach to explosion assessment needs to be decided early in the design process when
absolute values for explosion frequency and detailed consequence analysis are not available.
Risk is the product of consequence and frequency of occurrence. This risk can be calculated as
a numerical value expressed as Individual Risk (IR) or in terms of a value for the installation
such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative
measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the
assessment approach to be adopted.
Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.
A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix
of potential consequence and likelihood of an explosion event [47] is described in this sub-
clause.
• fires resulting from loss of inventory from damaged equipment, pipework and vessels;
• loss of TR integrity by failure of the boundary partitions;
• structural failure;
• inaccessibility of means of escape and/or evacuation.
For the installation under consideration the direct and indirect effects of explosion overpressure
should be identified. This should be achieved by assessing parameters such as;
Low consequence outcomes would be predicted where the overpressure level is predicted to
be relatively low and immediate and delayed consequences are also low. The equipment count
would probably be low, being limited to wellheads and manifold with no vessels (i.e. no
associated process pipework) resulting in low congestion and inventory. Confinement should
also be low, with no more than 2 solid boundaries including solid decks. Manning would be
consistent with a normally unattended installation with a low attendance frequency, less
frequent than 6-weekly. A 6-weekly visit by a maintenance/intervention crew results in
occupancy of a little over 1 %.
Where there is doubt regarding the category into which an installation should fall, it is
recommended that the category with next higher consequence is used.
3.4.3 Likelihood
The likelihood of an explosion will depend upon the likelihood of occurrence of a gas cloud and
delayed ignition. The following parameters will influence the potential likelihood of an explosion:
• hazardous inventory complexity, i.e. the number of flanges, valves, compressors and
other potential gas leak sources;
• the type of flanges, valves or pipework. Some generic types of flange tend to have
lower leak frequencies associated with them, e.g. hub type flanges;
• the number of ignition sources within the potential gas cloud;
• the ventilation regime;
Low event likelihood installations and compartments will have a low equipment count. The
frequency intervention of 6 weeks or more is also recommended as a criterion as this will be a
surrogate for equipment count and reliability as well as a measure of maintenance risk with
respect to explosion.
Medium event likelihood is suggested by an NUI with equipment count greater than for the ‘low’
case. Similarly, where the planned frequency of maintenance/intervention is greater than a 6-
weekly basis then this suggests a higher or less reliable class of equipment with medium level
of potential for explosion.
Where there is doubt regarding the category into which an installation should fall, it is
recommended the category with next higher likelihood is used.
Consequence
Low Medium High
High Medium risk High risk High risk
Frequency/
Medium Low risk Medium risk High risk
Likelihood
Low Low risk Low risk Medium risk
These initiating events should be eliminated if possible otherwise prevention, control and
mitigation will become necessary. An example methodology for the definition of scenarios is
shown in the flow diagram of Figure 4. Fire and explosion interaction is discussed in Clause 4.
Explosion scenarios must also be considered from the point of view of the fire hazard.
3.5.2 Identification
It is not possible to manage hazards without understanding them, it is necessary therefore to
undertake the necessary exercises to ensure they can be identified. It should be the aim of all
projects to identify the major safety and environmental hazards as early as possible in the
project so that they can be assessed and acted upon as necessary in a timely manner.
The means by which hazards are identified may be by formal processes such as:
Hazards may also be identified by the individual in the course of his work. A key element in the
management of hazards is the establishment of an action tracking system. A log should be kept
of all actions arising from hazard identification studies, reports and project concerns so that
they can be formally held in a single data-base, tracked and eventually closed out, thus
ensuring that none is forgotten or ignored. This is called the Safety & Environmental Action
Monitoring System, or similar title, and is generally managed by the Safety Group within the
project.
Additionally, it may aid the management of hazards to compile a hazard register listing all
significant hazards, their cause, and how each is handled.
3.5.3 Causes
Causes of a release may be dropped objects, ship impact, intervention, fatigue, vibration,
extreme environmental conditions, imperfections, escalation from a fire, exceedance of design
conditions and human error. These causes are often referred to as initiating events.
Sub-clause 2.2 gives an historical overview of the sources of releases for the UK sector of the
North Sea from Reference [23].
[48]
Generic release scenarios based on historical evidence in the Gulf of Mexico and the UK
sector of the North Sea [23] are listed below starting with the most credible:-
1. Pump Seal or Gasket Leak: Often represented as a 5 mm orifice or the annular space
between the flanges without a gasket or between the pump shaft and the caseless seal.
3. Medium Line or Partial Large Line: Often represented by a 50 mm orifice and evaluated as
a possible credible release scenarios especially when considering dropped objects.
4. Large Transfer Line & Vessel Nozzle Failure: Full pipe diameter. Rarely considered as
credible for design although frequently appears in loss databases. Evaluated usually for
off-facility or facility separation distance determination and emergency response planning
purposes.
3.5.4 Evaluation
For each hazard, including explosion, that is identified an evaluation should be made of the
potential consequences and the risk to personnel, the environment and the asset.
• if the overpressure, or other explosion effect such as severe vibration, exceeds the
quoted survivability criterion in the element specific performance standard for the SCE,
then its functionality is assumed to be impaired;
• As far as explosion impact on humans is concerned there are seven primary hazards.
These are direct overpressure effects, burns from the flame front, oxygen depletion,
removal of protective clothing, the impact of blast wind on personnel, the impact of
objects on to personnel and the inhalation of hot products of combustion
• It is probable that personnel around the periphery of the module, where gases vent, will
be more susceptible to blast wind than static overpressure. It is suggested [1] that at
20m/s most people would be knocked over. Injury may then result from contact with
hard objects or exceptionally by being thrown overboard;
• It is difficult to quantify the risk from blast wind and inhalation of hot gases. In QRA it is
often conservatively assumed that anyone within the same module as the blast
becomes a fatality.
3.5.5 Hazard & Risk Management
Where significant risk is identified, systems shall be put in place where practicable for its
reduction. A hierarchy should be used when considering suitable means of risk reduction. In
the first instance, the aim should be to eliminate the hazard entirely. If explosion events cannot
be eliminated the aim should be to:
Control implies the detection of the initiating events and actions initiated after the detection to
reduce the hazard or exposure to it. For the explosion hazard, systems will have a role in:
Measures that can be used to fulfil the control and mitigation roles are given in Table 3.3 below.
3.6.2 Detection
The aim should be to detect hazardous gas, vapour or oil spray accumulations and to initiate
control measures at the earliest opportunity. Gas detection devices should be located where
accumulations are likely to occur. In locating the detection devices some knowledge of the
dispersion of the accumulation is desirable. This will include any area where hazardous fluid is
handled, i.e. a fluid handled above its flash-point or within 20C of it.
Detection should result in an immediate alarm, so that personnel can escape from the local
area and the potential direct consequences of the explosion. Upon detection deluge should
normally be initiated where congestion dominated explosions may occur when the danger from
the creation of additional ignition sources is considered unimportant. (Deluge should not be
initiated on gas detection in confined areas as the result may be to increase overpressure due
to the added turbulence induced by the spray.)
Confirmed detection should give rise to executive actions to help limit the potential for an
explosion to occur or limit the consequences. This will involve Emergency Shutdown ESD at an
appropriate level, initiation of blowdown and isolation of non-essential electrical supplies. All
electrical equipment remaining in operation within the explosion zone should be rated for
operation in a Zone 1 hazardous area [35]].
A critical feature to be taken into account during design is the choice of detection devices to
provide rapid response and avoid spurious action. If the operator loses faith in the system
installed there is a risk that either the outputs will be disabled or that it will not be correctly
acted upon when a hazardous event actually occurs. The latest infra-red hazardous gas
detection devices are reliable and if correctly installed should not give rise to spurious trips.
They also provide a rapid response which is important where deluge is used as a means of
overpressure reduction.
In hazardous gas detection, two levels of action are usually specified, ‘low level gas’ and ‘high
level gas’.
The Low Level Gas action point, generally the alarm level, should be established at the lowest
level that detector can reliably be set without spurious tripping. This will ensure the earliest
possible detection of the leak by this means.
The High Level Gas action point, generally the executive action level, should be set at the
lowest level whereby it is considered reasonable to instigate executive actions. High and Low
Levels may be combined to a single action level. It is then recommended that this level is set
as low as practicable consistent with the avoidance of spurious trips.
Ultrasonic leak detection is another means of detecting a loss of containment, this does not rely
on the device being within the gas cloud to be tripped. This can be of significant benefit in the
early detection of leaks. This type of detector picks up the high frequency noise emitted by a
sonic leak. It is often used for alarm only, but this depends upon the potential for spurious
initiation, e.g. leaking pneumatic systems. If the potential for spurious/faulty action is low then it
should be considered for executive action especially in the initiation of deluge when acoustic
detection may be expected to give a more rapid response to a leak that conventional gas
detectors. Infra-red devices may also be beneficial as they too do not need to be in the cloud
to detect a gas release. Increased confidence in these types of detection is likely to lead
further to their use in automatic initiation of executive actions, such as including process
shutdown.
• alarm to personnel
• Emergency Shut Down (ESD)
• blowdown/depressurisation
• electrical isolation
• shutdown of fans for detection in external areas
• start of standby fans for detection in enclosed areas
• deluge initiation
The following figure indicates the actions that may be taken upon gas detection.
ESD
Ventilated Area
Ventilated Area (non hazardous)
(hazardous)
•Stop ventilation
•Start all fans
available HVAC •Close HVAC •Isolate non-essential
ventilation fans dampers electrical equipment
•Close ESDVs
•Open EDPDs
•Trip mechanical plant
Unless blowdown is rapid it will tend to have a small impact on the flammable cloud size
generated since, for a typical methane rich hydrocarbon release with a Lower Explosive Limit
(LEL) of 5 % volume concentration with 9 % as the stoichiometric volume concentration level;
only a relatively small amount of gas is required to develop a large explosive cloud. The use of
standard API blowdown rates [49] is intended for the mitigation of fire escalation only, these
rates are under review even for this use. API 521[49] is now known to recommend blowdown
rates which are too low for offshore use. The aim for explosion mitigation should be to
depressurize the process as rapidly as reasonably practicable, balancing the gains from the
reduced period of flammable gas cloud duration and reduced escalation consequences against
size and cost of the vent system and the impact of thermal radiation from the flare or ignited
vent. In general the API standard requirements [49] should be regarded as a minimal rather than
an optimal and are not related to the explosion hazard.
In order to remove the inventory from the explosion zone more quickly, it may be feasible to
close the upstream isolation valve and leave the downstream valves open if there is a
significant pressure drop in the process. The inventory will then tend to drop to the lower
pressure through the downstream control valve. Full isolation from downstream inventories
should however be completed as the pressure equalises. Downstream isolation valves and
actuators should be outside the explosion zone or protected from the potential effects of blast
so that closure after an explosion event is still possible. Closure of the downstream valve
should occur after a delay built into the shutdown software or initiated by a pressure sensing
device as long as this will remain functional after the explosion and any foreseeable escalation.
Rooms containing hazardous gas inventories are generally operated at negative pressure
compared with adjacent non-hazardous areas to prevent leakage of potentially explosive gas
clouds to those adjacent areas. Upon detection of flammable gas, the standby fan(s) should be
started to give maximum possible ventilation in order to aid dilution of the leak to prevent or
limit the generation of an explosive cloud.
Non-hazardous rooms adjacent or close to hazardous areas are normally operated at a positive
pressure to prevent ingress of explosive gas clouds. Upon gas detection, which would normally
occur at the fresh air intake, all fans should be stopped and the intake and discharge isolated
by (nominally) gas tight dampers.
3.6.7 Deluge
The Phase 3a Advantica Spadeadam tests [50] confirmed that deluge can significantly reduce
high explosion overpressures. The benefits of deluge have now been incorporated into the
major CFD and some phenomenological simulation software. Fears that the deluge would
provide an ignition source through electrostatic effects have proved unfounded [51] although
there is a residual doubt about the ignition potential due to charge accumulation on isolated
conductors e.g. scaffolding. The initiation of deluge and water curtains on a quiescent gas
cloud may induce turbulence in the cloud, limit ventilation and mix an inhomogeneous cloud.
These effects could give rise to higher overpressures.
The mechanism by which this mitigation occurs is by inhibition of the combustion process and
by cooling of the products of combustion as the deluge water is converted to vapour.
Deluge from standard MV or HV nozzles has been found to be suitable for reducing
overpressure in congestion generated explosions. Congestion generated explosions are
characterised by a fast moving flame front. This acts on the droplet to break it up and give a
greater overall surface area so that it more efficiently achieves the quenching effect on the
combustion mechanism. The usual general area coverage rate of 10 l/min/m2 [34], even with
15 % added for hydraulic imbalance, falls outside the rate investigated in the JIP tests [50]. If
explosion mitigation is considered critical a deluge flow-rate of at least 13-15 l/min/m2 is
recommended for general area coverage. This will have a significant effect on lowering peak
overpressures. Greater flows up to about 20 l/min/m2 will have a marginally increased benefit.
It is important that the deluge is employed as area coverage rather than equipment specific
protection. Equipment specific protection only applies deluge to small discrete areas and this is
not sufficient to give any meaningful control of overpressure.
For large open deck areas, such as FPSOs, the process area is generally divided into fire
zones in order to limit the size of the firewater pumps. On large open decks firewalls are not
generally practicable so the deck is divided into fire zones where fire events may be expected
to be confined, these may be discrete process blocks or pre-assembled units. Firewater pumps
are sized to deluge the zone in which fire detection takes place, and immediately adjacent
zones.
Large gas clouds can, however, cover a number of such fire zones. This means that there is
insufficient water supply to cover the whole flammable cloud. For these applications and where
equipment specific deluge only is installed, water curtains may be used to arrest the flame
velocity and prevent runaway flame acceleration. A double curtain of MV nozzles supplying
water at a rate of about 15 l/min/m2 for the area covered by the curtain and spaced at 10m
intervals should be effective in arresting runaway flame acceleration and prevent excessive
overpressures. Other devices such as fan sprays have also been tested and may give
coverage more suited for curtain use.
Deluge would then be applied to the fire zone where initial gas detection takes place with water
curtains supplied simultaneously from a separate deluge valve.
Some CFD overpressure modelling programs can accommodate the effect of water curtains so
an optimisation of frequency and coverage of curtains within the practicalities of firewater
demand can be undertaken.
A major problem in determining risk levels for an installation with explosion mitigation by deluge
is determining the level of risk reduction that can be assumed. This is due to at least two
factors;
• the delay between leak initiation and deluge being applied to the module;
• the reliability of the deluge system, from detector device through to deluge nozzle.
• for the majority of low pressure events there is no benefit particularly if the coverage is
incomplete
These factors can be however estimated from a knowledge of the equipment and systems
within the module.
The benefits of explosion mitigation by general area may deluge may only be considered only if
a time dependent ignition probability is used and the deluge can be applied within the reliability
constraints of the system.
The use and effectiveness of deluge as a fire and explosion mitigation measure is discussed in
sub-clause 4.7.
In order to demonstrate that these systems remain functional and fulfil their duties, element
specific performance standards defining how the SCEs will operate under normal and extreme
conditions. SCEs that mitigate the effects of a major accident will have to remain functional
after initiation of design accidental events, e.g. explosions. A design accidental event is one for
which SCEs on the installation should perform their function as designed. Extreme events
against which design is not reasonably practicable may result in loss of these systems.
A typical listing of SCEs would include the items given in Table 3.4:
Of the above SCEs all, apart from the crane/lifting appliances, should remain functional during
and after an explosion event, and the remaining items should not fail so as to give rise to a
hazard, e.g. catastrophically collapse. The performance of each SCE is defined in element
specific performance standards which remain with the SCE throughout its life and against
which its performance is assessed. The element specific performance standard defines the
item’s Functionality, Reliability or Availability, Survivability and some measure of interaction
with other safety systems.
Survivability includes its endurance under explosion loads. The design of the system must
therefore match its stated survivability so that its functionality is maintained in an explosion
event. The specific explosion effects which it may need to withstand are;
• overpressure
• dynamic pressure
• displacement effects
• strong vibration
• exposure to missiles
3.7.3 Equipment specific performance standards
The term Performance Standard has become interpreted as having a very specific meaning
when related to the DCR which amends the SCR. One of the aspects of DCR is the
identification of Safety-Critical Elements and the preparation of a Written Scheme of
Verification for assurance of continued integrity. A Performance Standard can be described as
a series of statements which can be expressed in qualitative or quantitative terms the
performance required of an SCE can be compliant with DCR.
The equipment specific performance standards or low level performance standards define the
requirements in terms of functionality, availability and survivability.
The Performance Standard is a means of condensing the Design Specification and Operating
Procedures into a requirement related to a particular system in a particular mode of operation
in the face of an identified hazard. The justification for the requirement and the degree to which
it is achieved is contained within the Written Scheme of Verification or Examination.
• The maximum credible peak overpressure, but very low frequency of occurrence;
• The practicable limiting overpressure for design purposes, giving ALARP risk levels;
• Overpressures giving elastic response levels in components, for early design and
robustness checks.
With systems such as gas detection, the ability to withstand a major explosion may not be
warranted, so long as the presence of the gas build up is identified. The element specific
performance standards thus need to be realistic and fit-for-purpose, taken on a element by
element basis. The performance standards need to take into account initial design and
manufacturing cost, practicability of construction, maintenance, accessibility for inspection,
reliability, robustness and redundancy.
[53, 54]
To this end OTO 1999 046 and 1999 047 , detailed the use of a criticality rating system
similar to the one given below:
Criticality 1 Equipment and pipes designed to withstand the same explosion severity as the
main structure.
Criticality 2 Equipment and pipes designed for a less severe but non-the-less substantial
explosion event.
The difference between Criticality 1 and 2 items would be associated with the consequence of
fire escalation and escape from the facility. It was recognised in the paper that the assessment
of Criticality 1 items would be very much constrained by project schedules and costs under
current design project philosophies. The key question though must be whether current design
practice delivers equipment and their supports which, if designed primarily for in-service
loading, provide safe and fit-for-purpose details when subjected to extreme explosion events.
Based on the limited amount of strengthening or modification to existing equipment required for
operators to delivery satisfactory Safety Cases upon their most recent submission, it must be
presumed that past designs are reasonably robust and a significant increase in design effort
would not therefore be warranted or necessary.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting structure.
Performance standard – These items must not fail during the DLB or SLB,
ductile response of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment.
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to
blowdown and or pipework damage.
The Strength Level Blast (SLB) and the Ductility Level Blast (DLB) are defined in the glossary,
Appendix B and sub-clause 3.6.
A reduction in pressure will also result in a lower inventory mass within the system which will
give the potential for more rapid blowdown and reduced escalation consequence
3.8.3 Ventilation
Assuming that some loss of inventory from a hazardous process will occur at some time,
ventilation is critical in ensuring that a significant flammable gas cloud does not form or that the
cloud is reduced in size, particularly for small leaks which are the most frequent.
Industry guidance [35] defines ‘adequate ventilation’ as ventilation achieving at least 12 air
changes per hour for at least 95 % of the time, with no dead spots. The term ‘adequate
ventilation’ is not meant to imply an optimum level of leak dilution; it should be regarded as
minimum target. Increased ventilation rates will ensure dilution of larger hazardous leaks and
reduce the potential for explosions to occur or reduce its severity.
In the case of natural ventilation adequate ventilation needs to be confirmed. For small
wellhead platforms and NUIs this can generally be demonstrated qualitatively since
confinement is low. For more complex installations the only way of demonstrating adequate
ventilation will be either by CFD modelling of the ventilation regime, or wind tunnel testing.
Where there is inadequate ventilation the options are to re-orientate the installation to make
more use of prevailing winds, to remove confinement, to relocate equipment to provide a freer
air flow through the module and to add some fan assistance at dead spots.
A special case, but one which typifies that various considerations that arise in the ventilation of
a hazardous area, is that of turbine enclosure ventilation. The means of managing this risk is
detailed in the HSE guidance[55]. This relies on fast dilution of the leak at source to prevent
significant flammable clouds forming.
Apart from smoke logging and natural ventilation, operational factors also enter into the
orientation assessment as supply vessels and helicopter approaches tend to be towards the
flow of current or wind respectively.
The preliminary QRA is likely to give an indication as to the relative risks of fire, toxic gas or
explosion. It is probable that explosion risk (including escalation from an explosion event) will
be well below that from process fires and that operational constraints of supply vessels, at least
on the larger installations, will tend to set the orientation, with natural ventilation being a
secondary consideration.
FPSOs are unique in that they orientate themselves according to the relative forces of the
current, wave and wind, called weather-vaning. Frequently the vessel will be positioned with
the wind blowing lengthways from bow to stern. This is not the preferred arrangement from an
explosion point of view as a gas cloud will extend along the deck within congested areas rather
than being blow out to the sides.
With fan assisted ventilation, for instance in a closed module, it is relatively easy to show that
‘adequate ventilation’ has been provided. The provision of 12 air changes per hour as an
absolute minimum [35] with a qualitative demonstration that there are no dead spots by the
suitable location of supply grilles should suffice.
• Minimise confinement
• Minimise congestion
• Minimise flame front path length
• Reduce potential gas cloud size
• Reduce unfavourable ignition source locations
Generally, layouts that result in maximum potential for venting and minimise the potential for
turbulent flow generation, particularly in the early stages of flame travel, will reduce the final
overpressure.
A large, correctly aligned, vessel may have little effect on overpressure but a number of small
bore pipes of similar volume will have a significant effect since the turbulence generated will be
greater. Since smaller items tend to give rise to the greater level of turbulence critical for
overpressure generation a suitable measure of overpressure generation potential may be the
mean diameter of equipment. This does not however take into account the amount of
equipment present. The Volume blockage ratio is a suitable measure of this. To judge the
degree of congestion in a given arrangement the volume blockage divided by mean diameter
may give a measure of congestion. These measures are in need of further investigation. This
issue will be pursued further in Part 3 of the Guidance
The effect on overpressure of the above recommendations can be variable and in some cases
conflicting. It is necessary to optimise the overpressure management techniques by reference
to a calculation model to confirm the downward trend. Phenomenological models may suffice
for this purpose. The intention is to identify trends in overpressure, not absolute values, it is not
then the accuracy of the model in predicting overpressure values that is required, rather its
ability to identify trends; its speed and ease of use.
The area around vents should be kept as clear as possible. Any blockage of these will result,
not only in increase in overpressure, but also in the velocity of the gases being vented.
Installations tend to have escape routes around the periphery of modules so that minimisation
of explosion consequences at vents will have less impact on escaping personnel and prevent
damage that may affect escape routes. Additionally, pipework located near vent areas will be
subjected to drag forces proportional to the square of the exit velocity. It is therefore preferable
to locate pipework away from vent areas so that they do not block the vent path but also
because the forces exerted on them may be difficult to accommodate.
Careful layout at an early stage in a design project by orientating major vessels parallel to the
expected gas flow during an explosion and avoiding the blockage of vents, can reduce the
peak overpressures by a considerable amount.
Figure 5 shows comparisons of good and bad layout options from the point of view of explosion
overpressure.
Reduce
volume Safe area
Reduce
Blockage ratio
And number
Of obstructions
Move
obstacles to
Inner part of
module
Sideways
venting
Reduce
Blockage ratio,
Increase
Transverse
spacing
• Blow-out panels take a finite time to move out of the way of the expanding gas and may
not prevent further overpressure increases.
• Normal louvres create sufficient obstruction to cause increased overpressures.
• Sharp cornered objects generate higher peak pressures than rounded obstacles.
3.8.9 Blast Relief Panels
Blast relief panels, which open quickly during an explosion in order to reduce peak
overpressures, must be carefully designed. It is unlikely that loosening of cladding panels will
have the desired effect.
Panels may be retained (e.g. hinged) if there is significant risk posed by them becoming
missiles, otherwise they can be free of restraint.
• static overpressure
• dynamic overpressure
• displacement effects
• strong shock (strong vibration) effects
Heat effects tend to be transitory and the thermal inertia of most items should ensure that
thermal effects of the explosion event are negligible.
Equipment on anti-vibration mounts may be displaced if the mount topples. If this is considered
possible restrained mountings should be specified or sea fixings retained during operation.
The smaller safety critical elements can either have enhanced support to withstand blast wind
effects or be located near a bulkhead or structure where the wind effect will be low. This may
be appropriate for fire and gas detection devices.
Flare/vent and firewater piping can be especially susceptible to blast forces since they are
generally of low pressure design and therefore light-weight. Damage to flare/vent lines can
result in large quantities of gas entering the module, especially as the installation will probably
be being blown down at the time. This would lead to jet fires and possibly secondary
explosions. Damage to firewater lines would result in the loss of fire control measures within
the explosion zone. Means of protecting these lines will include and or all of the following:
• not running these lines near vent areas where blast wind forces will be high
• increasing the schedule of the lines to increase inherent robustness
• increasing pipework supports
• running these lines in the shelter of structural elements
Detailed guidance on the methods of designing for static and dynamic overpressure is given in
Clauses 6 and 7.
As with all potential hazards the aim should be to avoid the situation occurring, that is, by
avoiding arrangements where items are attached to floor and ceiling. This may not however be
reasonably practicable. If this is so, sufficient resilience should be included in the design to
accommodate the differential movement. This may be achieved using resilient mounts or by the
building in of flexibility to the piping runs.
Good design practice however should be employed to mitigate the consequences of this
severe vibration, this involves;
• the location of vibration sensitive safety critical elements distant from potential explosion
zones, especially not attaching them to common boundaries;
• the use of shock or resilient mountings to absorb vibration effects;
• additional restraints to items that may topple and cause damage or lose function, e.g.
cabinets, bookcases;
• slack in cables where displacement of control or electrical equipment is possible.
Specialist products, shock mounts, are available from companies marketing anti-vibration
equipment. Their advice should be sought before any mountings are fitted since, if the wrong
product is installed, enhancement of the vibration effect can occur. The natural frequency of the
mount must not coincide (within a factor of 2) with the natural oscillation frequency of the
loaded floor. The structural design group should be able to estimate the approximate natural
frequency of the structure at the mounting point so that the correct mount can be specified.
The philosophy for minimising the potential for missile generation is to ensure general tidiness,
especially in the hydrocarbon processing areas and areas adjacent to the TR. Small items such
as fire extinguishers and items of safety equipment should be kept in cabinets firmly fixed to the
structure preferably against a partition or structural member where blast wind will have little
effect. There should be no loose items in the module, i.e. items that are not fixed to the
structure or substantial equipment items. Maintenance equipment such as scaffold poles and
tools should not be stored in process areas and should be removed when no longer required.
• inert gas
• barriers
• soft barriers
• micromist
3.8.13.2 Inert Gas
Inert gas can be used to dilute the flammable mixture by flooding the volume within which the
gas has been detected, with for example CO2, N2. The explosive gas can then be taken below
its lower explosive limit. This is most appropriate for enclosed volumes where the environment
can be controlled. Care should be taken in providing such systems as they can pose a
significant asphyxiation risk to personnel and they should be discounted if the overall risk of
using them is greater than the explosion/fire risk saved. This might particularly be the case for
generally manned areas.
Inergen (CO2 + N2 + Ar) is an alternative inerting material but it has a volume 30 times that of
Halon systems (now banned) which it may replace.
3.8.13.3 Barriers
• protecting areas behind the barrier from the overpressure effects generated in the
explosion zone;
• limiting the size of the explosion zone and thus the largest dimension over which the
flame can propagate.
• limiting cloud spread to ignition sources
• limiting the number of people directly exposed
Blast walls have long been used to protect adjacent areas from the effects of overpressure.
These walls are designed to absorb blast energy by displacement. There may be a partition
wall (e.g. B15 partition) on the non-hazardous side which will move sympathetically with the
blast wall, the air gap between the two acting as a spring. If the wall forms the boundary to a
control area housing safety critical equipment the effects of this movement needs to be taken
into account. That is, shock sensitive equipment should not be located along this wall unless it
can be demonstrated that the effects will be negligible.
By limiting the size of an explosive gas cloud the overpressure can be reduced. As long as
confinement is controlled decreasing the size of a module by inserting barriers can result in a
reduction in maximum flame path length and therefore a reduction in the overpressure
generated. It is important that these barriers maintain their integrity and do not give rise to their
own hazards by displacement and impacting on safety critical plant or by becoming missiles.
Mitigation measures aim to protect personnel or equipment from the explosion event.
Protection from the direct effects of blast can be achieved by the barrier method, that is, the
intervention of a blast wall between the explosion zone and the area to be protected.
Progress is being made in the manufacture of the Micro-mist device[59] which has been tested
as part of a recent joint industry project and consists of a cylinder of superheated water which
is released quickly as a fine mist in response to pressure, flame sensors during an explosion.
This device suppresses the explosion and has been shown to be successful in significantly
reducing overpressures. Accidental activation of these devices is not a hazard to people.
One simple approach to defining risk [48] and hence identifying whether risk is tolerable is the
use of risk matrices. These come in a wide variety of forms but provide a simple and effective
means for design teams to assess the likelihood (probability of and event) and the severity
(consequence).
Generic definitions for likelihood and consequence can be easily established. This enables the
risks to be semi-quantitatively defined (positioned) and offers a mechanism for mitigating
measures to be evaluated (i.e. is likelihood or outcome reduced, by how much and what is the
residual risk level).
The method reviewed here uses logarithmic frequency and severity ratings which are added
together to give a risk rating. These are added rather than multiplied because they are
logarithmic representations of the actual frequency and severity.
A simple example of the use of risk acceptance matrices is presented here. Risk is set at three
levels by the matrix:
C - risk is tolerable.
Frequency
Frequent Occasional Infrequent Unlikely Rare
Severe A A A B B
Critical A A B B C
Severity
Substantial A B B C C
Marginal B B C C C
Negligible B C C C C
FREQUENCY RATING (FR) or Likelihood: Each generalised hazard scenario, taking into
account existing controls and including releases in all directions under all environmental
conditions, ignition times and ignition location, may be ranked using a coarse system based on
the frequency of the cause. It is necessary to consider a generalised frequency in this
calculation as the frequency associated with a particular release direction under particular
ventilation (wind) conditions is likely to be very small. This scenario specific frequency will not
be representative of the general frequency of a late ignited release giving rise to a significant
overpressure and will grossly underestimate the frequency rating and hence the risk.
Frequency
Category Annual Probability of Occurrence (/yr)
‘Score’ Rating
-1
Frequent > 10 More than once every 10 yrs 0 5
Occasional 10-1 – 10-2 Once every 10 to 100 yrs -1 4
Infrequent 10-2 – 10-3 Once every 100 to 1,000 yrs -2 3
-3 -4
Unlikely 10 – 10 Once every 1,000 to 10,000 yrs -3 2
-4
Rare < 10 Less than once every 10,000 yrs -4 1
The frequency ‘score’ is effectively the logarithm of the annual probability of occurrence. The
frequency rating is a normalized representation of the frequency ‘score’ for use in the semi-
quantitative hazard assessment.
SEVERITY RATING (SR) or Consequence: Each release scenario, taking into account existing
controls, the variability from ignition time and position under a range of environmental
conditions may be ranked using a coarse system based on severity of the cause. Severity is
assessed using the following guide.
Severity
Category Severity (safety, environment, asset)
'Score' Rating
Large scale loss of life
Severe Large scale environmental impact +2 5
Large scale loss of asset
Loss of life of several persons
Critical Extensive environmental impact +1 4
Major loss of asset
Loss of single life or serious injury to several persons
Substantial Significant environmental impact 0 3
Significant loss of asset
Single serious injury or minor injuries to several
persons
Marginal -1 2
Minor environmental impact
Minor loss of asset
Single minor injury
Negligible Little environmental impact -2 1
Little loss of asset
The severity rating is a normalized representation of the severity score for use in the semi-
quantitative hazard assessment.
The assessment must consider the risk profile from all causes to satisfy the legislative
requirements in particular relating to TR impairment.
In many cases it will be the efforts of a single person that will result in the quantification of the
explosion hazard and resulting risk. It is essential that a checking procedure is instigated so
that the work can be verified by a competent person. This should occur for all work produced.
Other means of monitoring and verifying the design include peer review. This may be achieved
in a number of ways. It can involve additional review by an independent engineer or by
presentation of the overall design (including explosion) to a group of independent engineers.
Alternatively, it may involve the scrutiny of a proportion of the design output by persons
independent of the project audit. This involves the checking of work by independent personnel
against the procedures for that activity. Discrepancies may involve amendment of the design or
the procedure to bring about compatibility. It will also aim to check that activities are carried out
according to the project plan, that sufficient and competent resources have been allocated and
all risks are being managed correctly.
A suitable low sophistication means of defining the explosion hazard is the use of valid nominal
overpressures derived from previous assessments of similar structures. They may be used as
the ductility level blast overpressures (DLB).
Another acceptable means of overpressure derivation for low risk installations is comparison
with a specific past cases. Such comparisons should be supported by evidence that a
structured assessment has been undertaken to identify areas of difference and that the original
means of calculation were sound. Extrapolation of data for the relevant parameters is not
generally recommended but may be valid if a sound basis exists. The comparison process
would incorporate consideration of the following factors:
Where no nominal overpressure has been defined for the installation and there are no suitable
past cases for comparison, then the level of analysis appropriate for high risk installations
should be used for explosion hazard assessment.
Medium risk methods are described in this Guidance which substitute for some of the tasks
defined in the Higher risk methodology. The philosophy recommended in this Guidance is that
for medium risk installations the choice of methodology for any particular task must be justified
where it deviates from the higher risk methodology.
Appendix C gives by way of checklists the issues which should be considered for low medium
and high risk installations. These checklists are taken from Reference [22] the Genesis
‘Explosion assessment guidelines’.
Table 3.8 indicates appropriate methods of analysis by risk category for the installation.
1. Medium risk methods which substitute for some of the tasks defined in the Higher risk
methodology. The philosophy recommended in this Guidance is that for medium risk
installations the choice of methodology for any particular task must be justified where it
deviates from the higher risk methodology.
2. For high risk installations, all the tasks from low and medium risk methodologies should in
principle be considered in addition to those listed.
The assessment of existing structures differs from the assessment of a structure during design
in three important respects.
1. There is relatively little scope for the reduction of the frequency of a release and scope for
mitigation of the severity of an explosion may be limited.
Information should be available from the Safety Case, the original CAD and structural computer
models of the facility. The Individual Risk (IR) per annum TRIF and PLL will have been used in
the demonstration of ALARP in the existing Safety Case for the installation.
Use may be made of experience gained from the operation of the un-modified installation and
from similar installations. The computer data files and design reports should be checked to
confirm that they are a faithful representation of the present state of the facility.
Should modifications be necessary to improve the safety performance of the facility, then the
work to be undertaken should not in itself pose such hazards and risk to personnel that this
compromises the gains to be achieved by such modifications. All modification work should be
accompanied by hazard identification, assessment and other controls as determined by the
Safety Management system as well as method statements for their implementation.
All temporary structures and equipment used during the modification work should be removed
as soon as the work is complete.
The HSE reference [40] states “It should be borne in mind that reducing the risks from an
existing plant ALARP may still result in a level of residual risk which is higher than that which
would be achieved by reducing risks to ALARP in a similar, new plant. Factors which could lead
to this difference include the practicality of retrofitting a measure on an existing plant, the extra
cost of retrofitting measures compared to designing them on the new plant, the risks involved in
installation of the retrofitted measure (which must be weighed against the benefits it provides
after installation) and the projected lifetime of the existing plant.
All this may mean, for example, that it is not reasonably practicable to apply retrospectively to
existing plant, what may be demanded by reducing risks (to) ALARP for a new plant (and what
may have become good practice for every new plant).”
The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still
be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures
must be implemented, irrespective of cost.
The tasks to be performed are listed below with references to the sub-clauses where a detailed
treatment is given. For existing installations the ‘Explosion Hazard Review’ is and additional
activity.
The checklists described previously and located in Appendix C, are applicable to the
assessment of existing structures. An explosion hazard review may be necessary in the case of
an existing installation.
Before investigating the ability of the systems on the installation to withstand the blast effects,
the facility should be reviewed with regard to the level of inherent safety that exists and what
additional control mechanisms there may be for overpressure reduction. The existing wells
may be operating at a lower reservoir pressure than originally designed for, however
subsequent tie-ins may have offset this possible benefit. For an existing installation there may
be potential for:
• increased venting
• additional and/or improved gas detection (acoustic gas detection)
• introduction of flame detection
• lowering the level at which gas detection initiates executive actions
• voting for executive action on a single detector
• initiation of deluge on gas detection
• the removal of redundant equipment
• the relocation of equipment blocking vent paths
• vibration reduction
• enhanced robustness of small bore connections
• use of past operational experience
• improved inspection/maintenance regimes
Some of these actions may not necessarily result in a reduction of calculated Individual Risk or
loss of life (as shown in the QRA) but this should not be a reason for failing to undertake
modifications if actual reduction in explosion risk can be foreseen.
Ideally, there should be no disproportionate contribution from any one hazard to the risk
associated with the installation. For example fire and explosion hazards should contribute to
the total risk at levels comparable with those for a similar installation. This is referred to as the
‘balanced risk contribution principle’.
The general philosophy should be to bring all critical SCEs up to a similar level of integrity for
all accidental events. These critical systems include but may not be limited to:
• the TR
• escape routes to the TR
• evacuation systems
• systems that could threaten the integrity of the above systems, e.g. ESDVs isolating off-
site inventories.
In effect the list may include all the identified safety critical elements but, with respect to the
ability to muster, assess and evacuate, some safety critical elements may be in criticality levels
1, 2 or 3.
Where it is clear from preliminary inspection that it will be impracticable to meet maximum
overpressures that may arise, there would seem to be little to be gained in determining to the
last degree of accuracy what the actual overpressure characteristics will be. Simpler
phenomenological models or comparison with similar installations would be adequate for the
purposes of quantifying the residual risk. (Note: Schedules 1-3 of the SCR [30] imply that some
form of overpressure calculation will be necessary in order to quantify the risks involved in
mustering within the TR. The need to determine potential for TR damage would then seem to
be necessary.)
The aim should be to bring the design up to the same level of integrity for all major SCEs with
the presumption that more effort should be made where the level of risk from explosions is
high. Existing installations will have QRA data from which explosion risk can be determined.
Where this is high for explosion events the premise should be that greater cost is justified in
providing mitigation and protection than where the risk posed is relatively low.
A means of determining the cut off point for additional mitigation would be to determine the
costs involved with design enhancement to achieve integrity for successively increased
overpressure values. Where a significant ‘cliff edge’ occurs this may indicate that design
beyond the base of the cliff edge is not reasonably practicable and that design to this level is
ALARP.
The accepted level above which the overall risk is considered intolerable relates to an
individual risk of greater than 10-3 per year or a TR impairment frequency of greater than 10-3
per year. The overall individual risk from all hazards must be less than this value. If risks are in
the intolerable region then risk reduction measures must be implemented, irrespective of cost.
Hence the risk from other hazards may indirectly affect the acceptability of risk from explosions
and these may need to be considered in setting the target risk levels for the explosion hazard.
Where the original design took account of explosion overpressure, but latest knowledge
indicates that this needs to be reviewed, then recalculation and assessment will be appropriate.
The calculation of overpressure should however be reasonably straightforward if the original
CAD model is available and has been updated to include changes made since the design
stage.
The late ignition of a hydrocarbon release will allow a flammable gas or vapour cloud to
develop and could give rise to an explosion. The early ignition of a release will normally result
in a fire. In fact 80% of ignited releases have been observed to result in fires[26].
The approach is to assess the fire risk, assess the explosion risk and manage accordingly.
Where any conflict exists between explosion and fire management it is the latter which will tend
to take priority, however the optimum solution will generally be a balance between the two. The
object of this clause is to aid assessment of this balance.
Some jet fires may become unstable either by flowing too fast for the flame to remain within the
envelope of the release or through ventilation limitation leading to self-extinguishing of the
flame. This could give rise to the accumulation of a vapour or gas cloud leading to an explosion
on ignition or a secondary fire near a source of oxygen, near the vent. The most common
scenario is when an explosion gives rise to secondary fires due to vessel or piping rupture,
subsequent release of inventory and ignition.
The severity of many of these events may be limited by immediate and rapid, active reduction
of inventory (blow-down) or by segmentation of the inventory into isolated sections following
gas, heat or fire detection.
The consequences of combined fire and explosion scenarios with either component occurring
first should be considered in the structural design or assessment.
A blast wall may deform or bow in direct contact with flame but this should not be a problem for
a wall designed to deform in a ductile way. Columns of the primary structure may be
significantly weakened by this effect.
Combined blast and firewalls are available. Blast walls will generally have good fire
performance in isolating heat sources from their targets. Their performance as fire walls is not
usually adequate from the point of view of limiting the temperature of the cold face, the design
can usually be adjusted to accommodate this requirement.
Progress is being made in the manufacture of the Micro-mist device[59] which has been tested
as part of a recent joint industry project and consists of a cylinder of superheated water which
is released quickly as a fine mist in response to pressure, flame sensors during an explosion.
This device suppresses the explosion and has been shown to be successful in significantly
reducing overpressures. Accidental activation of these devices is not a hazard to people.
All management techniques and inherent safety features proposed for eliminating or minimising
leaks or ignition potential are therefore valid for both fire and explosion management.
Corresponding to the ‘fire triangle’ is the ‘explosion hexagon’. The latter includes fuel, oxygen
and ignition but also includes pre-mixing, congestion and confinement. Conflict with fire
management is likely to occur in these latter areas.
• key philosophies
• installation orientation
• deck sizing
• general layout
• fire area definition and deluge/firewater pump sizing
4.3.2.2 Key Philosophies
Key philosophies will include HS&E, piping and instrument philosophies. These should include
the setting of safety goals and the methods of identifying hazards and controlling risk. They
should aim to promote inherent safety features and the minimization of leak potential by
minimization of connections and intrusive instrumentation. All these features are consistent with
the management of fire and explosion.
One significant fire consideration with respect to ventilation control, is that relating to smoke. Is
it better to allow smoke to vent from the immediate fire area to allow escape, or should it be
contained to prevent migration to the TR or evacuation facilities. Since smoke is generally the
major cause of fatality in fire events it is preferable to make its passage towards the TR as
difficult as possible but otherwise allowing it to disperse.
Orientation of the installation to minimise smoke logging (and gas ingress) potential to the TR
will tend to result in the TR being upwind of the process areas with respect to prevailing
conditions. This is not generally the optimum orientation for natural ventilation.
Deck sizing is determined largely by the amount of equipment to be installed. Due to cost
constraints, especially in deeper water areas, the tendency is to minimize topsides area and
therefore jacket size. FPSOs and single deck installations have large continuous equipment
areas.
Congestion generated overpressures generally increase with distance travelled by the flame
front. Layouts that aim to achieve a minimisation of potential flame path length by deck sizing
and aspect ratio should not significantly impact fire risk. The main interaction comes in the
location and type of boundaries between adjacent areas, which generates confinement issues.
4.3.2.5 Confinement
This is probably the main area of difference in management between fire and explosion
hazards. It is generally the philosophy to contain fires within the immediate area of initiation to
minimize escalation potential and to discourage the movement of smoke to muster and
evacuation areas. This is achieved by the inclusion of fire barriers. These barriers include fire
rated decks as well as walls. It is generally the case when managing the explosion hazard that
areas are kept unconfined, although this is not always so, for example in the use of partitions to
minimize potential gas cloud volumes. Grating would normally be used to disperse gas clouds
but this may lead to liquid fuel migrating to decks below.
Apart from trying to limit the escalating potential of fires, a major aim of this
compartmentalisation is often to limit the fire to an area where the consequences can be
mitigated by firewater. For medium and large installations it is not usually practicable to size a
firewater pump to deluge all areas simultaneously, the pumps (including stand-bys) would tend
to be unreasonably large and expensive. A compromise is generally sought between the
size/cost of the pumps and the practicalities of adding fire divisions.
Confinement can cause ventilation controlled fires which produce more smoke and carbon
monoxide due to incomplete combustion. External flaming may occur which can impact
escalation targets and transfer smoke nearer to safe areas such as the TR.
In detailed design the considerations are focused on the finer points of the installation and the
full specification of control systems. With respect to fire and explosion management this will
include;
• pipe routing
• passive fire protection specification
• ESD and F&G design
• severe vibration impact
• design of firewater and vent/flare Lines
Firewater piping systems, vents and flare lines are generally fabricated from low pressure, low
strength, lightweight piping. Their relative fragility however leaves these systems vulnerable to
explosion damage if exposed to high drag or relative displacement induced forces. Significant
damage may then leave the installation exposed to fires that result from process damage
following an explosion. Reference [60] is a good starting point for the assessment of
equipment against fire attack.
Inventories beyond the topsides process, e.g. export lines and flowlines from remote wells, are
often significantly larger than that of the process itself. It is important that, following any
significant release, the platform can be isolated from these inventories to minimise fire
escalation potential. Riser ESD valves are installed for this purpose. It is important that, after
the explosion, these valves can close if they have not already done so.
In order to ensure this it is important that the valve, spindle and actuator are not distorted in the
explosion event. The valve vendor should be able to advise the overpressure which the valve
actuator can withstand without loss of functionality. It is necessary to confirm that it will
withstand the dynamic as well as static overpressure. Explosion proof enclosures or blast walls
may be installed to protect the valve system.
Generally, ESD valves should be ‘fail closed’ ensuring that damage to the initiation mechanism
results in closure. If not, protection should be applied to the actuation system so that
functionality is assured following an explosion event.
By contrast all blowdown valves should generally be fail open, if not, protection should be
applied to the actuation system so that functionality is assured following an explosion event.
Detection systems may be considered to fall into Criticality class 2 as they will have fulfilled
their function prior to the DLB event. They should however remain operable during and after
an SLB event.
Explosion induced vibration will propagate throughout the structure to some degree [57] . In the
Cullen report[61], it was reported that ‘a number of witnesses spoke of the severe vibration
associated with the initial explosion. People were thrown off chairs and knocked over’.
In the worst cases this vibration may be capable of damaging control systems. These control
systems are usually configured to ‘fail safe’ so that, for instance ESDVs close and blowdown is
initiated. Outputs that do not fail safe will commonly fail ‘as is’ meaning that ESD valves do not
close, blowdown valves cannot be opened, firewater pumps will not be started automatically
and active fire protection may be delayed or lost.
Severe vibration or blast wind may result in dislocation of instrumentation such as fire
detection/CCTV devices such that it makes monitoring of subsequent fires uncertain. These
devices may also be damaged by the vibration itself, i.e. acceleration forces. Robust fixing of
these instruments should prevent movement, but they should be located where drag forces will
have little impact.
Each safety critical element should be reviewed with respect to severe vibration. Resilient or
special shock mountings may be specified as recommended by the specialist vendors to
mitigate these effects.
Fire control/ESD systems should not be placed on or close to boundaries and blast walls that
will experience significant movement in a blast. This will include blast walls which are designed
to deflect and absorb explosion energy.
next area. Should high barriers be considered their impact on area confinement and natural
ventilation should be assessed.
On some integrated platforms, partitioning may have explosion benefits even though
confinement is increased. Partitioning may be used to limit the maximum size of the flammable
gas cloud and actually reduce the maximum overpressure experienced. This would then
reduce fire area size and may provide some benefit in firewater pump sizing.
• process fires can impact the tank tops and tank deck piping through the grating;
• process gas leaks can be directed through the grating to produce an explosive cloud in
this narrow space;
• liquid process leaks fall through the grating and run off the tank tops and into the sea,
giving an environmental impact.
These disadvantages must be weighed against the consequences of an explosion confined
between plated decks.
The potential for liquid spillage incidents to escalate to the cargo tanks via the main deck is
reduced whilst maximising interdeck ventilation by the following choices for the process
deck [62].
• Separation - bunded skids are used for each package to confine liquid spillage
• Gas Compression - plated deck to minimise ingress of gas into the interdeck area
• Fuel Gas area - normally grated to maximise ventilation
• Utilities - grated to maximize ventilation.
4.4.3 Existing Installations
Removal of boundary walls or the addition of vents to mitigate explosion overpressure in
previously enclosed modules can lead to additional fire risk or ignition frequency.
Removal or breaching of solid boundaries may extend hazardous areas beyond the original
limits [35]. Extended hazardous areas may then encompass unrated equipment or impinge on
enclosed non-hazardous areas where additional provisions may be necessary such as the
installation of air locks at access points or the relocation of HVAC intakes.
4.4.4 Barriers
A compromise has to be sought between increased overpressure due to confinement and:
Fire Explosion
Fire carries the highest risk to personnel, Poor explosion management can lead to fire
particularly smoke scenarios via escalation
Barriers limit escalation by preventing spread Barriers give confinement and may increase
of fires and smoke and protecting specific overpressure
items of equipment and people.
Barriers between fire areas limit firewater Barriers will limit natural ventilation
pump sizing
Barriers can limit gas cloud size and cloud
spread
Removal of barriers on existing plant may
impact hazardous area designation
Barriers to prevent environmental impact
4.4.5 Congestion
Congestion which generates high explosion overpressures is generally that from the large
number of small elements within the module. This will have little impact on fire management
except that high levels of congestion would suggest a high potential for escalation in a fire
event. On an offshore installation equipment is always in close proximity so fire escalation
should be catered for in any case by ESD and depressurisation which will to some extent limit
explosion hazard.
• the amount of firewater that can be delivered relative to potential gas cloud dimensions;
4.6 Explosion damage to passive fire protection (PFP) Systems
Passive systems provide a reliable means of fire management since they do not depend on
any control systems for initiation, being available at all times. PFP rated for jet fires will tend to
have a higher degree of mechanical integrity since they must withstand the erosion forces of
the ignited jet. However, explosion forces will place more extreme loads on PFP and its
substrate [63,64].
In an explosion the forces exerted on the structure and equipment in the blast zone can
generate large deflections/distortions in the structural substrate which can result in cracking of
the PFP, opening of the joints, delamination or even loss of the material entirely from the
surface. Most companies marketing intumescent systems have tested their products in blast
conditions with the materials generally maintaining integrity in a blast of about 1.5 bar [63] . Such
data should be sought from prospective PFP suppliers to aid assessment of explosion risk.
However care needs to be taken in using this data as it is the deflection of the substrate which
is likely to be more important than the headline overpressure figure.
Cladding materials should be rigidly fixed as blast winds at high velocity potentially have the
power to displace them exposing insulation material beneath which may not then be able to
withstand jet fire impact.
A review of the response of PFP to explosions is given in Reference [63] and [64].
There exists some experimental evidence that low expansion foam, delivered to an area deluge
systems may mitigate congestion (flame acceleration) dominated explosions.
Deluge is not an effective management tool when applied as specific equipment protection, e.g.
to a process vessel, since the area of influence is so limited. For maximum benefit it should be
provided as general area coverage. Deluge curtains can be useful in slowing flame
acceleration in large modules to prevent flame speeds accelerating to extreme levels.
There is always the possibility that the application of deluge may generate extra ignition
sources if acting on unsealed electrical equipment and in particular lighting units. If lighting
seals are routinely replaced at the same time as expired light bulbs then the impact of this will
be reduced or eliminated.
Any subsequent explosion should however be attenuated by the firewater deluge generally will
continue to run. Unless special circumstances exist, the fear of extinguishing a jet fire should
not result in any decision not to activate deluge since the initial jet fire is likely to hold the
highest risk potential. Special circumstances may occur where an installation is particularly
susceptible to blast (even at the deluge attenuated level) and where fire scenarios are short
lived due to inventory depletion with low escalation risk.
Until deluge coverage occurs the module is susceptible to full overpressures. Time delay can
be minimised by:
• rapid detection of the gas cloud. Acoustic leak detection is likely to give quicker
detection, especially as it does not need to be in the hazardous cloud to detect the
release;
There is no evidence that, for a properly designed and maintained installation, there will be
significant risk of ignition from deluge interaction with electrical plant. Electrical plant should
however be designed with suitable ‘IP ingress rating’ to cater for deluge. For existing plant this
may be a problem unless seals are routinely replaced at the same time as expired light bulbs.
The question to be answered is whether the increased exposure to hazards from more frequent
visits is compensated by the protection and mitigation effects of deluge both for fire and
explosion and subsequent escalation. For NUIs, firewater systems are frequently not installed
because overall risk is increased due to the increased hazard exposure from additional
maintenance burden. This situation is unlikely to change unless explosion risk is high. Suitable
arguments will need to be put forward to justify the chosen arrangement, by comparison of risk
with and without deluge/firewater provisions.
Change control is also critical in managing the impact of modifications over the life of the
installations.
Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and
an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed
volumes such as industrial process equipment or pipes and in more open areas such as
ventilated offshore modules or onshore process areas [67] .
For an explosion to occur a gas cloud with a concentration between the Upper Flammability
Limit (UFL) and Lower Flammability Limit (LFL) must be ignited. The overpressure caused by
the explosion will depend, amongst other things, on:
5. The congestion or obstacles within the cloud (size, shape, number, location)
For stoichiometric hydrocarbon gas clouds, filling a closed volume initially at atmospheric
pressure, combustion without heat loss will result in overpressures of close to 8 bar. This
pressure rise is mainly due to the temperature rise caused by the combustion process and is
generally not dependant on the congestion within the volume. This type of explosion is referred
to as confined. A stoichiometric air/fuel mixture is such that it contains exactly the required
amount of oxygen to completely consume the fuel.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points from 1 to 5 can affect the explosion overpressures in this type of environment.
If the rate of volume generation within the explosive region is greater than the ability of the
vents to release this volume then the overpressure will continue to rise.
Two types of explosion can be identified depending on the flame propagation rate:
In an environment typical of gas explosions on offshore platforms the gas cloud engulfs many
obstacles including equipment, piping, structure etc, often referred to as congestion. It is also
usually confined by a number of solid planes such as plated decks, blast walls, equipment
rooms etc. The explosion typically starts as a slow laminar flame ignited by a weak ignition
source such as a spark. As the gas mixture burns, hot combustion products are created that
expand to approximately the surrounding pressure. As the surrounding mixture flows past the
obstacles within the gas cloud turbulence is created. This turbulence increases the flame
surface area and the combustion rate. This further increases the velocity and turbulence in the
flow field ahead of the flame potentially leading to a strong positive feedback mechanism for
flame acceleration and high explosion overpressures. The behaviour of the explosion will be
influenced by both the degree of confinement and the congestion within the combustion region.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of the spatial and temporal pressure distribution. There will typically be
localised high regions of overpressure with lower values of average pressure acting on large
components. The overpressure at a location within a gas explosion will typically rise to a peak
value and then fall to a sub atmospheric value before returning to zero overpressure. The
duration of the positive phase in an explosion can vary greatly with shorter durations
associated with higher overpressure explosions. Typical durations range from 50 to 200ms.
For smaller objects such as piping the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this case
the overpressure will not apply any net load to the object. For this type of object the dynamic
pressure associated with the gas flow in the explosion will dominate the applied loads.
Methods for calculating loads acting on intermediate sized objects such as large vessels are
described in sub-clause 5.11.
Further descriptions of the external explosion phenomenon are available Reference [68].
The peak overpressure in this blast wave will then decrease with distance while the blast wave
duration will typically increase and as a result the impulse will decrease more slowly than the
overpressure. The blast wave will be affected by other confining objects such as decks, blast
walls and accommodation blocks that will result in reflection and diffraction of the blast wave.
This may affect the decay of the blast wave and in some cases can increase local
overpressures where a blast wave is reflected from a surface or object. The received pressure
on a flat surface may be greater than that in the incident blast wave. At pressure levels typical
of a blast wave generated by a hydrocarbon explosion, this received pressure may be up to
twice the incident pressure, a process which is referred to as ‘pressure doubling’.
The category of the installation does not preclude the use of more sophisticated methods of
assessment which may result in reductions in conservatism and hence cost. The treatment in
this clause concentrates on higher risk methodology techniques with simplifications for the low
risk methodology suggested for each of the tasks described.
An explosion assessment is performed in the following steps. Where given, the references refer
to other sub-clauses.
1. A hole of a given size is assumed to be present in a vessel, piping or riser, leading to a gas
or spray release. Immediate ignition is assumed not to occur. [12]
2. The time history of the release rate is calculated. The probability of the occurrence of the
release may be estimated from published failure statistics or even from simulation. (sub-
clause 3.5)
3. A dispersion analysis will predict how the gas or vapour cloud develops and disperses
under wind and ventilation conditions. Part of this cloud will be within the explosive
concentration limits of the gas/air mixture. (sub-clause 5.4)
4. An ignition source within the explosive part of the gas cloud is then assumed to ignite the
local fuel/air mix causing expansion resulting from combustion in the region surrounding
the ignition point.(see sub-clause 5.5 and Reference [12])
5. Explosion loading software is then used to calculate how the flame front accelerates
through the surrounding environment. Interaction with obstacles gives rise to increased
turbulence, flame folding, increased flame area, increasing overpressures and increasing
gas velocities within and outside the gas cloud. (sub-clause 5.6)
6. Overpressures may then be calculated for any barriers in the vicinity.(sub-clause 5.6)
7. Fuel/air particle velocities are also calculated to determine dynamic pressures or drag
loads on any structural members, piping or vessels in the vicinity.(sub-clause 5.11)
8. Small objects may be picked up during the explosion, creating secondary projectiles. The
peak energy for typical projectiles may be calculated from the dynamic pressure load time
history and their mass.
9. Secondary, ‘external’ explosions may result as the unburnt fuel/air mixture comes into
contact with the external (oxygen rich) atmosphere (sub-clause 5.1.3).
10. The explosion loads on piping and equipment may result in further releases with
consequent fires or explosions.
11. A blast wave will propagate away from the explosion region and impinge on adjacent
structures (sub-clause 5.1.4).
This clause deals with tasks 3 to 11 above, a process referred to as ‘Consequence Analysis’.
Example High level performance standards for the installation are given in the Part 0, Fire and
explosion hazard management. For extreme explosion events it is conventionally assumed that
fatalities will occur in the vicinity of the explosion. It is only possible to provide barriers to
protect adjacent areas.
It is unlikely that the SCEs will withstand a worst case explosion scenario defined as that
scenario which considers a maximal stoichiometric cloud filling the compartment or engulfing
the installation ignited at the worst position. Design explosion loads with a known frequency,
which the structure and other SCE’s must be designed to resist must then be derived. A
method is discussed which uses exceedance curves for representative peak overpressures for
the compartment/installation. This is discussed in sub-clause 5.10 on the generation of
exceedance curves and sub-clause 6.5 on the classification of SCE’s for explosion response
assessment.
In order to provide some measure of asset protection as well as protecting life and the
environment two levels of explosion should be considered. The strength level blast (SLB) and
the ductility level blast (DLB) explosions are described in Clause 3 and sub-clause 5.9.
A more detailed treatment of these issues will be given in Part 3 of the Guidance.
The methods for the determining structural and other SCE response and capacity are
described in the next clause.
The first step in the compilation of a frequency versus overpressure curve is the determination
of overall explosion frequency. This can be achieved by standard means used in Fire Risk
Analysis (FRA) using the following steps:
Leak frequency data Hydrocarbon Leak and Ignition Data Base [27], the WOAD
database [24], OREDA [25] and the UKOOA release statistics
review [28] .
Leak Rate Calculated from release size, inventory pressure and gas
properties [63] .
Ignition frequency Hydrocarbon Leak and Ignition Data Base [34] or
Classification of Hazardous Locations [35] .
Proportion of ignitions Classification of Hazardous Locations [35] .
giving explosion
The weak points in this approach are the variability of gas cloud size with ventilation and
environmental conditions and the choice of ignition time and location. A Monte Carlo approach
may be used to explicitly represent the variability of these and other parameters. Usually a
phenomenological method of calculation of overpressures is used in view of the large number
of simulations necessary. The increased accuracy in the representation of frequency and
consequence variability will offset the reduced accuracy in load determination in the
determination of explosion risk.
5.4 Dispersion
5.4.1 General
Once the release rate and frequency has been determined then the dispersion characteristics
of the gas cloud, vapour cloud or liquid spray release must be calculated. This may include a
time history of the cloud’s extent and the identification of the likely ignition sources in the
flammable range.
Three main methods are discussed in this document for the determination of the extent of the
gas cloud after a release. They are the direct CFD method whereby the cloud evolution is
tracked through time, the workbook approach developed in the JIP on ‘Gas build up from high
pressure natural gas releases in naturally ventilated offshore modules’ [39] , and the simplified
method is given in the ‘Explosion Handbook’, Reference [13]. Other approaches include the
zonal and Shell DICE methods.
The direct CFD method has the advantage that ignition sources and their position in the gas
cloud may be modelled with the effect of wind speed and direction being represented. The
software used for the dispersion simulations may be the same as that used for the explosion
simulation itself. The disadvantage is that at present these simulations do take some time to
perform in view of the long time scale of the dispersion process as compared with the explosion
simulation. This approach is discussed further in sub-clause 5.13 on the NORSOK procedure.
The majority of the releases were at a constant rate of between 0.5 to 10kg/s but the effects of
declining release rates were also considered. Gas concentration during the gas release event
was recorded at up to 200 locations within the rig. A correlation for the flammable volume of
gas within the rig (between 5 and 15 % concentration) was derived based on simple
experiments and dimensional considerations. A plot of an upper bound estimate of the fraction
of the module filled with flammable gas against the non-dimensional parameter R is given
below:
1
×
× # ## #
+ ¤ ¤#
Non-dimensional flammable volume
#* # # ×
+
+
+
+
+
+ ×
++
+ ¤
0.1
~~
~
~
~
+
×
0.01
0.001 0.01 0.1 1
Release parameter, R
Figure 6 - Plot of Non Dimensional Flammable Volume versus Release Parameter [39]
The Release parameter R is defined as:
R= (dm/dt) / ( ρs Uv L2 )
Where: dm/dt = mass flow rate of gas released into module (kg/s)
Uv = The average ventilation velocity in the module before the gas is released (m/s)
It was generally found that greater confinement gave lower ventilation rates and larger
flammable cloud volumes. Note that the larger rate releases themselves changed the
ventilation flow within the test rig.
In Reference [39] this approach is extended to a ‘workbook’ form. This requires the separate
determination of the ventilation flow rate through a confined and congested region and the
determination of the flammable gas cloud volume. Two estimates of the flammable volume are
made:
• A upper but realistic estimate of the flammable volume that a given release would
produce for use at the ‘screening’ stage
• A mid-range estimate of a typical flammable volume that a release will produce to give a
‘best estimate’ of the likely outcome.
The flow through the module is characterised by a representative ventilation velocity that is
assumed to be related to the external wind velocity. Four generic module layouts are referred
to specific details are not described. The normalised volume of the flammable gas cloud is also
defined by a non-dimensional relationship. Finally, a relationship for flammable gas volume
between two given concentrations is given. It is stated that the workbook could be combined
with accidental release rate/frequency data held by regulatory authorities.
LVent RLeak
Mg = 3600
LModule RVentilation
It is stated that this simple model will often give a good estimate of the amount of gas within the
module, provided that the ventilation flow field is close to uniform. For more complex flow fields
the model uncertainty increases.
Hansen [73] describes a parameter called ‘Q5’ that is calculated during FLACS dispersion
simulations. To calculate the Q5 parameter the mass of gas at non-stoichiometric
concentrations is multiplied by the burning velocity and the volume expansion ratio at the
concentration, both normalised to that for a stoichiometric mixture. This process calculates the
total mass of gas in the equivalent stoichiometric gas cloud. The filters used in this process are
shown in Reference [59]. Note that it is also stated that for very confined modules the burning
rate filter becomes less important and in the case of a fully closed vessel, only the volume
expansion filter should be used.
Pappas [11] describes how the complex shape of a dispersed cloud can be represented using a
cubic cloud typically extending from floor to ceiling in the module of interest. In Reference [12]
it is stated that this method will generally give pressures of similar strength for the equivalent
quiescent clouds as for the non-homogenous and strongly turbulent clouds ignited in full-scale
tests. It is also stated that the explosion overpressure durations may be shorter than for the
non-stoichiometric clouds that may in turn affect the structural response.
In the full-scale dispersion and explosion tests conducted in Phase 3b [74] Advantica proposed
an alternative method for calculating a stoichiometric gas cloud volume equivalent to the
dispersed cloud in an experiment. This was used to generate an equivalent volume based on
the dispersed clouds with results from partial stoichiometric fills of the test rig.
A curve relating the likely overpressure to the fraction of the module filled with a gas cloud
normalised to the fully filled case was derived. For fill fractions above 80 % the explosion
overpressures are predicted to be as high as those with a stoichiometric cloud completely filling
the test rig. The experimental data and a possible curve fit to it are shown in Figure 7. It is
suggested in Reference [74] that a simple straight line could be added to this figure to form an
upper bound for the likely overpressures at small fractional equivalent stoichiometric fill
volumes.
1.0
¤
80%ile max fill overpressure
0.8
80%ile test overpressure
Note The process of the representation of a dispersed gas cloud of varying concentration as an
equivalent stoichiometric cloud is considered by Advantica to introduce uncertainties in the chain of
calculations leading to the explosion loads. This has a bearing on the accuracy of the overall process
and whether high levels of detail in other parts of the chain are needed or can be justified
It is hoped that this process can be improved or that the CFD/phenomenological codes may be
validated against experiment for the case of varying density within the gas cloud.
5.5 Ignition
5.5.1 General
The probability of the occurrence of a detectable overpressure being developed ‘Prexpl‘ is the
product of the probability of the release ‘Prrel‘ and the probability of delayed ignition ‘Prign‘.
Based on data presented by Cox Lees and Ang [75] a probability of 0.08 for a delayed ignition
probability is suggested. This should then be multiplied by a value for the total ignition
probability for which a figure of 0.1 is suggested. As there are significant unknowns in both
values suggested here it is recommended that a factor of two is applied to both recommended
numbers. This gives an overall delayed ignition probability of 0.032.
During the Phase 3b tests [10] it was observed that for realistic releases giving a non-uniform
cloud density, the ignition of the cloud did not occur every time the ignition source was
activated. This was due to the fact that the source may be located in a non-flammable region of
the cloud or that the initial combustion ceased as the small initial flame front progressed to non-
flammable regions before it could develop. Further information may be found in the OGP
(formerly E&P Forum) hydrocarbon leak and ignition database, see Reference [76].
If a full dispersion analysis is performed then intermittent and continuous time dependent
ignition may be considered. Assuming a largely uniform distribution in space of ignition
sources will result in a time dependent probability of ignition proportion to the rate of generation
of flammable cloud volume.
Empirical models based on correlations with experimental data and usually used to predict far
field blast effects outside the gas cloud combustion region. The limits of applicability and
accuracy of these methods are generally determined by the extent of the experimental data
that they are based on. Can be simple and quick to use so they can be a practical design aid
but in general the least accurate and cannot address general scenarios, as they should strictly
be used within the range of data on which they are based. Examples of empirical models
include Baker-Strehlow, Congestion Assessment Method, Multi-energy method and-
equivalency [18].
Phenomenological methods are simplified physical models that attempt to model the essential
physics of explosions. Generally they represent the actual scenario geometry using a
simplified system, for example a small number of interconnected chambers with turbulence
generating source terms between them, to represent the fully 3 dimensional nature of the real
geometry. This can be a reasonable representation of some geometries such as an offshore
module but may not be adequate for more complex situations. Phenomenological models
typically generate a peak overpressure or a single pressure-time history taken as
representative throughout the area under consideration. Some codes can also predict the blast
wave that will propagate away from the gas combustion region into the far field. Short run
times make this type of model suitable for running large numbers of explosion scenarios.
Examples of phenomenological models include CLICHE/CHAOS, SCOPE (note CLICHÉ and
CHAOS are now included in the Advantica ARAMAS package)
A Monte Carlo approach may be used to explicitly represent the variability of these and other
parameters. Usually a phenomenological method of calculation of overpressures is used in
view of the large number of simulations necessary. The increased accuracy in the
representation of frequency and consequence variability will offset the reduced accuracy in
load determination as compared with CFD simulations in the determination of explosion risk.
Computational Fluid Dynamics (CFD) are in principal the most fundamentally based of the
methods discussed here and have the best potential for accurate prediction of gas explosion
behaviour over a wide range of geometries and explosion scenarios and in both the near and
far field. These tools solve the conservation equations of mass, momentum and energy
including turbulence and combustion in a large number of relatively small control volumes
covering the region of interest. These tools can provide a wide range of information about the
flow field and the explosion behaviour at the expense of significant effort required to set up a
suitable geometry model and significant computational power requirements. In practice
accuracy is limited by:
• Available computation power limiting the numerical resolution that can practically be
used
• Accuracy of numerical models
• The underlying empirical sub models for
- Reaction zone
- Turbulence generation
- Turbulence length scale
- Turbulent combustion
In addition the numerical grid is typically insufficient to resolve smaller items of equipment and
most pipe work. These items must be represented as they are responsible for a large
proportion of the turbulence generated during an explosion so they are represented as drag
and turbulence source terms within each cell (so called ‘sub grid’ modelling or Porosity, Drag
Resistance (PDR) models).
These models are therefore calibrated against experimental data of which full-scale data is
preferable to avoid scaling effects known to exist in gas explosions [77]. The full-scale tests
performed in the Spadeadam test rig during Phases 2, 3a and 3b of the Fire and explosion JIP
therefore provide important reference data for CFD explosion prediction tools. Importantly
Phase 2 of this JIP[9] gives a comparison of predictive capabilities for selected explosion
simulation tools.
Examples of specialist CFD gas explosion simulation tools include: AutoReaGas, FLACS,
EXSIM. A simplified formulation CEBAM has been developed in the US.
• The codes are mostly designed to deal with fully turbulent flames.
• The codes do not directly model flame distortion and diffusion/hydrodynamic instabilities
that occur between ignition and fully turbulent combustion. Consequently the codes
must rely on empirical flame folding models that are valid for a limited range of fuel-air
concentrations and boundary conditions.
• The codes do not model flame propagation phenomena involving instabilities
associated with acoustic waves and shocks.
• The codes should not be expected to accurately model flame quenching due to
deficiencies in the models, and due to lack of validation with experiments where
quenching can be directly observed.
Many of these deficiencies are partly due to the current limited understanding of the various
flame propagation phenomena, and due to inadequate computer resources which prevent
sufficient spatial and temporal resolution.
Important inputs to the analysis are the laminar and turbulent flame velocities. The turbulent
flame velocity is related to the laminar flame velocity in Appendix A of the Reference [18].
Further data are available in References [78, 79].
• The phenomenological code SCOPE and ‘simple’ CFD codes AutoReaGas, EXSIM and
FLACS are in widespread use
• Phenomenological and CFD methods generally give fairly good accuracy (within an
factor of two*) so these models yield solutions that are approximately correct
• The limitations associated with empirical and phenomenological methods (simplified
physics and relatively crude representation of geometry) can only be overcome through
additional calibration
• It is recommended to develop ‘advanced’ CFD codes that will allow fully realistic
combustion models and resolution of all obstacles but is stated that it is likely to be 10
or more years before such tools are available. This is primarily due to the large
computational expense of this type of model.
It is considered however that the present phenomenological and CFD models are adequate for
the assessment process being carried out given the uncertainties in the other stages of the
process.
Note: The view in Norway is that a correct application of the NORSOK protocol for explosion simulation
will result in an accuracy of +/- 30 % in peak overpressures [12, 11].
Further extracts from this report can be found in Reference [18] along with a brief description of
the empirical, phenomenological, and ‘simple’ CFD codes that are described in the report.
‘In light of the fact that gas explosion predictions are needed now, but that it will probably be
ten or more years before the CFD-based models will incorporate fully realistic combustion
models, be able to more adequately model turbulence and turbulence-combustion interaction
as well as being able to accurately represent all important obstacles in real, complex
geometries, one must make the best use of the currently available models. However, it may be
unwise to rely on the predictions of one model only, given the uncertainties that remain –
especially if the model is used outside its range of validation. One must also be aware of the
uncertainties associated with whatever modelling approach is used’.
‘The accuracy expected from, say phenomenological and ‘simple’ CFD models is generally
fairly good (to within a factor of two), e.g. the models yield solutions which are approximately
correct, but, importantly, only for a scenario for which the model parameters have been tuned.
This limits the accuracy of these models as truly predictive tools.’ (number 8 of main findings).
‘Perhaps the safest that can be advised at this point is that it would be unwise to rely on the
predictions of one model only, i.e. better to use a judicious combination of models of different
types, especially if a model is being used outside its range of validation.’ (number 9, of main
recommendations).
Note It needs to be remembered that the all phenomenological and CFD codes represent the physics to
some degree and all are ‘calibrated’ or ‘validated’ against experiments. It could be said that all could not
therefore be used outside their experimental validation, but it should be recognised that because there is
an understanding of the physics involved, it is not unreasonable to move the models outside there region
of experimental validation as long as this is done with a knowledge and understanding of the limitations.
During the early stages of a typical offshore project, only the general layout and location of the
major pieces of equipment are known. The level of geometric detail usually increases as the
project proceeds as smaller pieces of equipment and objects such as piping and cable trays
are defined. For explosion overpressures predictions at each project stage the likely effects of
geometry detail to be added later in the project should be accounted for. If this is not done it is
likely that the calculated explosion characteristics such as overpressure and impulse will
increase significantly as detail is added throughout the project duration. Two possible methods
of addressing this have been postulated [13].
• Make allowance for later increases in explosion loads by multiplying the explosion
overpressures predicted for a given level of geometry detail by applying a factor for
equipment growth (and hence congestion) based on previous project experience
• Addition of anticipated ‘probable’ congestion into the explosion geometry model to allow
for as yet undefined geometry
Detailed investigation of an integrated deck platform typical of the central/northern North Sea
showed that reasonable prediction of the likely final overpressures required the definition of all
major equipment, boundaries (decks, TR/accommodation blocks), all piping with diameters >
8”, Primary structure, secondary structure with cross section dimensions > 5”.
The anticipated additional congestion likely to be added as the design is progressed can be
based on historical data for similar previous projects, equivalent equipment with all of its
associated pipe work. Several possible measures of the ‘completeness’ of the current
geometry model such as the total length of the defined obstacles or various measures of the
blockage ratio have also been proposed.
• Uniform cells should be used in the region of a CFD model where turbulent combustion
will take place
• It is recommended that in FLACS simulations there should be at least 13 cells across
an unconfined gas cloud. Fewer cells are necessary with confinement. (P4.42, 72) .
• For AutoReaGas the recommended constants provided for turbulent combustion
modelling (factor slope and turbulent combustion modelling constant) should be used
with close to 1m3 cells.
• It is recommend that uniform stoichiometric concentration gas clouds are used in
explosion modelling due to lack of calibration/validation for non-uniform non-
stoichiometric concentration clouds
• A sufficiently detailed geometry model should be used with explosion prediction models
that rely on a detailed geometry model of the facility
• An explosion prediction code with a demonstrated predictive capability should be used,
consult your code supplier.
• The numerical mesh should be extended sufficiently far from the region of interest to
prevent boundary conditions from affecting the simulation results of interest to the
project
• The computer code EXSIMPO is available for use with EXSIM which determines the
appropriate cell size from the layout.
5.6.6 Validation/calibration of Gas Explosion Prediction Tools
If an explosion prediction tool is to be used to calculate design loads for offshore facilities it
should be ensured that the tool is appropriate for the purpose.
It has been found experimentally that gas explosion behaviour in confined and congested
environments is dependent on the scale of the test [81,9]. Thus one of the main objectives of the
Phase 2 BFETS JIP [9] was to provide specific information on the characteristics of explosions
in a full-scale test rig intended to be representative of an offshore module. Comparison
between results for complete stoichiometric methane fills of a 1:3.2 scale and full size
Spadeadam test rig showed overpressures between 5 and 2.5 times greater at full scale. The
full-scale test results from the Phases 2 and 3a can now be obtained from the UK HSE and are
an important resource for validating/calibrating explosion assessment tools.
The key to this validation process is to demonstrate the “predictive” capability of the tool rather
than simply a calibration to one set of experiments.
It is worth noting that the only assessment of full scale blind explosion predictions, made before
the relevant test results were publicly available, were conducted in Phase C of the Model
Evaluation Exercise conducted during Phase 2 of the Fire and Explosion JIP [9] . This was a
demonstration of certain predictive capabilities of the range of gas explosion simulation tools
available at this time.
1.50
1.00
0.50
0.00
Existing CFD explosion simulation codes do not generate these spikes as they cannot
represent any of the processes identified above so overpressure traces from CFD simulations
may be used directly as the input loading for some finite element packages (FEA) packages.
This form is not characteristic of far field blast waves outside a compartment. A typical trace for
this case is shown in Figure 9.
Overpressure (bar)
400
300
200
100
0.00
-100
-200
Figure 9 - Typical pressure trace at some distance from a vent – blast wave.
The reliability of the results of this method will depend on the reliability of the base simulation.
The method is based on the assumption that any gas within the module is perfectly mixed and
that the probabilities of an explosion occurring at any concentration within the flammable range
are equal.
It is recommended that the variation of explosion overpressure with ignition point location is
investigated by considering at least three ignition points at representative points, such as both
ends and the centre of the module, again assuming that the module is fully filled with a
stoichiometric concentration cloud.
This relationship for the variation of the maximum peak explosion overpressure with cloud size
has been developed based on limited medium-scale experimental evidence and FLACS
simulations of these events. The method was developed based on experiments for one
explosion geometry. The relationship between the fraction of the module filled with
stoichiometric concentration and the fraction of the overpressure corresponding to a fully filled
module, produced by a given cloud is shown below in Figure 10:
1
0.9
0.8
Normalised Overpressure
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
0 0.1 0.4 1
Normalised Cloud Volume
Maximum unmitigated
explosion overpressure Pr
(Bar)
0 to 0.2 1
0.2 to 0.5 2
0.5 to 1.0 3
1.0 to 2.0 3.4
2.0 to 4.0 6
> 4.0 8
A relationship for mitigated explosion peak overpressure is also given in the same form as the
earlier relationship for unmitigated explosions:
The factors given in Table 5.2 represent median values, with a large spread in the data for all
overpressure ranges. The use of these factors may considerably under or over estimate the
real local overpressure peak values.
As the spatial variation of explosion loads will not be well represented, it is not recommended
that nominal overpressures or dynamic pressures are used as a design basis at later project
stages, for the assessment of existing platforms or for high risk or novel installations. Nominal
overpressures are defined as peak representative overpressures by installation/module type
determined on a non-statistical basis from acquired experience or simulation for a
demonstrably similar situation.
If it is necessary to calculate blast wave effects in the far field, for example at an adjacent
platform, this could be done using one of empirical blast wave propagation methods from a
knowledge of the vent areas and the mass of fuel in the gas cloud. The external explosion
which may occur as a result of the ignition of a vented unburnt fuel/air mixture is not explicitly
included in the approach although in some of the data the external explosion may have
contributed to blockage of the vents and increased the overpressures in the combustion region.
At later project stages, and for assessment of existing facilities it is recommended that a
suitably validated phenomenological or a specialist CFD explosion simulation tool is used.
A Rule Set defining nominal, space averaged, peak explosion overpressures or nominal
overpressures may be developed to assess alternative concepts at early project phases. This
could be based on data from previous explosion load simulations for the range of concepts,
module sizes, module types and process characteristics.
It may be more useful to develop a library of example simulations of typical well defined
modules, installation types, calculation methods and design explosion scenarios. Frequency
information should also be developed alongside the corresponding explosion load. It was
recommended that UKOOA/HSE should fund such a project in time for the compilation of Part
3 of this Guidance.
• Production rate
• Gas compression pressure
• Gas composition
• Number of production trains
• Module area/footprint
• Confinement measures
• Congestion measures
• Aspect ratio
It would be desirable if these factors could be as near as possible independent to aid
processing of the base data.
• The values need to represent space-averaged overpressures over the affected area
which are defined as the average of all simulated (or measured) overpressure peaks
within the affected region. It is assumed that in the case of measured overpressures
they have been smoothed by time averaging over a window of 1.5ms.
• There should be sufficient gauge points to represent the spatial variation of pressure
within the explosion.
• The scenarios simulated should represent the DLB design level explosion for the
ductility level event occurring at the appropriate frequency level.
• A CFD or validated phenomenological simulation method should be used for all the
data. Contemporary analysis methods and up to date software should be used.
• A number of ignition points should be considered preferably with information on the
probability of ignition associated with each one. The detail on the model representing
the geometry should represent obstacles down to piping of 3” in diameter.
• An indication of the variability of the overpressure peaks throughout the compartment
should also be part of the data set.
• An indication of the form of the overpressure traces (duration, and impulse) should be
included.
• Peak dynamic overpressures at SCEs of Criticality 1 and 2 should be included.
The resulting nominal overpressures, frequencies and durations should then be a good
indicator of the expected severity of the design explosion event and the level of risk arising
from the explosion hazard.
Section D600, P9 of these rules provides guidance for hydrocarbon explosions. It should be
noted that large quantities of ethylene, acetylene and hydrogen require special consideration.
The following extracts are taken from the guidance:
In a ventilated compartment the explosion load given by overpressure and duration is mainly
determined by the relative ventilation and the level of congestion.
For compartment volumes of up to 1000m3, with relative ventilation area of about 0.5,
stoichiometric gas cloud ignition expected to give approximately 1bar with a medium level of
congestion. High congestion levels may increase overpressures by a factors of 2 to 3. Larger
volumes also tend to increase overpressures.
Design overpressure in a ventilated shale shaker room with less than 1000m3 volume and
moderate congestion may be taken as 2bar, combined with a pulse duration of 0.2s (200
milliseconds) unless a more detailed assessment is carried out.
Design overpressure on an open drill floor area may be 0.1bar combined with a pulse duration
of 0.2s unless a more detailed assessment is carried out.
The vent area Av may be taken as sum of free opening and blow out panel areas where static
opening overpressure is less than 0.05bar.
Durations for explosions is expected to vary from 0.2s for fairly open compartments to 1s for
quite closed compartments.
If panels or walls are intended to give explosion relief by failing a peak overpressure of 2-3
times their failure pressure can still be expected in the compartment. This is only the case if
ventilation dominates. For large and congested compartments local overpressures may be
greater.
Long compartments with length/diameter ratio greater than 3 will tend to give higher
overpressures due to long flame acceleration lengths. The effective diameter can be estimated
as D = √A where A is the smallest cross-section area and L is the largest compartment
dimension.
For completely enclosed compartments generally, bulkheads that must survive an explosion
will be designed for 4bar.
For process areas on open deck covering not more than 20m x 20m with an un-congested
arrangement a design overpressure of 0.2bar with a pulse duration of 0.2s may be used.
Volume Blockage Ratios (VBR’s) of 0.05 may be considered as not congested. VBR is the
ratio of the blocked volume to the total volume considered.
For larger or congested process areas a design overpressure peak of 0.5bar with a pulse
duration of 0.2s may be used. A volume blockage ratio of 0.05 may be considered not to be
congested.
See Table D1 in paragraph 617 of the reference for a summary of these results.
Without undertaking detailed modelling it is not practicable to establish the overpressure time
history for the specific situation. However, by establishing the blast duration, the peak
overpressure loads can be translated into useable loads for preliminary response calculations.
This load time history may be translated into an equivalent static load which is more readily
usable by the project in the concept definition and FEED stages (see Clause 6).
It is recommended that in the absence of project specific data the relationship between impulse
and peak overpressure described in Hoiset [86] is used to derive a positive duration for the
overpressure based on the assumption of a triangular pressure-time history with equal rise and
fall times. These relationships are based on CFD simulations of a small number of geometries
and should only be considered as approximate example values. The explosion overpressure
impulse, I, is given by:-
25
20
15
Impulse kPas
Impulse kPas
10
0
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Overpressure (Bar)
The curves given in Figure 11 and Figure 12 may not be applicable for large open areas such
as occur on FPSOs and Spars, as it was derived for enclosed compartments.
These curves do not apply to blast waves from a distant explosion as in this case the impulse
may be near zero and the positive phase duration may be much shorter. The blast wave from a
distant explosion (>20m from the vent) will develop into a sharp fronted wave with a negative
phase often represented with duration twice that of the positive phase.
1.6
1.4
1.2
1
Duration (s)
0.8 Duration s
0.6
0.4
0.2
0
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Overpressure (Bar)
The ductility level blast is the design level overpressure used to represent the extreme design
event.
The strength level blast represents a more frequent design event where it is required that the
structure does not deform plastically and that the SCEs remain operational. This load case is
recommended for the following reasons:-
• The SLB may detect additional weaknesses in the design not identified by the DLB
(robustness check).
• An SLB event could give rise to a DLB by escalation – this should ideally not occur as
elastic response of SLB and supports should be maintained.
• The prediction of equipment and piping response in the elastic regime is much better
understood than the conditions which give rise to rupture. The SLB enables these
checks to be made at a lower load level often resulting in good performance at the
higher level (strength in depth).
• The SLB is a low consequence event important for the establishment of operability.
• This load case offers a degree of asset protection.
5.9.2 Determination of explosion design loads
Overpressure acts directly on loaded surfaces and is available directly from computational fluid
dynamics (CFD) and some phenomenological explosion codes.
Design explosion loads were in the past derived from the a worst credible event assuming a
gas cloud of maximal extent with stoichiometric composition ignited at the worst time in the
worst position. Usually the ultimate peak overpressure ‘Pult’ derived in this way is far too large
to be accommodated by the structure. ALARP arguments are appropriate and can be used to
demonstrate that risk levels have been reduced to satisfactory levels which itself relies on
frequency and risk arguments. Pult will often correspond to an event with a return period out of
proportion with the design life of the installation.
A frequency of between 10-4 and 10-5 exceedance per year is considered a reasonable
frequency for the ductility level design event by analogy with the treatment of environmental
and ship impact loads which are often considered at the 10-5 level. The assessment principles
for offshore safety cases document APOSC [32] states that ‘the frequency with which accidental
events result in loss of integrity of the temporary refuge within the minimum stated endurance
time, does not exceed the order of 1 in 1000 per year’. The NPD code [87] also gives a lower
limit on TR impairment frequency of 10-3 per year. It is reasonable and conservative to assume
that the threat from fires exceeds that from explosions by a factor of 10 to 1 and an impairment
frequency of 1 in 10,000 per year is a reasonable estimate for explosion impairment.
Hence a target of 10-5 exceedance per year for an explosion event which directly impinges on
the TR is reasonable. An explosion event in the process area will be separated from the TR by
a barrier or blast wall which should withstand the load and have an impairment frequency of
much less than 10 % giving a target frequency for such an event of the order of 10-4
exceedance per year.
The space averaged peak overpressure for the compartment is used for determination of the
design explosion loads as it is more generally representative of the severity of the event. A
local overpressure peak may be used to generate exceedance curves for the determination of
load cases for local design of blast wall for instance. Impulse exceedance curves may also be
generated which take into account the duration of the load and its peak value are a better
measure of the expected response of the target which will be dynamic in nature.
The SLB may then be identified from a space averaged peak overpressure exceedance curve,
as that overpressure corresponding to a frequency one order of magnitude more frequent or
with a magnitude of one third of the DLB overpressure whichever is the greater. The reason for
the reduction factor of one third is related to the expected reserves of strength in the structure
and the observation that the primary structure will often only experience received loads of this
reduced magnitude. These topics are discussed in Clause 6.
P rexp
Frequency (per year)
10 -3
10 -4
10 -5
and frequency of
exceedance
10 -6
P str P duct
Figure 13 - Example overpressure exceedance curve – location of DLB and SLB design load
cases (Pstr and Pduct)
The SLB overpressure, ‘Pstr’ may then be identified as that overpressure corresponding to a
frequency one order of magnitude more frequent or with a magnitude of one third of the DLB
overpressure, ‘Pduct’ whichever is the greater. The reason for the reduction factor of one third is
related to the expected reserves of strength in the structure and the observation that the
primary structure will often only experience received loads of this magnitude [88,89]. These topics
are discussed in detail in Clause 6.
Many other forms of this curve have been produced with various combinations of log and linear
axes, this gives the impression that the curves differ in shape which depends on the axis
choice. Other forms of curve may be plots of local peak overpressures for a particular location
There is some evidence that the curve has underlying exponential distribution
characteristics [89,90] which gives a straight line when plotted with log-linear axes as in Figure
13.
The same convention may be used for plotting other measures such as dynamic pressure
exceedance curves for a particular part of the combustion region. The dynamic pressures
corresponding to the SLB and DLB load cases may then be obtained in the same way by
selection of the appropriate frequencies of exceedance.
The program is used by building an approximate model of the various field development
concepts from a list of elements so that each concept can be ranked and potential ‘concept
stoppers’ can be identified at an early stage.
The tool includes an explosion assessment method based on FLACS simulations of more than
15 modules/geometries conducted using the NORSOK procedure to generate an explosion
pressure exceedance curve. For a specified solid barrier the model can be used to calculate
the explosion pressure for a defined annual frequency of occurrence e.g. 10-4 per year.
The model has been developed based on data from ordinary offshore modules and is therefore
not recommended for extreme cases.
The model includes parameters that characterise the degree of congestion and confinement
explicitly. They make no claims for the validity or otherwise of the present version which is still
very much at an early stage of development.
‘Several methods of generating exceedance curves are in use, some of these are described in
Reference [18]. The range of methods represents the fact that at an early stage in a project the
information available may only be sufficient to apply a relatively simple methodology but that
more complex methodologies can be applied as the project develops. However, the range is
also due to the number of factors that can contribute to an explosion occurring and that
different methodologies account for these factors differently. The release, cloud formation,
ignition and explosion must all be considered in generating exceedance curves. Decisions
must therefore be made about how to represent these influences on the explosion. Natural
variability, in for example, release or ventilation rate, and uncertainty in both the data and
models used should be considered. In addition the choice of models will also affect the
methodology applied due to the resources they require.’
Reference [66] and sub-clause 5.6.7 describe methods of extrapolating from a small number of
explosion simulations representing differing ignition points to represent various (equivalent
stoichiometric) cloud sizes and the expected overpressures. An exceedance curve may be
constructed using these extrapolated results.
Sub-clause 5.10.5 presents a simplified method based on the assumption of exceedance curve
shape which in theory requires only requires a small number of simulations to be performed.
The other point uses the probability of a release forming a cloud combined with the probability
of a late ignition Prexp, corresponding to the zero overpressure exceedance probability (sub-
clause 5.5). This method may be used only at an early project phase when sufficient
information for more sophisticated methods is not available.
It is important to identify the explosion scenarios with the higher overpressures as these will
determine the required exceedance probabilities in the required range (10-5 to 10-4
exceedance). Explosions with a frequency of exceedance of greater than 10-3 will also
dominate the accuracy of the exceedance curve around the 10-4 exceedance level. The total
probability of an explosion gives a method of determining if enough scenarios have been
considered and convergence is being reached.
1. select leak scenarios (sub-clause 3.5) and determine release probabilities (sub-clauses
2.2 and 5.3)
At the highest level of sophistication this would involve consideration of ventilation rates
by wind speed and direction by CFD simulation. At a lower level the expected higher
explosion overpressures would occur in situations of poor ventilation with the wind from
a direction blocked by a barrier or equipment. A simplified method might assume a near
constant release rate to generate a series of cloud sizes with equal probability. The
workbook approach as described in Reference [39] and sub-clause 5.4 could be used.
At the highest level the probability of ignition from a continuous source, will be estimated
as a time history and will be proportional to the rate of generation of inflammable cloud
volume which should be available from a CFD dispersion calculation. At a lower level the
ignition probability could be assumed constant irrespective of cloud size but with say 3
widely spread locations for the ignition sources.
5. calculate equivalent stoichiometric cloud size (sub-clause 5.4.4) note the reservations
quoted in this sub-clause on the accuracy of this step in the analysis process.
6. calculate the space averaged peak overpressure (sub-clauses 5.6 and 5.6.6)
A high level of sophistication method could use CFD for the cases where the highest
overpressures are expected with calibrated phenomenological simulations for
interpolation between scenarios if required.
7. assemble the space averaged peak overpressure exceedance curve from probabilities
of occurrence of the overpressures for the scenarios simulated.
If local overpressure exceedance curves are needed for a reliability analysis of a blast wall for
example these may be generated based on the probabilities for the averaged pressures and
transfer functions relating these two values for the chosen location [92] .
The worst credible scenario assuming a stoichiometric cloud filling the module and ignited at
the worst position may not be representative of the general population of explosion events. In
addition it will be difficult to determine its probability of occurrence. A representative scenario at
around the 10-4 per annum exceedance level or the 10-5 frequency of occurrence level should
be used if it can be identified.
A simplified method which may be used for the purpose of design explosion load determination,
is presented at the end of this sub-clause in 5.10.5.
Bruce [93] describes a typical methodology for estimating overpressure exceedance distributions
with associated confidence bounds. The probability distributions of the input variables are
considered in giving these bounds.
Reference [18] forms the basis of this clause and contains a number of reviews of the literature
relating to this topic.
VENTILATION
AREAS FOR DISTRIBUTION OF VENTILATION
EACH FACE OF RATES
WIND ROSE MODULE
0.08 1
PROB. DENSITY
PROBABILITY
N 0.06 0.08
CUMM.
NW 0.06
NE 0.04
0.04
W E 0.02 0.02
0 0
SW SE
300
200
250
100
150
0
50
S
AIR CHANGES/HOUR
FORCED
VENTILATION
RATE
% FUEL
UEL
LEL
HOLE DIA.
TIME
INVENTORY
VOLUME AND
PRESSURE
FUEL CONCENTRATION
PROBABILITY DENSITY
PROB. DIST.
IGNITION/EXPLOSION
PROBABILITY
6
6
1
1
1
FUEL/AIR MIXTURE
VERSUS TIME
OVERPRESSURE DISTRIBUTION
1.5
PROB. DENSITY
1.0
1.1
1.2
1.3
1.4
1.5
1
OVERPRESSURE
0.01
EXCEEDANCE PROBABILITY
0.001
0.0001
0.00001
0.000001
0.05 0.3 0.55 0.8
OVERPRESSURE (BAR)
One problem with the use of this type of generic curve is that they do not allow for the fact that
the level of overpressure will affect the shape of the plot because if the overpressure is already
close to 8 bars it is unlikely to significantly increase. Ratios of a parameter called severity
index rather than the overpressure can be used to allow for this. Severity index, S, is defined in
Reference [92] based on runs of SCOPE 3. S tends to infinity at 8 bars that would correspond
to adiabatic combustion of a stoichiometric hydrocarbon without any expansion. An expression
for S is given as:
S = P.e
(0.4 P
E1.08 −1− P
)
Where P is the overpressure in bars, E is the expansion ratio at atmospheric pressure. Note
that this approach assumes that P is a typical overpressure, for example over a complete
congested region. If P is replaced by S in an expression fitted to some experimental data then
at low overpressures the predicted overpressures will be unchanged. If the correlation is used
for S and S inverted to get P using the above equation it will automatically be limited in a
realistic way to 8 bar.
It is however difficult to prove the general applicability of generic curves as their detail is likely
to vary between different modules/plants. It is stated that the only feasible way to take into
account the complexity of the physical processes in a gas explosion is to use a Monte-Carlo
method that requires performing many thousands of model runs to obtain valid statistics. The
SCOPE model that only takes a few seconds to run is used for this purpose. Where further
detail is required CFD runs are performed using EXSIM. Transform (or transfer) functions that
relate the median overpressure produced by SCOPE to features such as localised high
overpressures or geometry effects such as shielding or pressure wave reflection are then
defined. The method takes account of variations in leak rate, fuel type, wind speed and
direction, ignition location and stoichiometry.
Flammable gas cloud sizes can be calculated in two stages using EXSIM (ventilation flow
followed by dispersion simulation), or using a zone model to predict ventilation flow followed by
a random-walk dispersion method.
Transform functions at each ‘receptor’ are calculated by running EXSIM for range of initial
conditions. The idealisation of the module used in the SCOPE input is adjusted if necessary so
that with the module fully filled with gas and ignition at the centre of the module would give the
same median overpressure with both models.
Example exceedance frequency and exceedance probability curves are given for pressure and
impulse in the reference.
5.10.4 Mobil North Sea Methodology for Early Design Blast Analysis
Reference [66] describes four methods to allowing designers to select appropriate gas
explosion overpressures for use in early stages of the design process when only a small
number of simulations have been performed (one for each ignition point considered). The
relationship between overpressures for clouds of different sizes and simplifying assumptions
about the probability of ignition enable the construction of an exceedance curve for use in
identifying design explosion loads in the most sophisticated method described.
The guidance given is conservative in certain aspects in an effort to ensure that the estimated
blast loads remain firm throughout the design process. Four separate approaches are
described in ascending order of complexity. The first two approaches are hazard
consequences based while the last two are risk based.
This method is based on the a priori fact that the statistics of random events such as
explosions indicate that the intervals between such events will often have an Exponential
distribution[94].
A recent (unpublished) paper by Yasseri [90] has processed the historical data on explosions in
the North Sea given by Vinnem [95] and has shown that there is a good fit for the data to the
exponential distribution.
An exponential distribution gives a straight line for the exceedance diagram with the axes
chosen.
Possible methods of calculating the two required overpressure and frequency points include
the following:
Figure 13 shows an exceedance curve generated in this way from a sample representative
overpressure and frequency of exceedance obtained by simulation. If the sample simulation
corresponds to the worst credible case with a full compartment of a stoichiometric gas cloud
ignited in the worst position Pult., then the frequency of exceedance is the absolute frequency.
The difficulty is the determination of this frequency and it is argued that this case is not a
representative point to take.
SCEs of criticality level 1 and 2 should be assessed against the SLB, SCEs of criticality 1 will
be assessed against the DLB as derived in the previous sub-clause.
If the general level of dynamic pressure loads is not known then it is acceptable to take a load
equal to 1/3 of the overpressure at the location for the DLB load case. The duration should be
chosen so that the impulse matches that of the overpressure trace. This load must also be
applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads
should also be applied in the vertical plane.
The performance of the structure and SCE’s for these scenarios must then be tested against
the appropriate high level and equipment specific performance standards.
• Drag loads (similar to the Morison drag loads experienced in fluid flow) proportional to
the square of the gas velocity, its density and the area presented to the flow by the
obstacle.
• Inertia loads proportional to the gas acceleration and the volume of the obstacle.
• Pressure difference loads.
Drag loads dominate for obstacles with dimensions less than 0.3m or on cylindrical obstacles
less than 0.3m in diameter in particular in regions of high gas velocity near vents. Both drag
and pressure difference loads are significant on objects between 0.3m and 2m in the flow
direction.
Exceedance curves for dynamic pressures may be developed from simulations and used in the
same way as for overpressures in deriving design dynamic overpressures.
S
E W
N
Explosion
Vessel 70kN/m Overpressure load
The air ahead of this front is pushed out through the vent in the West wall over a vessel and
pipe work spanning the vent giving the possibility of vessel or piping failure, with further release
of inventory and consequent escalation. The gas velocities in this case will occur
predominantly near the vent. The magnitude of drag forces on the pipe work (with diameter D
typically less than 0.3 meters) at any time is given by the drag term in the Morison equation.
The force should be calculated for engulfment of the obstacle in the burnt and unburnt gas
mixture as the burnt gas/air mixture may be travelling at a speed of ten times the speed of the
unburnt mixture even though the unburnt mixture is ten times denser.
Drag coefficients are given in Czujko[13] and Reference [53]. Further details will be given in Part
3 of this Guidance.
A typical time history for the drag load is shown in Figure 16 from Reference [97].
5000
4000
Drag (Pa)
3000
2000
1000
0
1.42
1.44
1.46
1.48
1.50
1.52
1.54
1.56
1.58
1.60
1.62
1.64
1.66
1.68
1.70
1.72
1.74
1.76
1.78
1.80
Time (s)
Drag loads are particularly important in open areas such as on the deck structures of an FPSO.
The gas clouds associated with explosions on FPSOs may be very large and gas velocities up
to 500 m/s could be experienced. The direction of gas flow may also be very variable for
example in the case of the pipe rack of an FPSO acted on by an explosion ignited at low level.
Secondary projectiles may be a problem for FPSOs in view of the higher gas velocities.
The drag loads may be used to represent the total force on obstacles with in flow dimensions
less than 0.3m. For larger diameter obstacles or vessels, the pressure difference across the
vessel will also need to be calculated and added to the drag force above.
The IGNs [1] state that the validated methods for determination of loading due to blast wind are
strictly only applicable to distant explosions:
These validated methods are based on TNT equivalent explosions with non-turbulent fluid flow
at a distance allowing the use of Morison’s Equation to determine the load on a body.
Catlin’s paper describes some experimental validations of formulae for both vented gas velocity
from a compartment open on one face and the loads on vertical cylinders in the vent area [100] .
∆t = D/U
The pressure difference across the vessel ∆P may be read off the trace as indicated in Figure
17.
Overpressure (bar)
3.00
2.00
∆P
1.00
0.00
∆ t=D/U
-1.00
-2.00
-3.00
Figure 17 - Estimation of the pressure difference across a vessel from a pressure trace
This process is conventionally applied for the phase of the explosion where the vessel is in the
unburnt air/fuel mix using the appropriate speed of sound. The part of the curve relevant to this
calculation is that before the peak. Under these assumptions, this same load may be applied
after the peak acting in the opposite direction. A time history of drag load may then be
estimated.
For piping the response to the drag load may be estimated using a single degree of freedom
method such as the Bigg’s method described in sub-clause 6.8.
This same model may be used to estimate the tension effects in one-way spanning blast
panels discussed in sub-clause 6.8.
One problem with this method is that overpressures are generally recorded at the cell centres.
This should not be a problem for objects large in relation to the size of the control volumes use
in the simulation (3 times the cell dimensions). If the object is large and the gauge points are
located at the centres of the object cross section then the computed pressure differential may
be multiplied by 2/π to allow for the sinusoidal variation of load direction over the surface of the
object.
It should also be noted that the gauge points would not capture local pressure increases where
the flow stagnates on the object if they are far from the obstacle in relation to the object
diameter. This may add short duration loads (duration a few milliseconds) particularly a high
Mach number flows.
For intermediate obstacle sizes it is suggested that the CFD numerical grid be locally refined
until the object is sufficiently resolved in the flow field. The DLM can then be applied.
Alternatively, it is stated that near module vents forces calculated by the DLM and drag
methods are similar. Near the centre of a module the loads on obstacles it is recommended in
the references that both approaches should be used and the larger of the two loads used for
design. It is unlikely that drag loads would in any case be large at these locations so the
pressure difference approach is recommended in this Guidance.
For the simulations considered during the referenced work, it was stated that the peak drag
pressures were about 30 % of the maximum local field pressures and 60 % of the average
overpressures experienced within the module.
Methods for dealing with multiple objects that contribute drag forces to the total load on an item
of equipment are briefly outlined [53,54], including a method for dealing with groups of objects
that are partially shielded from the blast wind.
There are only two published circumstances where explosion gas velocities have been
measured:
1. The SCOPE experiments executed by Shell where gas velocities were measured
directly
2. The Phase 3b tests where an instrumented cylinder was placed in the vent area of the
Spadeadam test rig [83].
The general view is that in CFD codes the pressure and gas velocity is so closely linked at
each point in space and time, that validation of pressure may be sufficient to assume that the
gas velocities are being correctly calculated.
The asymmetric expulsion of vented gases from a compartment may give rise to out of balance
loads or strong shock response.
Initially it seems that the out of balance force on the module will be equal to ∆PA less any net
forces on internal equipment, piping and vent obstructions. In fact the time for pressure
disturbances to cross the module may be appreciable compared with the load duration and the
inertia of the un-burnt products and external atmosphere will affect the net force. The net force
on the gas volume contained in the module may also be calculated from rate of change of
momentum of the enclosed gas. However, if the local speed of sound is exceeded then the flow
becomes ‘choked’ and a second shock wave front is set up at the vent, which will restrict the
flow. Obstructions at the vent such as louvers may accelerate the flow locally and induce these
standing shock waves. The backpressure for confined flow may be represented by a ‘loss
factor’, which represents the loss of momentum encountered by the flow [100].
• Available inventories
• Cloud build up
• Dynamic pressures
• Equipment
• Piping
This procedure is based on an initiative started in 1998 by Norsk Hydro, Statoil and Saga to
accelerate and harmonise the development of probabilistic explosion assessment tools. It is
intended to be used for detailed analysis of platforms in operations or the project phases where
the necessary detailed information is available for all design elements that will influence the risk
picture. The procedure can be used to calculate exceedance curves for the overpressure and
frequencies can be established for unacceptable explosion consequences.
The procedure briefly also covers response calculation and consideration of overpressure
mitigation methods such as deluge.
One purpose of the procedure is to ‘standardise the analyses so that the risk of explosions can
be compared between different areas, installations and concepts, even if the analyses are
performed in different circumstances and by different personnel’.
The procedure is meant to be used for detailed analyses of platforms in operations or in the
project phases where the necessary information on all design elements influencing the risk
picture is available. In early project phases the project must be simplified according to the
design information available, but the general structure and principles must be maintained. The
amount of equipment shall be estimated based on equivalent areas in previous studies.
Sensitivity studies shall be used to establish whether minor changes in amount of equipment,
pressure relief areas and ventilation will change the gas explosion loads significantly. In cases
where low loads are expected or where the structure has high strength so that larger
conservatism can be accepted, the procedure may be simplified provided the conservatism is
under control.
In particular the methods described in the NORSOK standard Z-013[12] represent the most
technically rigorous methods available at the time of writing and are the benchmark against
which the methods used should be gauged. This Guidance is consistent with the underlying
philosophy of the procedure but also aims to identify ways by which the volume of computation
effort may be safely reduced.
6 RESPONSE TO EXPLOSIONS
6.1 Overview of explosion response
This clause is based on Reference [20] and deals with the methods of analysis of the response
of structures, piping and safety critical elements (SCE’s) to explosion loads derived following
the methods given in the previous clause.
Over the last ten years, many structures have been designed to resist uncertain explosion
loads by the calculation of the capacity of the structure and the SCE’s and the demonstration of
robustness in the structure as reflected in an insensitivity of response to variations in load. This
approach is to an extent scenario independent and may give added protection against
unidentified scenarios and in particular combined fire and explosion scenarios.
The ‘robustness’ approach is still valuable and should be considered in addition to the more
rigorous probabilistic methods described in this Guidance, which enable design explosion loads
to be determined which should be accommodated by the structure and other SCE’s.
The methodology for the assessment of explosion response is illustrated in Figure 18.
Inputs
Peak overpressures (DLB and SLB), durations/time histories, dynamic pressures
Pressure exceedance diagrams, element specific performance standards
Probability of late ignition of releases
Structure geometry, Loads on SCEs and supports, SCE criticality levels
From Explosion load determination
To ‘Evaluation’
Outputs
Response durations/time histories, peak response of structure and SCEs to
design explosion loads, ductilities, displacements, stresses and associated
probabilities. SCE criticality levels, rupture and associated probabilities,
element specific performance standards, escalation targets
This places considerable emphasis on the requirements for structural and equipment
robustness, i.e. ensuring that systems can absorb significant amounts of energy and be able to
redistribute internal forces via the provision of adequate alternative load paths.
One way of achieving structural robustness, is to prevent premature failure by buckling and
shear failures which may produce brittle, as opposed to ductile response. Adequate
connections to adjoining members will ensure the ability to redistribute load and enable the
structure to mobilise its ultimate capacity. The goal of robustness ensures that the structure has
the ability to absorb some of the uncertainty in the loading to which it may be subjected.
A review of the research in the area of response to explosion loads since the generation of the
Interim Guidance Notes [1] , or IGNs, is contained in Reference [20].
• Identified strength level blast (SLB) and ductility level blast (DLB) load cases – these
should include special distributions of peak overpressure and overpressure time
histories at critical locations.
• Dynamic pressure exceedance curves for SCE’s of criticality 1 for the DLB with time
histories of dynamic pressures at these locations.
• Dynamic pressure exceedance curves for SCE’s of criticality 1 or 2 for the SLB with
time histories of dynamic pressures at these locations.
• Other overpressure and dynamic overpressure information for significant scenarios with
similar frequency, where the loading pattern differs appreciably from the design
explosion events. If this is not available then a range of likely durations should be
supplied.
If exceedance curves are not generated then the probabilities associated with the design
explosion events should be available. If time histories are not supplied load durations and
general shape of the load time histories should be supplied.
Low and some medium risk installations will only require the information for the ductility level
blast explosion loads.
• High level and system specific performance standards for evaluation of the results of
the assessment.
• Layout drawings, including process, escape routes, muster areas, the TR, the SCE’s
and their support structures
• Any structural drawings and the location of tall structures which may become a hazard
during escalation.
• Details of the assumptions for detection, control and mitigation systems, location and
required availability.
• For dynamic response analyses, the location and masses of all major items should be
supplied.
Further exceedance curves will be required from the explosion specialists for dynamic pressure
loads, to enable the dynamic pressure loading on pipework to be developed.
In order to determine the loading on large items of equipment or vessels, the required items
can be identified to the explosion specialist for direct load extraction from the CFD model for
various explosion scenarios. Alternatively, a less accurate, but also less time consuming
method for the explosion specialist, is to provide generalised pressure-time histories for the
equipment locations, together with the speed of travel of the pressure wave. The structural
engineer then determines the maximum pressure difference between locations of known
separation, having determined the time taken for the wave to travel that distance.
If the general level of dynamic pressure loads is not known then it is acceptable to take a load
equal to 1/3 of the smoothed peak overpressure at the location for loads on the relevant SCE’s
and piping. The duration should be chosen so that the impulse is matched to the positive phase
of overpressure trace. This load must also be applied in the reverse direction. In open areas,
such as the decks of FPSOs, these loads should also be applied in the vertical plane.
The fact that the detail of a given load distribution is only one of many possible scenarios also
implies that reliance should not be put on the apparent result that some parts of a blast wall for
instance seem to receive less load than others, as a different ignition point may give rise to a
different distribution of load. It is therefore not acceptable to design adjacent areas to different
pressures without justification.
The structural engineer should develop the idealised pressure-time histories for various pulse
durations in order to capture the range of dynamic response for the various components of the
system to be designed or assessed or preferably use a representative range of overpressure
time histories directly if they are available.
If a range of pressure time histories is not available then extrapolation of the range of durations
supplied should be investigated. The peak pressure/duration relationships [86] given in sub-
clause 5.8 may be used to estimate the peak overpressure for shorter duration loads. The peak
averaged overpressure is plotted against impulse in Reference [86].
It is accepted that the design overpressure for the design of a panel will be greater than that for
a section of a blast wall which will in turn be less than that for a whole wall. This is a result of
the fact that the pressure disturbance is of finite extent relative to the target and hence the
averaged pressure will vary with target dimensions. The explosion load specialist may supply a
lower level of design load for an extended structure (deck or wall) than for a blast wall.
Reference [89] gives a simple method of deriving scale factors. The approach should be
applied with care as the direction of travel of the overpressure pulse relative to the target
affects the way the pulse is reflected. The approach is suitable for large deck areas or if
sufficiently detailed information on the loading pattern is available.
In modelling the response of a structural frame, it is conservative not to model the cladding or
plate as the shear restraint from such surfaces may be overestimated. The overpressure load
on a plate may be applied directly to the bounding members of the plate using the ‘area
tributary method’. For example the loads on a square plate may be applied to the bounding
framing members with one quarter on each, for a rectangular plate the members on the long
edges would receive a load proportional to the triangular area joining the edges with the plate
centre.
The response of a structure to a dynamic load is commonly characterised by the ratio of the
load duration ‘td’ to the natural period ‘T’ of the structure. Depending on the value of this ratio,
three response regimes are defined, denoted as either impulsive, dynamic or quasi-static.
Table 6.1 is a modified version of the one in the IGN to reflect more recent work published in
NORSOK [102] and summarises the influence of the loading characteristics on response in the
three regimes.
This table assumes that there is some identifiable natural period for the structure, which
indicates that a Single Degree Of Freedom (SDOF) idealisation of the structure is possible.
Multi-Degree Of Freedom (MDOF) systems may have a large number of modal periods
associated with them, although it is often possible to identify a mode or shape of response with
each modal period.
If the loading is impulsive much higher peak loads can be tolerated than the static capacity of
the target.
The limits specified in the Table above have been changed to correspond to those in the
Norsok standard [102] . The impulse duration ratio at the impulse to dynamic boundary has been
reduced from the 0.4 and 2.0 values given in the IGNs. The Dynamic Amplification Factor ‘DAF’
(dynamic/static response) does not approach unity for a triangular load pulse until a value of
between 5 and 6 is attained. It is important to note that although the load duration may be long,
the rise time may be short and this can cause significant dynamic amplification as may also be
seen in Figure 19 taken from Reference [103] for the sharp fronted pulse shape..
2.4
Rectangular
2.0
Triangular
D
1.6
1.2
0.8
0.4
0
0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0
2000
O verpressure (mbar)
Maximum overpressure
1750
(> 1 ms duration)
(PMAX )
1500
1000
750
500
250
10 % of maximum
overpressure
td
For determination of deck response to an explosion from below, it is important to represent the
negative phase of the loading to enable the calculation of rebound.
This form is not characteristic of far field blast waves outside a compartment. A typical trace for
this case is shown in Figure 8.
The single peak idealization shown in Figure 20 will not apply when external explosions are
involved or when there are two paths to the observation point or in some cases of explosions in
the moonpools of FPSOs. There are also concerns that the sharp changes in slope in the
idealization introduce spurious frequencies into the exciting force and that it is preferable to use
the original pressure traces from CFD or use some spectral approach. These topics are under
investigation and will be dealt with in detail in Part 3 of the Guidance. Reference [104],
discusses the accuracy of various methods of idealization of pressure pulses.
The use of Figure 19 is only applicable when elastic response is expected and the structure
does not yield locally. For plastic deformations the dynamic amplification factor has a restricted
meaning, as a static load which causes yielding would deform the structure without limit.
A Dynamic Amplification Factor (DAF), γ, should be calculated for all loaded members such
that the equivalent static load, Lstatic, is related to the peak dynamic load, Lpeak, by:
Lstatic = γ Lpeak
For single structural components γ may be as much as 2, for typical large structures such as
module and topside structures, the natural periods are likely to be longer with DAF’s less than
one.
An equivalent static load may be obtained from consideration of the modes of response of a
MDOF structure and by choosing the mode (and modal period) corresponding closely to the
expected shape of the response if this is available. A DAF may then be calculated for this form
of response. Another technique is to perform a simplified dynamic analysis and find an
equivalent static load distribution which gives similar displacements to the peak dynamic
response. This only applies for elastic response but may enable code checks to be performed
using conventional software.
The DAF obtained for an extended structure and the appropriate design load may not be
applicable for member or local checks.
For plastic deformation a time history simulation may be used to estimate the DAF including
plastic response using Biggs’ method described in 6.8.1.
For example consider an explosion overpressure of 1.5 bar with a duration of 150 ms as the
design load condition. A triangular profile may be appropriate as shown in Figure 20. This can
then be translated into transient dynamic response as shown in Figure 21.
0.0025
Static Response
0.0020 Dynamic Response
Displacement (m)
0.0015
0.0010
0.0005
0.0000
0.000 0.050 0.100 0.150 0.200 0.250 0.300 0.350 0.400
Time (second)
The method could be refined to take account of the variation of impulse and duration with peak
overpressure given in sub-clause 5.8.
In a design or assessment project, if detailed and precise material data is available then
potentially a more economical design can be achieved. However in most design situations the
engineer will typically have to rely on generic data specified in the relevant standards. In the
special case of modifications to existing platforms (brown-field projects) mill certificates for the
employed steels should be available. As a minimum these certificates will contain useful
experimental results obtained from tensile coupon tests on the yield strength, the tensile
strength and the rupture elongation of the steels.
It should be emphasised that when performing a structural analysis the materials are often
assumed to have a limiting strain well below their fracture strain. The reason for this is partly to
allow for deficiencies in the adopted analytical modelling tools, and partly to allow for variations
not explicitly covered in the geometric and physical description of the structure.
As an example the influence of specified tolerable variations in the dimension and mass of the
structural components as well their alignment are seldom incorporated into the analytical
model. Also local buckling of compression elements and localised necking of tension elements
are in general not automatically captured, except by the most sophisticated and detailed of the
analytical tools. According to the IGNs [1], the limiting strain can be set to 5 % for a member in
tension as well as for a member in bending or compression with a plastic cross-section.
The quasi-static stress-strain curve for a typical structural steel specimen tested in accordance
with standard tensile test procedures, such as those described in BS EN 10002-1:2001 is
typically characterised by four distinct phases:
• from the onset of loading, until reaching the upper yield stress, the stress-strain
behaviour of the specimen is nearly linear elastic with a modulus of elasticity of about
205,000 N/mm2.
• hereafter, it follows a rather sudden stress drop down to a lower yield stress,
With respect to the upper yield it is known that stress concentrations and welding both have a
tendency to reduce if not remove it. However, for the purpose of designing connections and
supports against dynamic loading, ignoring the upper yield stress could prove unsafe. In
contrast, when designing the individual structural members it is safe to ignore the upper yield
stress.
The yield plateau, which typically terminates at strains at least 10 times larger than the initial
yield strain, is followed by a phase of strain hardening at a continuously diminishing rate until
reaching the ultimate stress-strain point.
It is interesting that according to the guidelines given in the EC3 Part 1.2 draft code for
structural fire design the ultimate strain of structural steel can irrespective of the temperature be
set to 15 %.
The specific and current mechanical requirements to structural steels to be used in the
fabrication of fixed offshore structures are given in material standards [108]. This standard,
which has superseded the recently withdrawn BS 7191: 1989, specifies the requirements to
variations of the steel grades S355, S420 and S460. These steels are all suitable for
installations in the North Sea sector.
Typical limiting values for some of the mechanical properties specified in EN 10225 for grade
S355, S420 and S460 steel are listed in Table 6.2.
Table 6.2 Mechanical properties typically specified for structural offshore steels
Name Reh Rm Af
N/mm2 N/mm2 %
S355 355 470 – 630 22
S420 420 500 – 660 19
S460 460 530 – 720 17
It should be noticed that the minimum yield strength Reh refers to the upper yield strength. The
requirements to the tensile strength Rm is given in terms of an upper and a lower limit, and the
ductility in terms of a minimum rupture strain Af. The rupture strain is measured over a gauge
length of 5.65√S0 , where S0 is the original cross-sectional area of the test piece. In situations
where the yield phenomenon is absent the yield strength should replace this parameter with the
0.2 % proof strength Rp0.2.
It should be emphasised that the actual yield strength of steel frequently is significantly larger
than its guaranteed minimum value. In the case of the high quality offshore steels tested in
Reference [109] the upper yield strengths were measured to be up to 26 % larger than their
guaranteed value, with an average of about 13 %. Such differences between the guaranteed
and the actual yield strength need to be accounted when estimating the magnitude of the
forces transferred through the joint details into the supporting structure.
Compared to carbon steel the stress-strain curve for stainless steels are characterised by a
smooth rounded response with no definite yield point. Another major difference in the
mechanical performance at ambient temperature between the two types of steel is the
improved ductility of stainless steel.
Table 6.3 lists typical values for the mechanical properties of various stainless steels as
specified in Reference [110]. As is the case for carbon steels, the actual yield strength, here
taken as the 0.2 % proof strength, is usually significantly larger than the minimum specified in
the standard. For the experimental test series described in Reference [111] the measured proof
strengths were in average observed to be 28 % larger than the specified minima.
Furthermore, the mechanical requirements given in the table refer to material in the annealed
condition. Thus in situations where the structural elements will be subjected to some degree of
cold forming without a following heat treatment, the yield strength in the work hardened zones
need to be adjusted upwards.
Rp0.2 Rp1.0 Rm Af
Name
N/mm2 N/mm2 N/mm2 %
1.4404 (316L) 220 260 520 – 670 45
1.4401 (316) 220 260 520 – 670 45
1.4362 (2304) 400 - 630 – 800 25
1.4462 (2205) 460 - 640 – 840 25
Strain hardening should always be accounted for when designing for the dynamic reaction
forces, whereas it safely can be ignored when designing section sizes.
Strain rate sensitivity is traditionally expressed in terms of the Dynamic Increase Factor (DIF).
For a given strain rate and a given material property the DIF is defined as the ratio between the
value of the material property measured under dynamic and quasi static loading conditions,
strain rates of 2.5x10-3 s-1 .As a consequence the tested value will typically be about 8 % larger
than the long term yield strength.
In general the dynamic testing of steel specimens has shown that the elastic modulus is
unaffected by strain rates, and that the strain rate sensitivity decreases with an increase in the
plastic strain. It is also generally accepted that the strain rate effects are the same whether the
material is loaded in tension or compression, and that the Dynamic Increase Factors are
isotropic in their nature.
Although an increase in the rate of straining reduces the fracture toughness of steel it is
unlikely that the strain rates associated with hydrocarbon explosions will significantly reduce
the fracture toughness of the high quality structural steels used for offshore installations.
One of the most used models to describe the rate effects on the yield strength is the Cowper
Symond’s model:
⎛ ε ⎞
f yd 1/ q
= 1+ ⎜ ⎟
fy ⎝ D⎠
Table 6.4 [111,1] lists the coefficients D and q recommended for calculating the dynamic yield
strength of various structural steels.
D q
Material
s-1 -
Mild steel 40.4 5
Stainless steel (304) 100 10
Stainless steel (316L 240 4.74
Stainless steel (2304) 3489 5.77
Stainless steel (2205) 5958 6.36
Figure 22 compares various empirical models with experimental data. The experimental data
for stainless steels were taken from Reference [7], and for high quality carbon steels suitable
for fixed offshore installations from Reference [1].
For typical steel structures, the strain rates associated with hydrocarbon explosions will seldom
exceed 1 s-1. This compares with the strain rates of 103 s-1 frequently encountered in metal
working processes and hard impact situations. However the risk of employing the Cowper
Symond’s formulation to fit experimental strength data is the loss of some accuracy for the
strain rates which are most relevant to gas explosion scenarios. For strain rates less than about
1x103 s-1, an essentially linear relationship between the stress and the logarithmic strain exists.
It should be mentioned that the strain rates vary both spatially and temporarily within a
structure. Thus when performing a non-linear finite element analysis it is necessary to know the
complete stress-strain behaviour at all encountered rates. Likewise it is assumed that all
conclusions regarding the uniaxial stress state can be generalised to the multiaxial stress state.
1.6
Test data for BS 7191 grade 355 Mild Steel 2304
316L 2205
and 450 steels
1.5
Upper Yield Strength ratio
Lower Yield Strength ratio
1.4
Dynamic increase factor
1.3
1.2
1.1
1.0
0.9
0.8
1E-006 1E-005 0.0001 0.001 0.01 0.1 1 10 100 1000
strain rate s-1
It is, however, necessary to demonstrate that the strains are high enough to mobilize the
benefits of the strain hardening. The following groups of structural members may sustain high
plastic strain without losing strength from local or overall buckling.
• Tension members
• Members in bending whose cross-sections comply with the criteria of compact section
and whose slenderness ratio (λ) does not exceed certain values.
High level performance standards have been given in Part 0, Fire and Explosion Hazard
Management, they are reproduced below.
In an explosion event, at least one escape route must be available after the event for all
survivors. For a manned platform a Temporary Refuge (TR) or Safe Mustering Area must be
available to protect those not in the immediate vicinity of an explosion and to survive the event
without injury.
For the ductility level blast (DLB), the primary structure should not collapse with escape
possible from safe areas after the event. Safety critical elements, defined as those elements
critical to safety [30,31], should have fulfilled their function or remain operational. Plastic
deformation of the structure is acceptable provided collapse does not occur and barriers remain
in-place and are able to resist any subsequent fires. The ability of the structure to satisfy these
requirements will depend on its ability to respond in a ductile manner and the ability of the
barrier connection details to respond without rupture.
The frequency with which accidental events, from all causes, will result in loss of TR integrity
within the required endurance time will not exceed 10-3 per year [32]. The required endurance
time is the estimated time for people to travel from their work stations to the TR, then to the
primary and secondary means of escape, allowing for the possibility of helping injured
colleagues.
A Safety-critical element (SCE) is defined as, any structure, plant, equipment, system
(including computer software) or component part whose failure could cause or contribute
substantially to a major accident is safety-critical, as is any which is intended to prevent or limit
the effect of a major accident.
In addition to the high level Performance Standards above it will be necessary to define
measurable performance standards for specific key items or systems relating to the systems’
functionality, availability and survivability. These are referred to in this document as ‘element
specific performance standards’ used in the evaluation stage of the explosion assessment.
These are sometimes referred to as low level performance standards.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting structure.
Performance standard – These items must not fail during the DLB or SLB,
ductile response of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment.
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to
blowdown and or pipework damage.
As is common in the design of structural systems under other forms of accidental loading, e.g.
earthquakes, performance criteria for the DLB are set such that permanent deformations can
occur, but overall collapse is prevented. In addition to this is the requirement that the explosion
must be contained, in order to prevent an escalation of the event. Consideration needs to be
given to limits of deformation, as determined by the location of pipes and equipment and to the
performance of these items. The limits specified for the structural elements should not exceed
those required for the supported or adjacent equipment to function adequately.
Performance levels for structural elements, that are normally considered, are:
• Strength
• Deformation limits
• Rupture
• Global collapse
This guidance document recommends two levels of structural assessment, strength level
analysis for the SLB and an ultimate capacity analysis or ductility level analysis for the DLB.
The performance standard relating to strength of members is more suitable for the strength
level analysis, as this is predominantly a stress based check using static design codes. For the
DLB, ultimate capacity check the yield stress limit will be exceeded and member stress is not
appropriate for judging member response. At the ductility level, deformation limits are normally
adopted.
For a class 1 section, Reference [112] allows a limiting support rotation of 2 degrees and a
ductility factor of 10 (whichever governs) as reasonable estimates for absolute values to ensure
safety for personnel and equipment and consistent with maintaining structural integrity in the
inelastic range. It should be noted that such levels of ductility will have design implications for
members containing plastic hinges to ensure the ductility levels can be achieved. This is
normally achieved by providing lateral restraint at hinge locations to the unbraced compression
flange (Part 3 of the Guidance Document will cover these details).
Norsok standard Annex A, N-004 [113] gives the range of allowable values of µ depending on the
section classification assuming no axial restraint to the beam and the boundary conditions. This
is given in Table 6.5.
Consideration of attached fire protection may impose a lower limiting strain or deflection. The
displacement of the component must also be limited to prevent impacting SCEs and equipment
items.
6.5.4 Rupture
Structural integrity is often assessed using strain limits, which if exceeded would cause rupture.
Current guidance on allowable strain values are to set the critical percentage strain limit at 5 %
at weld locations and 15 % in the parent material away from welded details.
These values refer to average local strain values. However it is important to be aware that
strains at this level are quite sensitive to a number of parameters and tests show a significant
scatter of strains at fracture. The Norsok Standard [113] highlights a number of factors which
influence the strain values such as material toughness, presence of defects, strain rate and
presence of strain concentrations. Strains are normally adopted as a failure criterion when
using finite element models to judge response. It should be noted that variations in strain are
quite common depending on the modelling assumptions used and care in interpreting these
values at critical points is required.
Screening of various options for blast walls or potential behaviour of walls and decks under a
number of explosion scenarios requires cost effective, reliable and accessible solutions. In
many cases this may mean that complex Non-Linear Finite Element Analysis (NLFEA) is
unlikely to be an option in the early stages of the design cycle unless planned well in advance.
Once the design has matured and safety critical elements of the structure have been identified,
NLFEA is likely to be required to verify the design.
For retrofit systems, it may be important to obtain the ultimate capacity at an early stage which
may require a more refined analysis at the outset. This will assist in determining the degree of
retrofit required although other factors such as shutdown period if hot work is required and
space available will also influence the options available. It is also important to bear in mind that
simple models may not give a satisfactory design for large overpressures as many of these
tend to rely on bending capacity from a static analysis with some form of load factor to account
for the dynamic response.
The extreme loading applied to a structure during an earthquake is often compared with an
explosion event on a topside due to the small probability of occurrence. Also, many of the
concepts used in design for earthquakes[112] such as attention to detail to connections and
ductility requirements apply equally to topside explosion response. For earthquake design it is
common to consider two load cases for the design of structures and equipment:
1. For a frequent earthquake with low seismic forces, the structure or equipment should
remain undamaged. For the structure this is essentially a serviceability check and
must remain elastic.
2. For a strong rare event, the structure can sustain damage but overall collapse should
not occur. –- definition
In blast mitigation applications the prime objective is often energy absorption and not static
strength, particularly for the extreme low probability scenarios, although limiting deformations
need to be set in some parts of the structure which may be influenced by plant, equipment and
piping. In general, increasing the stiffness of a structure can result in local stiff points which
attract high loads and lead to brittle failure modes which may compromise the integrity of the
whole system.
By analogy with the approach used to assess structures for their ability to resist earthquakes,
two levels of explosion loads are recommended for explosion assessment. The strength level
blast (SLB) and the ductility level blast (DLB) obtained from consideration of exceedance
curves or from the use of derived nominal overpressures as discussed in sub-clause 5.7.
The SLB may be typically in the region of 0.5 – 0.6 bar. It should not be less than the 0.34 bar,
which is given in the building code [114] as a minimum lateral pressure to be resisted by walls in
order to achieve a minimum level of robustness in the connection details.
This is likely to involve simple numerical models such as the Bigg’s SDOF idealization [101] or a
static finite element analysis for the primary steelwork. The use of simple models will allow a
rapid assessment of the suitability of the layout of the primary steelwork and the screening of a
number of pressure time histories to establish the bounding case from the loading.
Performance standards based on design strength are adopted for assessment with this loading
level. It is important to be aware of limitations of this approach:
1. Design codes are based on static design and not dynamic loads. This is particularly
important when checking members in compression as buckling is a time dependent
phenomenon which may invalidate some of the static code checks.
2. It is essential to allow for the enhanced reaction forces at connection details due to the
enhanced yield stresses which may occur.
3. Membrane forces may occur in some elements which may not have be accounted for
in some code checks
In some cases a maximum deflection limit may be specified to avoid compromising supports to
vital equipment or pipework, which may lead to an escalation of the event. The adequacy of
components is checked against performance criteria based on maximum deformation and
strain rather than strength.
Analysis of this level of deformation inevitably requires the use of more complex analytical
tools, such as non-linear finite element techniques which are capable of modelling large
deformation and strain. It is also important to capture the effects of interaction of the structural
elements as a system, in order to assess the possibility of a global collapse mechanism
occurring. Uncertainties still exist at such large strain values, which are inevitable in many
instances, and care needs to be taken when interpreting the results of non-linear analyses.
Joints, panels, barriers and connections still need to be checked against the DLB directly
preferably using a non-linear elastic plastic method of analysis.
It is, however, unlikely that the differing levels of response to dynamic loads at the same peak
level as determined by the natural periods of the target structural elements will be adequately
represented without undue conservatism. The variability of pressure in the explosion load
cases is also not represented in this method. The validity of this method will depend on the
severity of other load cases which have been used in the original design of the structure.
For the primary structure, which is crucial to the survivability of the structure under the extreme
load condition, it is necessary to ensure that it remains predominantly elastic in the overall
failure mode and parts of the structure that are allowed to yield are detailed for high ductility.
This will be predominantly the blast walls and plating, which if allowed to deflect will reduce the
loads transmitted to the primary framing.
This places emphasis on the connection details, which need to be assessed for large rotations
in order to achieve a robust structure. The overall aim of the philosophy in this clause is to
ensure that the concept of robustness is built in at an early stage. At the strength level blast,
the structure should remain elastic and the structure should have enough ductile capacity to
survive the ductility level blast load case.
The general philosophy is to start with the simplest methods (ensuring a conservative
approach) and if failure is indicated, proceed to more sophisticated methods of analysis.
1. Screening analysis
Non load-bearing elements, typically panels, fire walls, and blast panels may be checked in
isolation.
The stresses in panels and cladding usually dominate the stresses due to frame movement.
Panels and some blast wall systems may be conservatively idealized as one way spans.
Resistance displacement curves may often be determined statically, dynamic response may
then be determined using a modified Biggs’ [101] method.
Dynamics of simple structures may be represented with knowledge of dominant natural period.
It is preferable to model the primary structure response to the SLB using an elastic frame
model as single member assessment does not take into account the transfer of loads between
connected loaded surfaces and any co-existent static loads. It is preferable not to include non-
structural cladding and plates in the model as their response is mainly in membrane action and
their shear strength may be overestimated.
Screening analysis for an existing installation consists of condition assessment which may
involve a survey followed by design basis checks.
The transfer of conclusions and load characteristics from the analysis of a similar platform is
acceptable for this and for Strength level and ductility level analyses.
Design basis checks consist of checking the basis of design for the installation and determining
if the methods used for the design are acceptable in the context of the fire and explosion
events considered.
If the structure and appurtenances have been checked for a Safety level or Ductility level
earthquake loads following API RP 2A [47] (9th Edition sub-clause 2.3.6e.2 or later) then the
‘strong vibration’ response to explosions need not be checked.
Component checks may be employed if the component is non-load bearing in the operational
condition or if the component does not form part of the main framing. Methods of dynamic
response assessment such as Biggs method [101] may be used as described in sub-clause
6.8.2. Where loads from connected structures are represented component check methods may
be employed. There are however many limitations on the method which are discussed in sub-
clause 6.8.3.
A major consideration in explosion response is that deflections of the structure must be limited
to allow escape. Typically the deflections into escape ways should be limited to about 150mm.
The allowable deflection into equipment spaces will depend on the clearances to equipment.
The deflections of the Primary structure will normally be satisfactory if it passes the normal
strength or utilization checks. Blast and firewalls are however designed to deflect to exploit the
ductility of these items and so deflection checks for these items will be necessary.
Buckling checks must also be performed to ensure that the full plastic capacity of a member
can develop.
The integrity of an offshore structure may be checked using a linear, elastic, beam model.
It is conservative not to include the restraint from the cladding or barriers in the primary frame
computer model. In some circumstances it is advisable not to include the cladding as plate
elements as the shear restraint from these elements will be overestimated in a small deflection
elastic model. This applies particularly if an external explosion load is considered which puts
the side walls with respect to the pressure into shear. In a dynamic analysis the masses and
their distribution should be included in the model.
In checking the primary structure it is conservative to include the loads from barriers but to
ignore their strength contribution.
The response of cladding panels and plates that form part of the primary structure may be
analyzed in detail using finite element analysis assuming the supporting beams are fixed at the
main nodes of the structure. The justification for this is that the stresses in the panel are
dominated by local response of the panel out of plane and that the stresses induced by the
deflection of the main framing are comparatively small. If necessary this assumption can be
checked by application of prescribed displacements to the edge of the panel corresponding to
the frame response.
Buckling checks must be performed to ensure that the full plastic capacity of a member can
develop. These checks should be made particularly for deck beams loaded from an explosion
below as flanges usually in tension may be in compression during the explosion. These checks
should ideally be performed using the loads for the DLB and SLB load cases. Deck beams
loaded by an explosion below should also be checked for re-bound effects.
An equivalent static load as described in sub-clause 6.3.3, will need to be defined for
application of explosion loads as a static load case.
The dead loads in the structure need to be combined with a realistic estimate of live or
operating loads to perform a strength level analysis treated as a design load case.
Environmental loads need not be included. API [47] recommends that 75 % of the live loads are
included in the combination for the earthquake analysis. It is recommended that the same
proportion of live loads are taken for the explosion load case. The loads from an existing
fatigue analysis load case may also be suitable.
Blast resistant structures and their supports are designed to respond in a ductile way to
explosion loading mainly in bending. The shear behaviour of structures at their supports and in
the joints of the primary frame will also affect the utilization factors derived in the code checks.
The safety factors implicit in the code checks will be different from those associated with
bending. Shear strains at supports should generally be limited to the elastic limit.
Additionally, for a dynamic situation these shear forces will be quite different from the values
obtained by static analysis as a result of the inertia forces acting on the structure. The benefits
of this effect are exploited in blast wall design, as the support or reaction loads may be less
than the applied overpressure load. Plastic deformation of a blast wall also has the effect of
limiting the reaction loads on the supports.
For a loading duration near the natural period of the member the shear forces could be higher.
Checks should be made where this is likely using a dynamic amplification factor based on the
ratio of load duration to natural period (see Figure 19).
Code checks may be re-interpreted to take account of the following inherent reserves of
strength, both material and plastic reserves as discussed in sub-clause 6.4.3. Material effects
are discussed in sub-clause 6.4.
For most ductility level analyses code checking will either not be appropriate or the response
simulation software will not contain a code check module within the software. Checking of
members will be done explicitly with regard to performance standards, which may take the
following forms.
• Strength limit checks similar to code checks; failure is defined to occur when the design
load or load effects exceed the design strength. This criterion may be applied in the
plastic region.
• Buckling checks, which identify where plastic response may be limited by local buckling.
Members may be classified as plastic, compact or non-compact (BS5950). Plastic and compact
members will generally reach their full plastic capacity before buckling.
If the structural response software is capable of representing finite displacement effects, plates
may be included in the model to represent barriers and loaded surfaces. The inclusion of plates
with equivalent thickness to represent mid point deflection will also help to represent the
tension and shear effects from these items.
The restraining effect of cladding can conservatively be omitted from the computer model so
long as the loads applied to them are applied to the bounding members according to the area
associated with each one. Some packages will not take account of the loss of shear restraint
from the cladding as it is deformed; in this case it is preferable not to include the cladding as
plates in the model.
Deformation limits are discussed in sub-clause 6.5.3. Additional Guidance is given below.
Compact sections may be designed using code checks without supplementary local buckling
checks up to first hinge formation.
Sub-clause 7.2 of Reference [5] gives formulae for checking for local buckling of beams
working beyond the elastic limit.
Checking of columns under axial compression is dealt with in Reference [117]. In most
situations blast walls are arranged to span from floor to ceiling without direct support from the
columns. Isolated columns only receive load from dynamic pressures and could be in tension
during an explosion. Allowable ductility ratios based on earthquake design practice are
available for I sections, box sections and circular sections from Reference [117].
Buckling checks must be performed to ensure that the full plastic capacity of a member can
develop. These checks should be made particularly for deck beams loaded from an explosion
below as flanges usually in tension may be in compression during the explosion. These checks
should be performed using the dimensioning explosion load level.
Reference [5] gives criteria for the prevention of lateral torsional buckling based on slenderness
ratios for beams. Large deflection effects such as web crushing and flange curling are dealt
with in Reference [5].
The principal ultimate failure mechanism for joints is rupture or brittle fracture unless the joint is
stronger than the members which are connected to it. The basic design principle is to design
them so that loading or imposed rotation causes ductile deformation of a connecting member.
This follows general practice in earthquake design. A more detailed appraisal is given in
Reference [5].
Components may be analysed in isolation as long as the interaction with the surrounding
structure through fixity and the applied loads are negligible or are represented in the
component model [98] .
Single Degree of Freedom (SDOF) methods represent a structural system as a single mass
whose motion is resisted by a single linear, or non-linear spring. The magnitude of the mass
and the stiffness of the spring are determined such that the displacements in the SDOF model
are the same as a characteristic displacement of the real system, usually taken to be a point at
mid-span.
The SDOF method is limited to structural systems, which can be easily simplified to a single
mass and spring. These are systems where the overall response may be represented by a
characteristic displacement and the deflected shape is similar to the first or lowest mode of
vibration of the system.
The SDOF method can easily be programmed onto a computer, which can calculate the
displacements at each time increment. The equations of motion can be modified during the
time-stepping process, to allow the modelling of changes in structural behaviour at certain
displacements. For example, the change in structural stiffness caused by plastic deformation
can be introduced when the yield displacement of a beam has been exceeded; hence
realistically modelling the increased displacements that occur after plasticity has been reached.
Explicit solutions of the equations of motion do not have to be found, and hence it is relatively
simple to use non-linear force and resistance inputs without significantly increasing the
complexity of the program. This is particularly useful in the analysis of blast panels, where the
resistance-displacement relationship is complex.
The Biggs method requires two basic inputs, the resistance displacement curve and an
idealized loading time history. Design charts are available [1,101] for the calculation of the peak
response, xmax, given the load duration to natural period ratio, td/T, and the ratio of peak
overpressure load to component ultimate plastic resistance, Fm/Rm. The charts are based on a
simplified bi-linear resistance behaviour, which is inaccurate for fully or partially fixed members
as well as for members where tension effects are significant. This procedure is illustrated in
Figure 23.
The mass and stiffness of a structural member must be carefully represented in the SDOF
model to ensure that the model displacements accurately represent the displacements of the
actual member. The mass and stiffness of the member, as well as the loads applied to it, are
modified using transformation factors which are calculated taking into account the deflected
shape and the loading and mass distributions [1,101].
The values of the transformation factors are dependent on the deflected shape of the member
under the blast load. If the deflected shape of a member changes as it is loaded (for example if
plastic deformation occurs) the transformation factors must be adjusted. Methods of
calculation of mass KM and stiffness KL transformation factors for beams and panels are given
in References [1] and [101].
Me
T = 2π
ke
where Me = Actual member mass M times KM, the mass transformation factor.
Ke = Actual member stiffness k times KL, the stiffness or load transformation factor.
Typical member response is shown in Figure 21. Member damping is not usually modelled in
this analysis, and hence the member oscillates freely after the blast load has been released. In
practice, damping is not important, as it is generally small for structural members oscillating in
air, and in any case it is the maximum displacement rather than subsequent oscillations, which
is important.
Pm F e( t)
1000 FORCE
800
600
400
200
0
0 0.1 0.2 0.3 0.4 0.5 0.6
td LOA D DURA TION TIME(s)
R
RE S I S TANCE R m
1000
2
800
600 1
3
400
S LOP E K e
200
Xe Xm
0
DIS PL ACEM ENT
F(t)
B LAST WALL
The degree of rotational and axial fixity at the ends of a structural member affects its elastic
stiffness and hence its natural period. The bi-linear resistance – displacement relationship
used in the Biggs’ design charts is only accurate for simply-supported members, where the
member reacts either purely elastically or purely plastically. For partially or fully fixed
members, elastic/plastic behaviour occurs before the member reaches its ultimate plastic
resistance.
The Biggs charts use an approximation of member stiffness to give a bi-linear resistance curve
for all fixity conditions. The stiffness used in the Biggs method is determined such that the area
under the ‘actual’ and ‘idealized’ curve are equal, and hence the energy or work done to a
given deflection is the same for the two curves.
A range of values of Fm/Rm and td/T were used to generate the sets of curves shown in the
Biggs’ design chart Figure 24 for a simply supported member under a triangular load with a rise
time equal to half the load duration. Similar charts for differing rise times of triangular loading
are given in References [1] and [101].
100
80 Rm /F1=0.2 0.3 0.4 0.5 0.6 0.7
50
20 0.8
10
8
5
y m /y el = µ
0.9
1.0 1.00
0.8 1.20
1.60
0.5 R
2.00
F(t) F1
Rm
ym
0.2 t y t
0.5 t d t d y el tm
Triangular Resistance Displacement
pulse load function function
0.1
0.1 0.2 0.5 0.8 1 2 5 8
t d /T
Figure 24 - Biggs' design chart – overpressure rise time equals half load duration
This chart enables the peak response of the member to be calculated. The vertical axis is in
terms of the ductility, which is the number of multiples of the yield displacement the member
will reach under the loading.
• Determine the peak resistance Rm, effective stiffness and yield displacement Xe for the
member.
• Determine the effective peak force Fm from the peak force Fpeak and the load factor Kl.
(Fm = Kl x Fpeak)
• Determine the natural period of the member from the effective mass and stiffness
• Read off the ductility for the peak response corresponding to the td/T for the member
• Calculate the peak response from the ductility indicated on the vertical axis
The reaction loads at the ends of the member may also be estimated using this method
although the accuracy may be doubtful as detailed strain information is not represented in the
model. These formulae are not accurate for two way spanning panels but are reasonable for
the assessment of one way spanning panels or beams.
Similar charts may be constructed for partially fixed members by applying a rotational spring
stiffness, Ks, to the ends of the member [98] . Ks tends to infinity for a fully fixed member and to
zero for a simply supported member. The degree of end fixity for a member is determined from
the flexural stiffness of the connecting structure.
At low values of fixity, a plastic hinge is initially formed in the middle of the member, with
additional deflection causing plastic hinges to occur at the ends until the ultimate plastic
resistance is reached. At high values of fixity, plastic hinges are initially formed at the ends of
the member. Increased deflection causes a plastic hinge to be formed in the middle of the
member. The transitional stiffness occurs at Ks=6EI/L. This stiffness gives the greatest elastic
resistance for the member. Here I is the second moment of area, L is the length of the member
and E is the Young’s modulus for the material.
The degree of fixity significantly alters the natural period of the member. The natural period for
a fully fixed beam is less than half that of a pin-ended member. The ability of a member to
resist axial loads is reduced if its fixity is reduced. The buckling load for a pin-ended column is
4 times smaller than that of a perfectly fixed column.
Attached equipment alters the natural period of the member by increasing the mass, which
must be accelerated during blast loading. A one degree of freedom idealization may be
adopted to check the response of deck sections if a Screening Analysis is being performed.
The effect of static out of plane loads is to cause an initial deflection of the member. The
deflection will be positive in the case of a floor beam subjected to blast loading from above, and
will be negative in the case of a ceiling beam subjected to blast loading from below. The initial
deflection due to the out of plane loading effectively changes the position of the origin on the
resistance – displacement graph. The resistance function may be modified to take into account
equipment loads. The same Biggs’ chart may be used to estimate peak response so long as
the natural period and resistance function are modified to represent attached masses.
Whilst purpose designed blast walls will have no static loads applied to them, there is often a
need to assess the capacity of module walls and columns with in-plane loads present.
In-plane (i.e. axial) loads have 4 effects on the response of structural members:
1. Axial loads reduce the plastic moment capacity of a section. At the dead and live
loads normally applied to structural members the reduction in plastic moment capacity
is small.
2. Axial loads change the stiffness and hence the natural period of a member. The
stiffness of a member will reduce to zero at the Euler buckling load.
3. As an axially loaded member deflects under blast loading an additional moment will be
generated by the axial load about the original centreline of the member. This ‘P-delta’
effect is modelled by converting the moment caused by the axial load into a lateral
resistance, which is then subtracted from the original beam resistance
4. An axial load may be applied eccentrically to the member, creating an initial central
deflection. The reduction of blast resistance due to eccentric axial loading is modelled
by reducing the resistance of the member at the initial deflection.
The dominant effect on response is the p-delta effect. As blast walls are usually arranged to
span from floor to ceiling the direct explosion loads on columns are small these effects may be
ignored in a Screening Analysis.
Blast walls are usually designed to deform plastically and act predominantly in bending to
minimize the reactions on the primary structural members of the platform. A great deal of effort
is usually expended in designing the edge connections of the blast wall so that the reaction
loads are transmitted to the supports without damage to the supporting steelwork. Because of
the inertia of the wall it is possible to design these connections such that the transmitted shear
forces and moments are much less than the peak overpressure force on the wall. Purpose-
built blast walls are usually free standing, spanning from floor to ceiling and are not an integral
part of the supporting structure.
The capacity of a blast or fire wall with stiffened plate construction may be estimated for
Screening Analysis purposes using yield line analysis for the plate sections[119]. Other
formulations for resistance estimation are given in the API Bulletin 2V[119]. Work by Shell[120]
indicates that the ultimate capacity of panels may be much larger than formerly thought. In
particular the finite deflection capacity of a simply supported plate is larger than the classical
estimates of the capacity of a clamped plate with the same dimensions and span.
The possible failure modes of the wall may include panel failure, stiffener failure, and whole
wall failure. Each mode corresponds to a different plastic hinge, or yield line pattern. Local
and torsional buckling of stiffeners and wall plate may also occur before plastic hinge formation.
The failure mode corresponding to the lowest ultimate resistance is the critical failure mode of
the wall.
The calculated resistance will also depend critically on the edge support conditions assumed
which may in turn depend on the form of loading. High pressure loading on adjacent panels
may give rise to clamped edge conditions between panels even though the panels would not
otherwise merit this approach. Tension and membrane effects often indicate an increased
resistance but the restraint from the surrounding structure through inertia or stiffness may not
be sufficient for these effects to be fully mobilized.
Penetrations such as piping and cable runs should be arranged to pass through the wall at the
top or bottom of the wall to limit deflections and induced strains in the wall. The penetration
should be fire and gas proof. The penetrated section of the wall should be designed to have
the same stiffness and strength as those parts of the wall where no penetrations exist. The
dynamics of the wall and penetrations may need to be checked if large mass items are
attached to the wall.
Examples of connection and penetration details will be given in Part 3 of the Guidance.
Efforts have been made to include tension and membrane effects into Biggs’ method [98,121,8]
with mixed success. A detailed assessment of these will be made in Part 3 of the Guidance.
6.8.2.6 Rebound
Rebound must also be considered. This occurs when the load has subsided and the stored
elastic energy in the wall is released. This may be taken into account by assuming a reverse
load or suction at a level of 1/3 of the original overpressure with the same duration.
Biggs method may also be used to determine the rebound response if a suction phase is
included in the load time history. Other authors have developed a rebound dynamic
amplification factor which may be used to calculate rebound response (116].
1. It is not an easy task to convert anything other than the simplest structures into
equivalent spring mass models. A great deal of engineering judgement is required in
determining meaningful models and interpreting the solutions. For example, modules
are normally framed for lifting and to give redundant load paths, making the overall
structure of the module difficult to describe as a one degree of freedom system.
3. Ductility factors which are used are normally for idealised simple beam models. These
may not be appropriate for the actual MDOF structure where different patterns of
yielding could give the same overall inelastic peak deflection but the local ductilities
may be significantly different.
4. The Biggs method implicitly assumes that the deflected shape under blast loading is
normally the same as the static deflected shape. Many multi-degree of freedom
systems or systems with complex mass distributions do not respond in this way. This
also applies to some stiffened plate blast walls.
5. The loads obtained from a CFD model may indicate that they vary significantly in both
space and time requiring some conservative idealisation to simplify them so they can
be used with the SDOF model.
6. The method relies on the fact that the mass can be lumped, but deck type structures
are likely to have significant mass components from plant and equipment. This spatial
variation in the mass may well invalidate the assumed shape function and give non-
conservative results. Biggs [101] does address this problem but often the refinements of
his method are not implemented. If the rebound is more important, which may well be
the case if the ceiling of a module supporting plant is being considered, care needs to
be taken [122] .
Although some of the limitations above seem severe, the technique has been successfully
used in design situations, particularly where the resistance function has been accurately
determined. Reference [122] shows an example of a stiffened plate which whose resistance
function was determined via a static NLFEA and combined with the spring mass model. The
deflection time histories compared well with an explicit NLFEA up to pressures of the order of 3
bar. Beyond this, the model was unable to give accurate deflection values. This was thought to
be due to the spread of plasticity which results in a change of the shape function used in
formulating the spring mass idealization.
For an impulsive load, the kinetic energy imparted to a structure or structural element by a
short duration pulse, or external work for a long duration pulse, is determined and the strain
energy is then equated to the strain energy the structure develops while deforming.
A suitable shape function is required to describe the deformation under the loading and both
elastic and plastic behaviour can be accounted for. The resulting expressions for the two
loading regimes are then rearranged such that a non-dimensional plot of pressure against
impulse can be constructed. A number of curves are normally plotted for varying levels of
damage which may be defined in terms of the ductility parameter µ. This allows rapid
assessment of the damage or vulnerability to a number of different loading conditions. The
method is capable of representing membrane action in elements such as plate components.
The method can also be applied to certain systems which are also not easy to define using a
SDOF model.
The method can also be taken a step further by constructing pressure impulse diagrams for a
number of different elements such as beams, plates and columns for a series of damage
levels. The damage calculated for each component is then combined in a weighted manner,
depending on the vulnerability of each component, to define overall module damage.
Impulse assymptote
Fail
Pressure
Increasing µ
Pressure assymptote
Safe
Impulse
Figure 25 - Pressure impulse diagram
Furthermore the impediments to the common use of this powerful modelling tool are
continuously being pushed back by advances in computer technology. However, though the
necessary computer speed and data handling capabilities may prove no longer to be a
problem, it is still very much a specialist’s tool because of its general-purpose characteristics,
and because the method inherently overestimates the resistance of structures. The successful
application of NLFEA requires a sequence of carefully considered modelling, and possibly sub-
modelling, decisions as well as a number of control checks before total confidence in the
predicted results con be achieved.
The numerical model should include sufficient parts of the supporting structure to ensure that
the end-restraints are modelled realistically. This is especially the case when determining the
membrane forces developing in structural components undergoing large displacements. The
membrane forces have the effect of increasing the resistance of a structural member by
delaying the onset of buckling, and can also significantly alter the reaction forces. In this
context it should be noted that when membrane forces develops in one part of the structure
they are usually counterbalanced by compressive forces in other parts. These compressive
forces may have an adverse effect on the stability of the structure.
Rather than opting for a high overall level of detailing in the modelling of structural assemblies it
is often possible, without loss of accuracy, to employ the output of one model to drive a
displacement controlled analysis of a sub-model. An example of sub-modelling is the
assessment of the containment pressure of a blast wall. Typically the stiffened or corrugated
plate is represented by shell elements. A sub-model of solid elements is employed in order to
assess whether or not the ultimate resistance of the welded connections has been exceeded.
The converse of displacement driven sub-modelling is to use the results from a few lower level
analyses, such as those carried out to find the deformation capacity of connections and welds,
to define member performance standards applicable to the higher level analysis.
In order not to overestimate the ductile capability of members, it is very important that the finite
element analysis takes due account for all the potential buckling modes. As a consequence the
mesh density need not only to be fine enough for apparent convergence, but need also to be
sufficiently fine to represent all the dominant local buckling modes. Sufficient fineness can be
obtained by dividing each structural element susceptible to buckling into at least 6-8 elements
across the width. Furthermore the analyst may have to introduce imperfections or destabilising
loads in order to trigger numerical buckling.
For large assemblies it is not practical to make the mesh fine enough to pick up all the buckling
modes. Hence the individual structural components need to be checked until the analyst is
satisfied that all potential failure modes have been accounted for.
Regarding meshing it is also considered to be good practice to keep the aspect ratio of the
elements as close to unity as possible, and only to gradually change the sizes of the elements
in the mesh. Post processing tools can play an important role when investigating whether the
meshing is adequately fine.
For most models it is necessary to specify appropriate multiaxial constitutive equations for the
material. For steel materials Von Mises yield criterion used in conjunction with an isotropic
hardening rule and an associated flow can be employed in situations where the critical
response is reached during the pass of the positive phase of the blast loading. In the special
situations where plastic strain reversal is significant a kinematic hardening model is preferred.
The spatial and temporal distribution of strain rates, and their adverse influence on the reaction
forces need always to be considered when performing a plastic analysis.
When analysing structural components it is usually assumed that the pressure time history is
uniformly distributed over the surface. However when carrying out a global structural analysis
the ability to describe non-uniform loading, which also varies in time, is often required. Blast
loading should at all times remain normal to the surface of components undergoing large
displacements.
Furthermore the analyst should recognise and possibly need to include the fact the structure is
in a state of static equilibrium at the time of blast loading. Ignoring the service loads when
calculating the blast resistance will not necessarily be conservative. Permanent loads
associated with heavy equipment are best modelled by transferring the load through discrete
fixing points, which can be mutually constrained. Other service loads are included using a
smeared approach.
In general the explicit method is best suited for the analysis of blast loaded structures, where
the transient response are to be measured in tens of milliseconds, and large plastic
deformations develop. The primary reason being that the explicit algorithm requires relatively
little computational effort in each time step since no formal matrix factorisation is necessary.
Implicit methods on the other hand are essentially static codes running in time domain, and will
as such require much more memory and disk space. The degree of non-linearity of the problem
makes the larger time steps permitted in the implicit codes of little practical value. Another
advantage associated with the explicit codes is that they have an inherent ability to initiate most
of the local buckling modes.
The most severe limitation for non-linear finite element modelling is the dependence on low
level performance standards, which in general means that a significant amount of time may
need to be invested in setting up the models and interpreting the results. However in most
cases the reward is a more cost efficient design.
Isolated columns and beams will be loaded by drag or dynamic pressure loads which are only
important near vents and are often much less than the overpressures. The method of load
calculation is discussed in the context of piping and vessels in sub-clause 5.11.
Other mitigating effects including scale effects, the limitation of reaction loads by secondary
member capacity and the effects of dynamics and plasticity are discussed in this sub-clause.
Finally these effects are discussed in the context of modified code checks in sub-clause 6.10.5
The simplest factor, which affects global primary structure response, is the scale factor or
coherence factor. The following cases are given only as an illustration of the scale effect. The
precise geometry of the target structure and the loading pattern will change these conclusions
and a detailed assessment of these factors should be made depending on the scenario
considered.
Considering the situation of a pressure disturbance travelling along a wall or for a ridge of
pressure travelling across a deck. The pressure disturbance is considered to be a pulse
travelling with a velocity of about 340 m/s (the speed of sound C0 in ambient conditions,
neglecting convection with the gas flow) giving a length scale of the disturbance ld = td x C0 of
about 17 m for a 50 ms pulse. A typical bracing member or panel of length l equal to 8 m will
hence see a peak averaged pressure of 0.75 of the peak. A module wall of length L equal to
35 m will see a peak averaged pressure of 0.25 of the peak value.
This indicates a scale factor of 1/3 on the global load/member load for this situation. In
situations where a large deck is considered these conclusions may only apply locally as the
pressure loading pattern may be circular or irregular in shape.
Often the direction of the loading on the primary framing may be changed locally due to panel
membrane effects. These membrane loads may be balanced globally if panels of similar
dimensions are attached to either side of the columns.
If a member has a td/T ratio of 0.2 for example, and a ductility of unity is required (elastic
response) then the static resistance to load ratio is about 0.6 and the member will resist
(dynamically) a load of 1/0.6 = 1.67 times the member resistance. For elastic response the
dynamic amplification factor for this case is 0.6.
If a ductility of 10 is allowed then the resistance to load ratio is about 0.15 and the member will
resist a load of 6.67 times the member resistance. Hence the ratio of the capacity allowing a
ductility of 10 to the elastic capacity is 6.67/1.67 or a ratio of 4 for structures with a load to
natural period ratio of 0.2.
Values above 4 may be reached for structures with long natural periods (large frame structures
or compliant structures). The allowed ductility will depend on the applicable performance
standards. A ductility level blast performance standard could well allow a ductility level of 10 for
decks and beams.
As an initial screening process, this approach can be used before further checks and analyses
are carried out, particularly if the overpressures are not high, less than 0.5 – 0.6 bar. The
checks can be carried out with some relaxation on the design yield strength which are normally
based on guaranteed minimum values and an allowance for the increase in the yield strength
due to strain rate effects. Allowing for strain rate effects will extend the elastic range and this
needs to be considered in the buckling checks. Also, the forces at the connections will
increase, whose adequacy needs to be considered.
Checking primary structure against the SLB (in the case where the load is 1/3 of the DLB) will
often size the members for the DLB. Experience suggests that the Primary structure will not
experience the full overpressure loading as the loading acts first on secondary members,
barriers, cladding and plate [88,89].
Unity or utilization checks to the appropriate standard (e.g. AISC) may be re-interpreted to
reflect the reserves of strength in the structure.
When compared with a Ductility level analysis this approach often result in a less efficient and
heavier structure. These methods will not be suitable for the analysis of a situation where a fire
has preceded the explosion unless allowance is made for material weakening and geometric
imperfections and permanent deformations resulting from the fire.
Blast resistant structures and their supports are designed to respond in a ductile way to
explosion loading mainly in bending. The shear behaviour of structures at their supports and in
the joints of the primary frame will also affect the utilization factors derived in the code checks.
The safety factors implicit in the code checks will be different from those associated with
bending. Shear strains at supports should generally be limited to the elastic limit.
Additionally, for a dynamic situation these shear forces will be quite different from the values
obtained by static analysis as a result of the inertia forces acting on the structure. The benefits
of this effect are exploited in blast wall design, as the support or reaction loads may be less
than the applied overpressure load. Plastic deformation of a blast wall also has the effect of
limiting the reaction loads on the supports.
For a loading duration near the natural period of the member the shear forces could be higher.
Checks should be made where this is likely using a dynamic amplification factor based on the
ratio of load duration to natural period (see Figure 19).
Code checks may be re-interpreted to take account of the following inherent reserves of
strength, both material and plastic reserves.
1. The explosion event is an accidental event and hence the stress may be allowed to
approach yield. A factor of 1/0.67 (1.5) is then appropriate on the allowable utilization.
Alternatively the yield stress may be enhanced by the same factor to allow for non-
linear relationships for some aspects of utilization factor calculation.
2. The material strain rate effect will generally give an increase of yield stress of the
order of 20 %, this value is used in the nuclear industry [69]. This value may be higher
locally, in particular in high strain regions of a blast panel. A factor of 1.2 may be
applied to the acceptable utilization or to the yield stress.
3. Strain hardening will occur around regions of local plasticity. Where it is appropriate
(for tension members, plastic sections in compression and/or bending) allowance may
be made for this by taking the design yield strength as the ultimate tensile strength
divided by 1.25 (IGNs [1] ).
4. The occurrence of plastic hinging may be taken into account by factoring the
acceptable utilization factor by the ratio of the plastic ‘Zx’ to elastic section modulus
‘Sx’. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The
member must be able to sustain the formation of a plastic hinge before buckling, i.e. in
tension or be a ‘plastic’ section.
As discussed above shear checks should also be made using the correct dynamic reaction
loads with strains being limited to elastic limits.
Taking into account all the factors above gives a possible acceptable utilization factor of 1.5 x
1.20 x 1.25 x 1.1 (a factor of 2.5) for a tension member. Usually the benefit of both strain
hardening and strain rate yield strength enhancement is not taken into account.
The recommended acceptable utilization factor is hence 1.5 x 1.20 x 1.12 = 2.0 for primary
members acting in bending and/or compression under explosion loading so long as the
member does not buckle where local buckling is not acceptable. Buckling checks for members
working beyond the elastic limit are discussed in References [5] and [117]. It is stated in
Reference [117] that semi-compact and compact sections may be designed using code checks
without supplementary local buckling analysis up to the formation of the first hinge.
The above approach assumes a working stress approach is being used for primary framing
design. The limit state approach may also be used with the equivalent elastic load level for the
DLB (the dimensioning explosion load) being derived from consideration of the differing partial
safety factors suitable for the ultimate limit state and elastic limit state. These topics are
discussed in References [89] and [88].
Assessment and design tended to be component oriented, with little understanding of the
interaction of effects between components [122] .
As the understanding grew, through full scale testing, of the actual overpressures realized in an
explosion, so the need to achieve greater resistance or capacity in decks, walls and
connections has grown.
Non-linear and dynamic analyses became commercially viable for even small design houses at
component level using PC based software. Finite element packages enabled single degree of
freedom solutions to be improved, through consideration of support stiffnesses and axial
membrane resistance. Single component assessment could be expanded to the consideration
of panels or complete walls and decks. The influence of penetrations could be addressed and
the detrimental effect of local stiffening on global ductility became evident.
A common misunderstanding in the design of blast walls is the relationship between the design
overpressure and the strength of the wall, interpreted through its stiffness. In the mitigation of
explosion loads, the key consideration is the ability to absorb energy through ductility, and the
delay of peak response to a time where the load has dissipated or reversed. The inclusion of
penetrations and local reinforcement for the support of piping or equipment, will introduce hot
spots in terms of stiffness, which may reduce the explosion resisting capacity of the wall. The
deformation of the wall, when subjected to explosion loading, may also violate the integrity of
any attached pipework or equipment.
In the assessment of explosion resistance of existing platforms, simple linear elastic designs
are often reviewed using non-linear, dynamic techniques to identify additional capacity without
the need for reinforcement. The capacity of a blast wall or deck, in terms of explosion loading,
is limited by its weakest component. This could be the situation where the connection is made
by means of a weld with a 5 % strain limit, as compared to the 15 % strain limit of the parent
material.
In some situations, making a wall more flexible may increase its ultimate capacity to resist
blast. Removing or revising over-stiff details, say by making a heavy column base pinned
rather than fixed, may allow the development of plastic hinges throughout a wall and through
greater overall deformation before key component failures. Later response may exploit the
benefit of the suction phase in the loading.
Many different blast simulations may be required in order to generate a realistic envelope of
responses for specific details. A balance has to be reached between the extent of the model
and the level of detail in order to be cost effective. Inclusion of small details, such as
penetrations and stiffeners, may not influence the global response and thus becomes irrelevant
for a global model. Application of point masses at deck level at primary model nodes may also
be sufficient to achieve an acceptable accuracy for vertical dynamic response. Elevated
masses may be required for significant items of equipment or vessels where rotational effects
may be important and local horizontal loads are present.
Major pipework may need to be modelled if it could influence the dynamic and explosion
response of the structure, particularly if it has been detailed in such a way as to provide an
explosion resistance load path between decks via pipe supports.
Rigid boundaries for panel assessments are not necessarily conservative if the operating
condition deformations are not considered. The sensitivity of the explosion capacity to
deadweight and operating load should be addressed, as should the sensitivity to residual
fabrication deformations and stresses. Welding residual stresses should also be considered in
connection assessment, especially if key components are limited in capacity by the 5 % weld
strain limit. The weld geometry needs to be addressed for ultimate capacity calculations,
especially in fillet welded details, as a considerable portion of the total capacity of a connection
may be absorbed by secondary loads generated by eccentric load paths.
An advantage of global models is the ability to visualise modes of mitigation, which may
otherwise not be apparent when focussing on individual components or panels. Tying long
span decks together to limit the deflection under heave is a means of limiting damage to
equipment and pipework, which would otherwise suffer consequentially from large
displacements. The loading required for design can be extracted from a global dynamic
analysis which incorporates the ties – the ties affecting the dynamics of the deck girders. Care
must be taken in detailing, however, in order to prevent operating loads being transmitted into
the ties.
• Differential pressure
• Differential movement
• Strong vibration
Areas remote from, or physically separated from, the areas with the direct explosion risk should
also be assessed for these actions if there is a potential consequence to personnel safety or
integrity of safety critical systems, including personnel escape provision.
Dynamic pressure loads are discussed in sub-clause 5.11 and are potentially the most severe
design loadings on equipment, vessels, pipework and cable trays.
Differential movements may generate significant loadings where adjacent supports respond in
a differing manner to an explosion. For instance, a vessel will be supported from the deck of a
module, but pipework connected to the vessel may be supported from the roof of the module.
In an explosion, the deck and roof will deflect in opposite directions, imparting loads on the
vessel nozzle, potentially triggering a further hydrocarbon release, which could be catastrophic
in terms of escalation of the event. Similar effects could be seen with pipework connections to
equipment and with pipe branches, or where supports are positioned either side of stiff deck
elements leading to support rotations in opposing directions.
Loose items subjected to blast wind, components that break free of their supports as a
consequence of explosion loading effects, or fragments of equipment or vessels generated by
the break-up of those items in explosions all have the potential to become missiles which can
then impact other equipment, vessels, pipework or critical electrical and control systems. The
potential for loose items to become missiles needs to be controlled by good working practices;
the potential for items to break free and become missiles, or for vessels and pipework to break
apart and become missiles, needs to be controlled by design.
The dynamic response of the vessel or equipment on its support steelwork is fundamental to
the reactions that are generated. Very stiff supports will generate high reactions; flexible
supports will generate lower reactions. Too flexible a support condition may not be tolerable for
operational reasons, or continued integrity during or following an explosion event. Too much
movement may also contribute to vibration modes of failure for connecting pipework.
In most circumstances, the critical explosion loading effect on a vessel will be a lateral loading
or overturning effect on the supports. For the assessment of existing installations, this may be
well above the design loading magnitude, as the design explosion loading would have been on
a par with the accelerations allowed for in the transportation or earthquake scenarios. Under
the higher explosion loadings now prevalent, this may no longer be the case and modification
of the vessel supports may be required. As discussed above, support strengthening may lead
to an increase in the support reaction, so modifications should be carefully assessed. Often a
linear elastic design may be demonstrated to have adequate ultimate capacity if assessed
using non-linear dynamic techniques, with full use of material certificates.
The vessel should be considered rigid in order to develop support reactions, but the uncoupling
of loads onto the deck steelwork needs to be considered in conjunction with the deck loading
from explosion. A simple SDOF solution may not be appropriate, whereas simple NLFEA
would be.
For equipment supported on Anti-Vibration Mounts (AVMs), this could mean retention of lateral
stops or shear keys, which would otherwise be removed after the transport and installation
phase. The deck plating or under-deck bracing must be assessed for adequate resistance to
the lateral explosion loads. Tall equipment (relative to the support footprint) must be assessed
for the possibility of toppling under explosion loading.
A similar approach to the large vessels discussed above can be taken for the support reactions
and the response of the under-deck steelwork.
Differential movement between adjacent supports, whether at a pipe branch or transition from
deck to roof support, or between modules, must be accounted for in considering explosion
loading. It may well be prudent to design the first support from a pipe branch as a structural
fuse, in order to prevent a line from breaching under explosion loading .
Explosion loading assessments should not be restricted solely to oil and gas lines, but must
also include deluge pipework, as being essential for mitigation of potential fires following
explosion.
Pipe runs on FPSOs are designed to accommodate significant movement as a result of vessel
flexing; safety critical pipework on fixed structures, in regions of significant potential movement
when subjected to explosion loading, should have the same considerations.
Given the problems associated with developing a time-domain loading for a complete pipe run,
an appropriate test for robustness would be to consider each pipe span as simply supported
and use either a Biggs SDOF approach or a static load solution in a standard design pipe
stress analysis.
The tension capacity of the piping dominates the response and so a pure plastic resistance
may be assumed for the pipe span considered with the mid point deflection being the relevant
response variable. Plastic hinging soon occurs at each end of the pipe and hence the pipe may
be assumed simply supported.
Consideration of the equilibrium of a length of pipe between supports as a catenary will give a
time history of the tension Tp in the pipe and the extreme deflection of the mid point enables
the plastic strain at each end to be estimated using methods given in the previous sub-clause.
An average plastic strain limit of 5 % and a peak local strain limit of 10 % may be used to
determine failure of the pipe. This failure criterion applies to all reasonable pipe sizes and is
insensitive to pipe diameter.
If the pipe supports are attached to beams of similar section properties then the differential
movement of the deck under an explosion should not be a problem.
If the structure and SCE’s appurtenances have been checked for a Safety level or Ductility
level earthquake loads following API RP 2A 9th Edition (sub-clause 2.3.6e.2) or later then the
‘strong shock’ response to explosions need not be checked.
In the Cullen report[61], it was reported that ‘a number of witnesses spoke of the severe vibration
associated with the initial explosion. People were thrown off chairs and knocked over’.
Once the force is calculated it may be applied to a dynamic global platform structural model [57].
The displacements and accelerations at points on the topsides may then be calculated. These
accelerations are potentially damaging to essential safety systems such as:
One further consequence of shocks of this kind is that pipe runs between modules may be
stressed due to relative displacements between modules. This would be particularly important
for the fire water main.
For a fixed platform the integrity of the substructure should be checked against out of balance
explosion loads.
It is likely that the explosion loads will have a duration in the range of 50 to 100 milliseconds
whereas the substructure will have a sway natural period in the range of 2 to 4 seconds.
For elastic response of the jacket, a dynamic amplification (or reduction) factor may be
calculated from the ratio of load duration td to natural period T or extracted from the curve
given in Figure 20. A reduced equivalent static load may then be derived which can be applied
to the fixed platform computer model.
Typical dynamic reduction factors of the order of 0.05 may apply in which case problems with
the substructure are unlikely. This load case may then be eliminated from consideration, on the
basis that the equivalent static loads on the substructure are smaller than those induced by
waves and currents.
Floating, tethered and moored installations are unlikely to suffer serious response to this form
of loading because the natural period in the horizontal direction is much longer than the load
duration.
Awareness of strong vibration is therefore essential in the design and protection of safety
systems used for emergency shutdown, emergency power, communications, fire protection,
deluge pipework, fire and gas detection, HVAC, EER etc. Systems which some may consider
not to be “Safety Critical” also need to be assessed for strong vibration loading: e.g. grating on
escape routes, stair towers, module stools. Such systems are fundamental to the safe
evacuation of personnel from the facility and strong vibration or blast wind loading may be the
governing design load case.
Control and instrument cabinets in utilities areas, which are protected from the direct influence
of explosion loading, should be assessed for the risk of toppling by strong vibrations. Battery
racks should have a retaining bar across the front of each shelf. Even book shelves in critical
areas such as the Control Room should be assessed for the risk of displaced objects, which
may fall and damage control panels or cause injury to key personnel.
Walkdown is now a commonly used tool to perform a qualitative assessment of the risk of
damage from strong vibration [58] .
2. The difference between guaranteed minimum yield stress values and actual coupon
tests can give rise to a significant increase in reaction force, particularly in strain
concentration regions which will amplify strain rate behaviour.
3. The ductility values given in Table 6.5 are based on 2 dimensional beam models.
However in three dimensional systems tri-axial effects, effects of bending and twisting
in the third dimension are significant and will reduce the available ductility. There are
limited performance criteria in order to assess the reduction in available ductility.
The detail design aims have been identified in this part of the Guidance Document, to enable
co-ordinated best design practice, such that significant changes can be avoided late in the
design process. Detailed guidance will be given in Part 3 of the Guidance Document.
Conflicts between the requirements for different engineering disciplines will be identified, as will
the conflicts between explosion and fire hazard management or mitigation. Some areas will be
covered on a phase by phase basis, others on a discipline by discipline basis, as best suits the
delivery of the discussion and its understanding. The readership is intended to be broad and
the issues understood by all disciplines (engineering, management, verification and
compliance) through all phases of project development, execution and operation.
New build or a new build project essentially starts with a clean sheet of paper and
modification thus has little or no constraints in terms of layout, materials or
structural form. An existing facility modification, by contrast, will have
constraints in terms of viable location, weight, layout, interfaces with
existing plant, power, spares, materials, accessibility and impact
upon the existing Safety Case and HAZOP assessments for the
facility.
Sub-sea or topsides generally the selection process for sub-sea or topsides wellheads is
wellheads related to satellite facilities where processing and main export is
accommodated elsewhere. Explosion hazard is not normally a
primary consideration, as the satellite structure, if selected, would be
a minimum facilities, normally unmanned installation. With sub-sea
wellheads, all fluids would be transferred to the main facility for
processing; with a minimum facilities platform, primary separation
may be included, but the topsides wellheads makes for improved
accessibility for maintenance. Current technology has made the sub-
sea option more viable, especially where the main facility is in close
proximity.
Inventory The gas content of the received fluids is the primary contribution to
the explosion hazard, with the pressure of the flow, coupled with
volume in the case of vessels, being the key parameters in
determining the magnitude of release for a given leak size. The
temperature of the fluids has an influence on the degree of
absorption of gas within the crude oil, but is much less significant in
terms of explosion hazard than pressure. The sweetness of the
crude and the water content are the primary contributors to corrosion
risk, with sand entrainment being the key contributor to erosion.
Separation of process, The process area has the highest risk on the facility, in terms of
drilling, utilities and explosion hazard, as a consequence of the high pressures and the
accommodation number of potential leak sources in the pipework, pressure containing
vessels and machinery. It is normal to distance the gas compression
plant from the separation vessels, where possible, to reduce the
escalation risk for any single event.
Wellbay and drilling These have the next highest risk, due to the amount of flanged
facilities pipework required to connect the trees to the manifold and the
tendency of this pipework to move in concert with the conductors.
The utilities area is much less vulnerable to serious explosion
hazards, but a risk is still present, for example with fuel gas for power
generation.
Regulatory regime Regulations vary in different parts of the world and cognisance is
therefore required of the relevant governing regulations for the
installation location, irrespective of where the design is executed.
Budget, timescale and Best practice may sometimes be compromised by the available
external factors budget and project timescale, whether for new build or modifications
to existing installations. Similarly external factors such as lift vessel
availability may influence or determine the outcome of a particular
decision, resulting in a less than optimum solution. The degree of
compromise should be documented for evidence in hazard review
and project safety audits.
Initial hazard review The initial hazard review can make judgements based on past
experience and advise on the consequences of initial engineering or
management decisions. This review process must be open,
however, to new understanding on explosion loading and response,
as well as to the capabilities of new technology or design methods.
The initial QRA must be based on current generic data for leak and
ignition frequency, or take account of proposed high integrity
solutions which offer better hazard management, in order to be
meaningful and aligned with the design process.
Given the number of competing options available, concept selection is normally achieved by
means of comparative assessments both qualitative and quantitative, based on cost, risk and
timescale.
• New build or modification – a new build project essentially starts with a clean sheet of
paper and thus has little or no constraints in terms of layout, materials or structural form.
An existing facility modification, by contrast, will have constraints in terms of viable
location, weight, layout, interfaces with existing plant, power, spares, materials,
accessibility and impact upon the existing Safety Case and HAZOP assessments for
the facility.
• Sub-sea or topsides wellheads – generally the selection process for sub-sea or topsides
wellheads is related to satellite facilities where processing and main export is
accommodated elsewhere. Explosion hazard is not normally a primary consideration,
as the satellite structure, if selected, would be a minimum facilities, normally unmanned
installation. With sub-sea wellheads, all fluids would be transferred to the main facility
for processing; with a minimum facilities platform, primary separation may be included,
but the topsides wellheads makes for improved accessibility for maintenance. Current
technology has made the sub-sea option more viable, especially where the main facility
is in close proximity.
• Inventory – The gas content of the received fluids is the primary contribution to the
explosion hazard, with the pressure of the flow, coupled with volume in the case of
vessels, being the key parameters in determining the magnitude of release for a given
leak size. The temperature of the fluids has an influence on the degree of absorption
of gas within the crude oil, but is much less significant in terms of explosion hazard than
pressure. The sweetness of the crude and the water content are the primary
contributors to corrosion risk, with sand entrainment being the key contributor to
erosion.
• Separation of process, drilling, utilities and accommodation – The process area has the
highest risk on the facility, in terms of explosion hazard, as a consequence of the high
pressures and the number of potential leak sources in the pipework, pressure
containing vessels and machinery. It is normal to distance the gas compression plant
from the separation vessels, where possible, to reduce the escalation risk for any single
event.
• The wellbay and drilling facilities have the next highest risk, due to the amount of
flanged pipework required to connect the trees to the manifold and the tendency of this
pipework to move in concert with the conductors. The utilities area is much less
vulnerable to serious explosion hazards, but a risk is still present, for example with fuel
gas for power generation.
• Export route – the availability of a convenient nearby pipeline, with available capacity,
may determine whether export of oil is by tanker or pipeline. To date, gas has either
been flared, exported by pipeline, or re-injected into the formation for later export;
excessive flaring is no longer considered to be an option in many parts of the world, due
to environmental considerations. The required pipeline entry pressure will contribute to
the compression requirements for the platform. The degree of gas compression has a
significant influence in the potential for leaks and the resulting gas cloud sizes in the
process area.
• Gas lift - The other factor in determining compression requirements is whether gas or
electrical submersible pumps are used for artificial lift of the oil. The gas lift lines are a
major potential hazard due to them being small bore, high pressure and subject to
vibration due to tree movement. A major hazard is also presented in the loss of
containment of the gas in the well annulus. Switching from gas lift to electrical
submersible pumps is generally not an option on existing installations, due to the
compressor design requiring a minimum throughput to maintain efficiency – for new
installations the electrical submersible pump option is much safer.
• Regulatory regime – Regulations vary in different parts of the world and cognisance is
therefore required of the relevant governing regulations for the installation location,
irrespective of where the design is executed.
• Budget, timescale and external factors – Best practice may sometimes be compromised
by the available budget and project timescale, whether for new build or modifications to
existing installations. Similarly external factors such as lift vessel availability may
influence or determine the outcome of a particular decision, resulting in a less than
optimum solution. The degree of compromise should be documented for evidence in
hazard review and project safety audits.
• Initial hazard review – The initial hazard review can make judgements based on past
experience and advise on the consequences of initial engineering or management
decisions. This review process must be open, however, to new understanding on
explosion loading and response, as well as to the capabilities of new technology or
design methods. The initial QRA must be based on current generic data for leak and
ignition frequency, or take account of proposed high integrity solutions which offer better
hazard management, in order to be meaningful and aligned with the design process.
• pipe-in-pipe risers;
• in-field pipelines;
• sub-sea storage.
Several of these elements affect topsides risks by their vulnerability to dropped object hazards
causing sub-sea leaks. The pipe-in-pipe solution requires the use of vents to control leaks, in
which the construction arrangement inhibits in-service inspection and repair. This arrangement
may be preferable to single skin risers for reasons of insulation to maintain oil temperature.
• separation;
• cooling/heating;
• compression;
• water injection;
• sand entrainment;
• metering;
Water injection is included here as being associated with aquifer water and the pipework
contributing to process area congestion. Sand is primarily a source of vessel and pipework
erosion; water is the primary source of corrosion.
Vessel size is a consideration in terms of the quantity of the topsides inventory and the
potential for fuelling a fire in case of rupture. Vessel size is also crucial in terms of reducing
pressures during blowdown. Smaller vessels may thus be more controllable in emergency
situations, but may be less efficient in operating terms.
The layout stage is important in the provision of adequate inspection and maintenance access,
selection of laydown and storage areas and mechanical handling routes between the laydown
areas and the relevant equipment.
7.2.5 Pipework
The initial pipework sizing and routing follows the layout process. Operational considerations
included here are: provision of fixed and spring supports; valve locations; flange locations to
facilitate installation and maintenance; material selection for robustness (wear control and
corrosion resistance). The key areas for explosion hazard potential are leak sources and the
magnitude of release, generally through mechanical connections but also associated with
corrosion, fatigue, erosion and human error.
• area congestion;
Local or remote control is significant in terms of manning levels within hazardous areas. The
Control Room layout is critical in terms of the potential for human error in crisis management –
information overload is now recognised as a cause of delay in response times.
Cabinets in hazardous areas need to be robust to withstand explosion loading and prevent
missile penetration. Instruments and controls (valve wheels, handles, switches etc) need to be
accessible to minimise or eliminate the need for scaffolding or other temporary access, hence
reducing congestion, vent paths and potential missile material. A review of potential
standardisation of components is likely to lead to reduced human error.
The durability of components and software should be an important design consideration, along
with the potential for upgrade or expansion to accommodate future platform modifications. The
mixing of system types or overloading of components can lead to increased explosion risk.
The same influences and design requirements apply to general pipework, but both the
blowdown and isolation systems require a very high integrity, reliability and survivability in order
to function safely. These systems can involve a large number of flanged connections and
isolation systems are associated with components that are regularly subjected to manual
intervention.
An area of potentially poor design that has become apparent recently is that onshore refinery
based design codes for blowdown systems [49] are based on fire loads which are too low for the
offshore industry [123] . These codes do not take account of the stress distribution in the vessels
and the strength of the vessel steel is reduced faster than is applied in the codes, as a result of
the higher heat load that would be typical. The vessel integrity may thus be compromised
before the blowdown is achieved.
Reference [60] is a good starting point on this topic, although work is continuing at the time of
writing.
Reviews of blowdown system efficiency are also now considering sequenced blowdown as a
means of improving overall response time. Such reviews need to assess manual versus
automatic or semi-automatic shutdown of systems on high-level gas detection.
Considerations for reliability and robustness of systems include the use of double isolation
valves, high integrity seals, the attachment of small bore bleed pipework in double block and
bleed isolations and the selection of appropriate pressure relief valve devices.
Some operators have experienced a number of failures of bellows in balanced bellows type
relief valves [124] . An impaired pressure relief valve may fail to prevent an explosion or lead to
a sudden large toxic gas release in the event of rapid escalation of fire. Bellows failure may be
caused by valve chattering, incorrect material specification or pressure rating, incorrect
installation, incorrectly specified fatigue life or incorrect dimensional tolerances on the valve
seat and bellows manufacture.
Utility systems include: firewater deluge; seawater cooling; diesel and potable water tankage;
chemical storage; HVAC.
The design and routing of deluge mains is of primary importance in ensuring a robust system
capable of withstanding the Strength Level Blast and providing continued deluge coverage
outside the affected area in a Ductility Level Blast.
7.2.10 Layout
The equipment layout is usually based on good past experience and an awareness of design
details that can lead to problems with poor ventilation, congested explosion venting, blast wind
turbulence and high explosion overpressures. The finished layout may then be validated by
CFD modelling.
The main layout considerations are: process economics; accessibility; pipework protection;
ventilation; congestion; escape routes; trip hazards; mechanical handling provision; storage;
maintenance access; growth provision; HVAC; cable trays; pipe racks; lighting;
communications.
The primary structural steelwork will often have been sized for other load considerations
(operating loads, installation or environmental) but blast walls will be sized for these blast
loads.
Topsides structural and architectural design includes the following considerations: modules and
module stools; integrated decks; blast walls, wind walls and fire walls; floors, equipment
supports and pipe supports; stairways and escape routes; bridges and bridge supports; lifeboat
and liferaft supports; doors and windows; passive fire protection (PFP); lift points; tall structures
– drilling derrick, cranes and masts; living quarters (LQ) and temporary refuge (TR); Control
Room and Workshops; Helideck; fabric maintenance and inspection; growth provision;
decommissioning.
In the design of architectural features such as doors and windows in the LQ, whose failure
could lead to TR impairment, it is important to consider the negative pressure impulse
immediately following the initial high positive pressure impulse. The ability of doors and
windows to resist outward loading is generally much lower than that of inward loading due to
the construction details and assembly method.
• Spars
• TLPs
Some fixed steel platforms have diesel tanks in the legs close to the topsides; FPSOs have
storage tanks beneath the process modules; jack-up production facilities will have diesel tanks
in the side double skin or crane pedestal. Subsea oil storage is not considered to be an
explosion risk, however, such tanks will require vent pipework to control gas build-up and allow
tank purging.
Conductor and riser support is important in the control of flowline vibration topsides. Such
vibration can have a significant impact on attached small bore pipework fatigue, particularly
with gas and chemical injection pipework. The provision of pre-installed risers and J-tubes for
future satellite development can significantly reduce the explosion hazard associated with
construction activities on the topsides.
A robust sub-structure design will significantly reduce the explosion risk associated with strong
lateral vibration resulting from major boat impact hazards. Structural redundancy will ensure
adequate support to the topsides in the case of a surface pool fire, ensuring that gross
deformation of the topsides does not result, leading to secondary releases and explosion risk.
A comparative exercise is required to document the pros and cons of one or more of the
options, equating cost, risk savings, timescale, practicability etc. For modifications to existing
installations factors such as lack of bed space and production downtime for modifications are
significant factors in the calculation.
The balance is thus drawn between the cost of lost production and the increased hazard
presented by more pipe flanges. If high integrity flanges are used, where the flange class
ratings are higher than required for the design pressure rating of the pipe, then the system
ductility will be tolerant of explosion loading and brittle modes of failure and flange leakage will
not result. With all piping systems the location of flanged joints must be considered in
conjunction with the selection of support locations, to avoid joints being placed at locations
where high ductility is required.
Nitrogen leak testing is recommended for all hydrocarbon pipework following new construction
and maintenance. Leaks can often be detected in existing pipework following a shutdown,
even where no intervention had occurred, as a consequence of joint relaxation upon cooling or
accidental mechanical impact.
The need for detailed dimensional surveys for pipework tie-ins at the hook-up stage is
demonstrated time after time. Reliance on “as-built” drawings has caused many project delays,
whereas a single visit offshore to confirm the accuracy of the recorded data would have
ensured a better fit-up and eliminated clashes with items not included on the referenced
drawing. The use of PDMS (Plant Design Management System), which integrates data from all
disciplines in a 3-D model, has vastly improved clash control, but as-built models are still rare.
The consequences of being ill-prepared at hook-up, in terms of explosion hazard, are that
piping joints are cold-stressed and on-site fit-up rectification is required for pipework or
structures, that may involve hot work.
This sub-clause outlines briefly the considerations used to arrive at a best practice design.
These considerations are constantly changing as new technologies and new explosion
behaviour or response information becomes available. Detailed guidance will be contained in
Part 3 of the Guidance Document.
Design has a big influence on the prevention of ignition. Hot surfaces, electrical equipment,
lights, and equipment earths are all fixed ignition sources that need to be designed or selected
with recognition of the potential explosion hazard. Selection of a higher specification, different
location or gas tight enclosure will reduce the ignition risk. Temporary ignition sources, such as
hot work or poorly earthed scaffolding or equipment, need to be eliminated or controlled, by
design and operating procedures. The need for a calm weather policy should be considered.
External ignition sources, such as ship exhausts, helicopters and lifeboat engines, also need to
be considered in the design process.
The subject matter in this category is very broad and needs to be addressed by simple, generic
guidance in this Part 1 document, with detailed assessment being performed in accordance
with Part 3 of the Guidance. Several of the measures are procedural, especially in the area of
missile limitation. The design based issues, whether for new or existing installations, can
involve multi-discipline aspects, not just structural. Blast wall performance can be
compromised by the need for pipe transits, cable conduits and access manways. Capacity is
not necessarily related to stiffness but to ductility.
Connection capacities can be more critical than span capacity. Increased capacity in existing
systems can often be demonstrated through the use of non-linear analysis, where simple
elastic methods were used in design – the strain limitations of the welded connections may be
the limiting factor. Mechanical strengthening may have to be achieved through cold work
solutions, if platform shutdowns are to be avoided.
Complex loading situations need to be considered on space frame systems, with understanding
of the real collapse and failure mechanisms, where computer modelling may only represent
idealised post-yield and joint behaviour.
Equally important, the initial failure in the system may not represent the ultimate capacity, as
the failed component may be redundant. The consequence of component failures within the
collapse sequence must be appreciated. A weld failure along the edge of a blast wall may
enable release of gas or flame into a previous safe area, with a potential tunnelling failure
resulting. In other instances, say within a double skin wall, there may be no significant
consequence from first failure.
Corrugated profiles are commonly constructed from stainless steel due to its high energy
absorption characteristics and good corrosion resistance. Typical failure strains for ASTM 316
stainless steel are in excess of 50 % with ultimate capacities in the region of 600 N/mm2. Pre-
Piper Alpha, firewalls were used in situations where explosions were a possibility. However
these were not initially designed for the blast loads and many were constructed from mild steel.
The walls typically span from floor to ceiling and are normally provided by specialist blast wall
suppliers. The height of wall that can be provided varies between 3 and 8 metres and
thicknesses are typically from 6 mm to 12 mm.
The behaviour of the wall is very much controlled by the web and flange slenderness limits, the
column slenderness of the wall, the flange to web ratio, corrugation angle and the end
connection details. It is important to be aware of the interdependence of some of the controlling
parameters such as the angle of corrugation which will control the degree of restraint to the
flange. Also the web/flange ratio plays a crucial role in controlling buckling of the section.
Previous research [125] on profiled flooring systems suggests a maximum value of 1.5, although
limited profiles were given which may not be appropriate for blast walls.
A guide issued by FABIG, Technical Note 5 [6] provides guidance for web and flange
slenderness limits based on stub girder tests in order to classify the section. In traditional static
design of typical universal beam members in bending, codes give slenderness limits for web
and flange elements independently despite the fact that one provides restraint to the other.
Extensive validation work has been carried out to ensure designs are conservative based on
this specification with an effective width concept adopted to account for the actual stress state.
With profiled sections under blast loads there is little published data to provide the same extent
of validation for using these results. Also the web in this case is loaded by the pressure
providing a destabilising load. It should also be noted that Reference [6] provides guidance on
the selection and design of profiled barriers. However, this deals with design criteria for
predominantly elastic wall profiles and recommends the use of NLFEA to provide performance
standards for ductility factors greater than 1.5 for plastic sections.
It is important to be aware of the change in behaviour of the wall with increasing depth. For
relatively shallow profiles the corrugations can open up under a blast pressure load allowing
some of the energy of the explosion to be absorbed by the deflection of the wall. This also has
the effect of reducing the forces applied at the supports. If a deeper wall is adopted which is
very stiff, then little of the blast energy will be absorbed via bending deflections. This will attract
high shear forces which will impose large forces at the connections and could induce buckling
of the cross section. Buckling issues need to be carefully checked for deep troughed walls.
Double skin profiled systems have also been adopted recently where the skins were separated
by an air gap with the same profile used for both layers to allow for a blast occurring from either
side. The concept being that one of the skins becomes sacrificial while the gap increases the
standoff from the explosion and impacts the second skin. The wall is designed to be flexible to
allow much of the energy to be dissipated in bending.
Stiffened panel blast walls consist of a flat plate stiffened by a series of vertical and horizontal
stiffeners and is supported by the main steel structure. For integrated decks the stiffeners are
continuous and are required to carry large service loading. As a result, they are likely to be
closed hat type sections. Although plates can resist high loads through membrane action, this
will be transferred to the main structure as an axial force and requires careful consideration,
particularly if the deck is carrying high service loading. Many stiffened panel walls have
connection details which minimise the transfer of high axial forces to the main structure for this
reason.
Where there is a need to assess the capacity of module walls and columns with in-plane loads
the effects of static loads need to be considered on the response of structural members:
Support details for any blast barrier are crucial to ensure that the integrity of the wall is not
breached during an explosion and must be detailed such that they are not the weak link. Walls
are normally attached at their top edge to the flanges of primary beams, normally allowing
rotations to occur such that large membrane forces are not developed. It is important to ensure
that any stress concentrations, which may not always be avoided, occur in the components of
the connection rather than the weld itself. The connection must be sized to transfer the
computed reactions and to assure that any plastic hinges can be maintained in the assumed
locations. They should be designed for a capacity that is greater than its supported member.
The bottom of the wall is commonly welded to a channel or angle section attached to the top of
the deck in order to allow for rotation to occur. In some cases the wall is welded directly onto
the deck which has no rotational flexibility, relying totally on the top connection for this.
Results from a recent JIP, which investigated tests on firewalls carried out at the Spadeadam
test site, together with numerical studies, have shown that flexible angle connections arranged
in a dog-leg configuration performed well in terms of energy absorption capability [6].
In situations where walls have limited clearance strengthening schemes which considerably
stiffen the wall have been adopted. Yasseri [126] has discussed a number of these, including
adding a facing plate (flat or corrugated) to the wall or the addition of an X-bracing or stiffening
in the form of a light grillage welded to the wall. However limiting the deflection of the wall
means less energy of the blast will be absorbed in bending which will attract high shear forces
at the connections. Stiffer walls also tend to exhibit more brittle failure modes.
Ideally no penetrations should be allowed in the wall as these are likely to reduce the available
ductility under blast loading. However, if they are required they should be located at the top or
bottom of the wall, or other locations where deflections will be a minimum.
For existing installations the problem is likely to be more complex, as there are likely to be
many penetrations including doors in some instances. These need special attention particularly
in relation to any likely stiffening which can introduce undesirable stiff areas which attract high
loads.
In addition to the above considerations, it is also necessary to define whether the service
moves with the wall or not. For instance, a large pipe can be regarded as a fixed object and the
wall must move relative to it. However, a cable has a degree of flexibility, and providing
adequate extension is available, can be anchored to the wall.
It has been suggested that internal ties, which restrict the differential movements between the
floor and the ceiling, may be incorporated into the design to enhance its blast resistance. The
ties must be designed so that do not carry any compressive loading occurring as a result of
operational loading or the explosion rebound of the deck structures. In order reduce local
loading effects the ties should preferably link the stiffer members of the deck structures.
In designing modifications to existing installations, the designer can assist with the continuation
of existing safe working practices and safety records by using the same equipment and
material specifications as are prevalent, in addition to consistent sparing philosophies and tool
sizes as are in use for that installation.
Operating procedures should recognise the explosion hazards associated with the misuse or
poor maintenance of equipment. Rigorous testing procedures should prevail to ensure that any
intervention activities with pressurised hydrocarbon systems are executed only after
depressurisation and purging is confirmed. Following reinstatement of systems, nitrogen leak
testing is recommended to confirm joint integrity.
Inspection and maintenance procedures should be regularly reviewed to assure that best
current practices are considered, whilst retaining the intended operating philosophy and design
parameters. Inspection methods should recognise the function and performance of insulation
or fire protection systems and ensure that the performance is not compromised by removal of
such systems in order to gain inspection access.
These directives have been adopted by the European Union (EU) to facilitate free trade in the
EU by aligning the technical and legal requirements in the Member States for products
intended for use in potentially explosive atmospheres.
A UKOOA guideline [115] is in preparation that covers the lifecycle activities of bolted pipe joints,
including the critical aspects of system design, construction, maintenance and operation. It will
set out the principles of joint integrity management and provide examples of best practice to
assist operators in develop their own management systems. Training and competency are
significant contributors to successful safe operating practices and demonstrate that good
design alone is not sufficient where manual intervention is required with hydrocarbon systems.
The recently published “Guidelines for the Management, Design, Installation and Maintenance
of Small Bore Tubing Systems” [127]) records that "small bore tubing systems are the single
largest contributor to the incidence of process containment rupture in potentially hazardous
plants". As such, the adoption of these guidelines go some way to assuring the integrity of
tubing systems under operational loading, such as vibration, and should be adopted as a basis
for good practice for resistance to accidental loads, such as mechanical impact, which are a
further cause of releases.
8 REFERENCES
[1] Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., ‘Interim Guidance Notes for
the Design and Protection of Topside Structures Against Explosion and Fire’, Steel
Construction Institute Document SCI-P-112/487, January 1992.
[2] FABIG Technical note 1, ‘Technical note on Fire resistant design of offshore
structures', SCI 1993.
[3] FABIG Technical note 2, ‘Technical note on Explosion mitigation systems’, SCI 1994.
[4] FABIG Technical note 3, ‘Use of ultimate strength techniques for fire resistant design
of offshore structures’, SCI 1995.
[5] FABIG Technical note 4, ‘Explosion resistant design of offshore structures’, SCI 1996
[6] FABIG Technical note 5, ‘Design guide for stainless steel blast walls’, June 1999.
[7] FABIG Technical note 6, ‘Design Guide for Steel at Elevated Temperatures and High
Strain Rates’, SCI 2001
[8] FABIG Technical note 7, ‘Simplified methods for analysis of response to dynamic
loading’, 2002.
[9] Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2,
Final Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998
[10] Johnson D.M., Cleaver R.P., ‘Gas explosions in offshore modules following realistic
releases (Phase 3B) – Final summary report’, Advantica report R4853, February 2002.
[11] Pappas J., The NORSOK Procedure on Probabilistic Explosion Simulation, Paper
5.5.1, ERA Conference, ‘Major Hazards Offshore’, London 27-28 November 2001,
ERA Report 2001-0575.
[12] NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013.
[13] Design of Offshore Facilities to Resist Gas Explosion Hazard, Engineering Handbook,
Ed. Czujko J., CorrOcean 2001.
[14] ‘Industry Guidelines on a framework for risk related decision support’, UKOOA, Issue
3, February 1999.
[15] Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 103, Explosion hazards philosophy’, Genesis Oil and
Gas Consultants, August 2002
[16] Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 104, Management of explosion hazards’, Genesis Oil
and Gas Consultants, August 2002.
[17] Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 107, Interactions with fire hazard management’, Genesis
Oil and Gas Consultants, August 2002.
[18] Fairlie G., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 105, Derivation of explosion loadings – method support
dossier’, Century Dynamics Ltd., August 2002
[19] Warwick A., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 105, Preparation of updated guidance for fire and
explosion hazards – Derivation of explosion loadings’, W.S. Atkins Inc., August 2002
[20] Louca L.A., Friis J. and Carney S.J., ‘Updated Guidance for fire and explosion hazards
– Part 1 Avoidance and mitigation of explosions, CTR 106, Response to explosions’,
IC Consultants and Aker Kværner, August 2002
[21] Carney S.J., Gall D., Louca L.A., Friis J., ‘Updated Guidance for fire and explosion
hazards – Part 1 Avoidance and mitigation of explosions, CTR 108, Guidance on
detailed design’, Aker Kværner, IC Consultants, August 2002.
[22] ‘Explosion assessment guidelines’, Genesis oil and gas consultants, report J6838 for
the HSE June 2001.
[23] ‘Hydrocarbon release reduction campaign’, HSE books, HSE OSD report OTO 2001
055, HMSO 2001.
[26] ‘Offshore Accident and Incident Statistics Report 1998’, OTO 98: 952, HSE, HMSO,
1998.
[27] ‘Accident statistics for fixed offshore units on the UK continental shelf 1991–1999’,
DnV for the HSE, OTO 2002 012, HMSO 2002.
[29] ‘Offshore Installations (Prevention of Fire and Explosion and Emergency Response)
Regulations’ (PFEER), HMSO, 1995
[31] ‘Offshore Installations and Wells (Design and Construction, etc.) Regulations’ (DCR),
HMSO 1996.
[32] ‘Assessment principles for offshore safety cases’ (APOSC), HSE Books, HSG181,
ISBN 0 7176 1238 4, HMSO 1998.
[33] ‘The offshore installations and pipeline works (Management and Administration)
Regulations, HMSO, (SI 1995/738), (MAR)
[34] ‘Petroleum and natural gas industries – Control and mitigation of fires and explosions
on offshore production installations – Requirements and guidelines’, 1st Edition. 1999,
ISO 13702.
[35] ‘Area Classification Code for Petroleum Installations’, Institute of Petroleum. March
1990. (IP 15)
[36] ‘Electrical apparatus for explosive gas atmospheres Part 10. Classification of
hazardous areas’, BS EN 60079-10.
[38] ‘Code of practice for control of undesirable static electricity’, BS 5958 : 1991.
[39] ‘JIP – Gas build up from high pressure natural gas releases in naturally ventilated
offshore modules – Workbook on gas accumulation in a confined and congested area’,
BP Amoco, CERC, BG Technology, May 2000.
[40] Policy and Guidance on reducing risks to ALARP in Design, HSE web site
http://www.hse.gov.uk/dst/alarp1.htm
[41] Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have
Reduced Risk as Low as Reasonably Practicable.
http://www.hse.gov.uk/hid/spc/perm12.htm
[42] ‘Reducing risks protecting people, HSE’s decision making process’ (R2P2), ISBN 0
7176 2151 0, HMSO 2001. http://www.hse.gov.uk/dst/r2p2.pdf .
[43] ‘Control of Risks at Gas Turbines Used for Power Generation’, Guidance Note PM84
HSE.
[44] Alderman J.A., Carter D., ‘White paper – working group 1 – Philosophy and
management strategy’, International workshop ‘Fire and blast considerations in the
future design of offshore facilities’, June 2002, Houston Texas.
http://www.fireandblast2002.com
[45] ‘A Review of Potential Ignition Sources on Offshore Platforms’, HSL Report, FS 99/09.
[46] ‘Successful health and safety management’, HSE books HS(G) 65, 1991.
[47] ‘Recommended Practice for the planning, Designing and Construction Fixed Offshore
Platforms – Working Stress Design’, API RP 2A-WSD, 21st Edition. API (American
Petroleum Institute).
[48] Wishart J. et. Al., ‘White paper – working group 2 – Safe design practice’,
International workshop ‘Fire and blast considerations in the future design of offshore
facilities’, June 2002, Houston Texas. http://www.fireandblast2002.com
[49] API Recommended Practice 521, ‘Guide for Pressure-Relieving and Depressuring
Systems’, 4th Edition, March 1997.
[50] Evans J.A., Johnson D.M. and Lowesmith B., ‘Explosions in full scale offshore module
geometries – Main report’, (Phase 3A) HSE books OTO 1999 043, 1999.
[51] ‘Electrostatic hazards associated with water deluge and explosion suppression
systems offshore’, HSE books, OTO 95 026, 1995.
[55] ‘Control of risks at gas turbines used for power generation’, HSE Guidance note
PM84.
[56] Tahan, N., Nicholson, R.W, Walker S. and Tandberg, D. ‘The Design and Testing of a
Louvered Blast Relief System’, 3rd Intl. Conference and Exhibition – Offshore
Structures Design – Hazards and Safety Engineering, London, 15 – 16 November
1994.
[57] Walker S and Klair M, 'The Escalation Consequences of Accidental Shock Loads', 3rd
Intl. Conference and Exhibition – Offshore Structures Design – Hazards and Safety
Engineering, London, 15 – 16 November 1994.
[58] Morrison G., ‘Strong Vibration and Design for Robustness’ HSE – ERA Conference
Offshore Structural Design – Hazards, Safety and Engineering, November 1994.
[59] Tam, V.H.Y.. ‘Barrier Methods for Gas Explosion Control, Safety on Offshore
Installations’, ERA Report, 99-0808, December 1999
[60] ‘Review of the response of pressurised process vessels and equipment to fire attack’,
HSE, OTO 200 051.
[61] ‘The Public Enquiry into the Piper Alpha Disaster’, Cullen The Honourable Lord,
HMSO, London, 1990.
[62] ‘Fire and Explosion Aspects of FPSOs’, FABIG Technical Meeting Notes, SCI, May
1997.
[63] ‘Explosion Resistance of Passive Fire Protection’, International Coatings Ltd. Report
TN006.
[64] ‘Blast and fire engineering project for topside structures’, Report FR6 ‘Fire
performance of explosion damaged structural and containment steelwork’, 1991.
[65] ‘The effectiveness of area water deluge in mitigating offshore fires’, FABIG Technical
meeting review.
[66] Gregory J., ‘Early design blast analysis’, RISX Ltd. Report RISX/12-01-01/01,
November 1998.
[67] Lea C. J., Ledin H. S., ‘A Review of the State-of-the-art in Gas Explosion Modelling’,
Health and Safety Laboratory Report CM/00/04, 19 February 2002
[68] Marsano S, Bowen P.J., O’Doherty T. ‘Modelling the Internal/External Interaction from
Vented Explosions, 13th Australasian Fluid Mechanics Conference, Melbourne,
Australia, 13-18 December, 1998.
[69] ‘Structural Analysis and Design of Nuclear Plant Facilities’, ASCE 58, 1980.
[71] Walker S., Corr R. B., Tam V.H.Y., ‘Guidance for the protection of Offshore Structures
against Fires and Explosions’, BP Corporation, Document Reference CH152R002 API
Draft 0, September 2001.
[72] Cleaver R P, Humphreys C. E., Robinson C. G., ‘Accidental generation of gas clouds
on offshore process installations’, J. Loss Prev. Process Ind., 7, pp 273-280, 1994
[76] E&P Forum, ‘Hydrocarbon Leak and Ignition Database’, May 1992
[78] Bray K.N.C., ‘Studies of the turbulent burning velocity’, Proc. Roy. Soc. London. A
1990 431, pp315-335..
[79] Harris R.J., ‘The investigation and control of gas explosions in building and heating
plant’, ISBN 0 419 13220 1, E&FN Spon Ltd., 1983.
[82] Shearer M J, Tam V Y H, Corr R.B, ’ Analysis of results from large scale hydrocarbon
gas explosions’, J. Loss Prev. Process Ind. 13, 167-173, 2000
[84] Det norske Veritas, ‘Offshore Standard DNV-OS-A101, Safety Principals and
Arrangements’, January 2001
[87] ‘Acts, Regulations and Provisions for the Petroleum Activity’, Volume 2, NPD,
December 1992.
[88] Yasseri S.F., An Approximate Method for Blast Resistant Design, Paper R429, FABIG
Newsletter January 2002, SCI publication.
[89] Walker S., Corr R.B.., Tam V.H.Y.., Bucknell J. and O’Connor P., Simplified
Approaches to Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, ‘Major
Hazards Offshore’, London 27-28 November 2001, ERA Report 2001-0575.
[90] Yasseri S.F., ‘Target explosion loads for offshore installations – strength level and
ductility level events’, FABIG newsletter, October 2002.
[91] Lund J K, ‘COSAC, The Tool for Efficient Hazard Identification and Risk Assessment
in the early phase of a field development’, ERA Major Hazards Offshore Conference,
London, November 2000.
[94] Mood, M.A., Graybill, R.A., Boes, D.C. ‘Introduction to the theory of statistics’, 3rd
Edition, McGraw-Hill, 1974.
[95] Vinnem J.E., ‘Blast load frequency distribution assessment of historical frequencies in
the North Sea’, Preventor report 19816-04, November 1998.
[96] Corr R B, Tam V Y H, Snell R O, Frieze P A, ‘Development of the limit state approach
for the design of offshore platforms’ ERA Conference, London, 1999.
[97] Corr R.B. and Tam V.H.Y., ‘Gas explosion drag loads in offshore installations’, Journal
of Loss Prevention in the process industries, 11 (1998) 43-48.
[98] Walker S and Haworth M.W.,’ Sensitivity of response of topside structures to fires and
explosions’, HSE OTO 97 043, 1996.
[99] ‘A Guide to the offshore installations (Safety Case) regulations 1992’, HSE L39,
HMSO 1992.(ACOP)
[100] Catlin C.A. et al. ‘The blast loading imparted to a cylinder by venting of a confined
explosion’, ERA Conference, Offshore structural design against extreme loads,
London, 3-4 November 1993.
[104] ‘Blast and fire engineering project for topside structures’, BRI, ‘The effects of
simplifications of the explosion pressure-time history. Second impression’, 1991.
[105] ‘Blast and fire engineering project for topside structures’, Report BR4, OTI:602 ‘The
effects of high strain rates on material properties’, 1991
[106] ‘Blast and fire engineering project for topside structures’, Report FR1, OTI:604
‘Experimental data relating to the performance of steel components at elevated
temperatures’, 1991
[107] ‘Blast and fire engineering project for topside structures’, Report FR2, OTI:605
‘Methodologies and available tools for the design/analysis of steel components at
elevated temperatures’, 1991.
[108] BS EN 10225: 2001 ‘Weldable structural steel for fixed offshore structures – Technical
delivery conditions’.
[109] Jones, N. and Birch, R.S. ‘Elevated Temperature and High Strain Rate Properties of
Offshore Steels’, The Steel Construction Institute. OTO Report 2001/020
[112] Earthquake Resistant Design for Engineers and Architects – Dowrick, D. J. – 2nd
Edition, Wiley, 1987.
[114] BS 6399 – Part 1, ‘Loading for Buildings – Code of Practice for Dead and Imposed
Loads’.
[115] Guidelines for The Management of Integrity of Bolted Pipe Joints, Jan 2002, UKOOA.
[116] Walker S, Corr BR, Tam VHY, O’Connor PA, Bucknell J, ‘New guidance on fire and
explosion engineering’, paper OMAE02-28623, OMAE 2002, June 23-28, Oslo,
Norway.
[117] Kato B., ‘Rotation capacity of steel members subject to local buckling’, Proc. 9th World
Conference on Earthquake Engineering, Japan 1989.
[119] ‘Bulletin on design of flat plate structures’, API Bulletin 2V (BUL 2V) 1st Edition., May 1
1987.
[120] Taylor P.H., Stewart G., Harwood R.G., ‘Blast wall strength estimated using finite
displacement theory’, OMAE98-1423, 17th conference on Offshore Mechanics and
Arctic Engineering, 1998.
[121] Izzuddin, B., ‘Simplified Methods for Dynamic Response Analysis’. – FABIG Technical
Meeting, January, 2002.
[122] Louca, L. A., Punjani, M. and Harding, J. E., ‘Non-Linear Analysis of Blast walls and
Stiffened Panels Subjected to Hydrocarbon Explosions’ – J. Constructional Res. Vol.
37, No.2, pp. 93-113, 1996.
[123] Medonos S. and Berge Dr. G., ‘Why API Recommended Practice may Lead to Unsafe
Design of Pressurised Systems’. ERA Major Hazards Offshore Conference Nov.
2001.
[124] HSE Offshore Division Safety Notice 2/2002 May 2002 “Balanced bellows pressure
relief valves – problems arising from modification of the bonnet vent”.
[125] Rockey, K.C. and Evans, H.R., ‘The Behaviour of Corrugated Flooring Systems, Thin
Walled Structures’, Crosby Lockwood, 1967
[126] Yasseri, S.F., ‘Fire and Blast Information Group Newsletter, Retrofitting of Blast walls
for Offshore Structures’. Issue No.15, 1996.
[127] Guidelines for the Management, Design, Installation and Maintenance of Small Bore
Tubing Systems, Institute of Petroleum, June 2000.
APPENDIX A – ACRONYMS
Accidental event (AE) Event or chain of events that may cause loss of life, or damage
to health, the environment or assets
Active Fire Protection A fire protection method that requires activation – switching on,
directing, injection or expulsion – in order to combat smoke,
flames or thermal loadings.
Artificial ventilation That ventilation which is not supplied from the action of the
environmental wind alone
As low as reasonably ALARP expresses that the risk level is reduced (through a
practicable (ALARP) documented and systematic process) so far that no further cost
effective measure is identified. The requirement to establish a
cost effective solution implies that risk reduction is implemented
until the cost of further risk reduction is grossly disproportional to
the risk reducing effect.
Auto-Ignition Temperature The minimum temperature of a vapour and air mixture at which
it is marginally self igniting.
Average Individual Risk (AIR) The average chance of any individual in a defined population
sustaining a given level of harm from incidents which are
considered to be limited to that population. (Sometimes called
Individual Risk – IR)
Blast Relief Panel Parts of a module wall, ceiling or roof which are designed to
increase the area of venting in an explosion by being opened or
removed by the force of the explosion.
Blast Wall A structural division which has been designed expressly for the
purpose of resisting blast loads.
Blockage Factor The fraction of an area which does not provide open venting or
free passage for a flame.
Blow-out (ignited) A form of jet resulting from ignition of a high pressure flow of oil
and/or gas issuing from an uncontrolled well, possibly with a
substantial fallout of heavy fractions which may also ignite on or
around the platform as pool fires.
Boiling liquid expanding The sudden rupture due to fire impingement of a vessel system
vapour explosion (BLEVE) containing liquefied flammable gas under pressure. The
pressure burst and the flashing of the liquid to vapour creates - a
blast wave and potential missile damage, and immediate ignition
of the expanding fuel-air mixture leads to intense combustion
creating a fireball
Burning Velocity The rate at which the flame consumes the unburnt gas/vapour.
Also the velocity of the flame relative to the unburnt gas/vapour.
Caisson A vertically aligned pipe, running from the module deck to a sub
sea level, forming a service line for seawater suction or
sewage/drilling disposal.
Cellulosic Fire A fire with a fuel source predominantly of cellulose (e.g. timber,
paper, cotton). A fire involving these materials is relatively slow
growing, although its intensity may ultimately reach or exceed
that of a hydrocarbon fire.
Common Mode Failure The failure of components from the same cause
Convection (Heat) Heat transfer associated with fluid movement around a heated
body; warmer, less dense fluid rises and is replaced by cooler,
more dense fluid.
Cost Benefit Analysis (CBA) A quantitative technique to assess the overall value of a
proposal taking into account its likely benefits and detriments.
Criticality (of SCEs) Defined by the criticality classes 1 (highest) to 3 (lowest) with
respect to the explosion hazard and the consequences of
failure. In particular the impact on the TR, EER systems and
associated supporting structure.
Design accidental event An accidental event for which SCEs on the installation should
perform their function as designed.
Design basis checks Design basis checks consist of checking the basis of the existing
design for the installation and determining if the methods used
for the design are acceptable in the context of the explosion
hazard.
Design explosion loads Explosion loads used for design. SCEs must be designed to
resist these load levels within the constraints of the associated
element specific performance standards.
Detonation Limits The range of fuel-air ratios through which detonations can
propagate.
Diffracted Wave That component of the blast wave which propagates into the
sheltered region behind the structure.
Dimensioning accidental AEs that serve as the basis for layout, dimensioning and use of
event (DAE) installations and the activity at large, in order Ito meet the
defined RAC.
Dimensioning accidental load Load (action) that is sufficient in order to meet the risk
(DAL) acceptance criteria.
Dimensioning explosion Explosion loads which are of such a magnitude that when
loads applied to a simple elastic analysis model, the code check
results in members dimensioned to resist the ductility level
explosion.
Drag Coefficient An empirical multiplying constant used to relate the drag load on
a structure to the stagnation overpressure.
Drag force The drag load on a small obstacle due to the movement of gas
past a small obstacle less than 0.3 m in the direction of flow,
form drag – Presented Area x Pdrag.
Ductility level blast (DLB) Representative peak overpressure used in design (10-4 to 10-5
p.a. frequency level) – Pduct.
Ductility Ratio The ratio of the peak deflection to the deflection at first effective
yield.
Ductility ratio The ratio of the maximum displacement of the element to the
deflection required to cause first yield at the extreme fibres.
Duty Holder The organisation, or company responsible for the safety of the
installation or its design under UK legislation.
Dynamic pressure Representative peak out of balance loads over target area,
includes drag, pressure difference and gas acceleration effects.
Used for calculation of loads on equipment and piping – Pdyn,
sometimes referred to as dynamic overpressure.
Emergency Shutdown Valve A valve mounted in a pipeline, pipe or marine riser specifically
(ESDV) for the purpose of cutting of the supply of its normal contents in
an emergency.
EPA
Essential safety system System which has a major role in the control and mitigation of
accidents and in any subsequent EER activities
Exceedance curve A plot of the value of a variable against the plot of the probability
or frequency of exceedance of that variable.
Expansion Ratio The ratio of burnt to unburnt gas volumes of a given mass of
gas.
Explosion risk risk from the initiating event and possible subsequent escalation.
Extreme (residual) events Events for which design is not reasonably practicable may result
in loss of functionality of SCE’s
Fire Curve A temperature/time curve devised for a fire tests that is intended
to represent (but not necessarily reproduce) the temperature
development of a ‘real’ fire, either cellulosic or hydrocarbon.
Fire Endurance The length of time that an element can resist fire either up to the
point of collapse or alternatively to the point when the deflection
reaches a limiting value.
Fire Point The temperature at which a liquid fuel flashes and then
marginally sustains a flame.
Fire Protection Measures taken to minimize effects of damage from fire should
it occur.
Fire Protection System An integrated detection, signalling and automated fire control
system.
Flammability Limits The range of fuel-air ratios which can support non-detonative
combustion such as laminar and turbulent flames.
Flash Fire The combustion of a flammable vapour and air mixture in which
the flame passes through the mixture at less than sonic velocity,
such that negligible damaging overpressure is generated.
Flash Fire The combustion of a flammable vapour and air mixture in which
flame passes through that mixture and negligible damaging
overpressure is generated.
Flash Point The flash point of a liquid is the temperature at which the vapour
and air mixture lying just above its vaporizing surface is capable
of just supporting a momentary flashing propagation of a flame
prompted by a quick sweep of a small gas pilot flame near the
surface.
Fuel Controlled Fire A fire in which the rate of fuel consumption is controlled by the
rate of supply of fuel to the fire, rather than the availability of
oxygen for combustion.
Hazard Analysis The identification of undesired events that lead to the realisation
of a hazard, the analysis of the mechanisms by which these
undesired events could occur and usually the estimation of the
extent, magnitude and likelihood of any harmful effects.
Health, safety and A description of the means of achieving health, safety and
environmental (HSE) environmental objectives.
management plan
Health, safety and The formal review by senior management of the status and
environmental (HSE) adequacy of the health, safety and environmental management
management review system and its implementation, in relation to health, safety and
environmental issues, policy, regulations and new objectives
resulting from changing circumstances.
Health, safety and A public statement of the intentions and principles of action of
environmental (HSE) policy the company regarding its health, safety and environmental
effects, giving rise to its strategic and detailed objectives.
Health, safety and The broad goals, arising from the HSE policy, that a company
environmental (HSE) sets itself to achieve, and which should be quantified wherever
strategic objectives practicable.
Heat Flux (heat density) The rate of heat transfer per unit area normal to the direction of
heat flow. A convenient unit is kW/ /m2/s (1 kW m-2 /s = 317
Btu ft-2 h-1). It is a total of heat transmitted by radiation,
conduction and convection.
Heating Rate The rate, measured in degrees C per minute, that a sample is
heated.
Homogeneous In two-phase flow the vapour and liquid phases are assumed to
be travelling at the same speeds and to be mixed uniformly
throughout.
Hydrocarbon Fire Test A furnace fire test using a time/ temperature curve which
supposedly represents a hydrocarbon fire and which results in
an ‘H’ rating for successful specimens.
Inventory The quantity and type of fuel stored. A platform inventory lists
the fuel types and total volumes stored on board an installation.
The term inventory is also used to describe the quantity and
type of fuel stored in vessels and pipe assemblies.
Jet Fire or Jet Flame The combustion of material emerging with significant momentum
from an orifice.
Jetting Length The length of a jet flow over which the effects of its initial
momentum are dominant.
Large Deflection Analysis A type of non-linear structural analysis based on the final
deflected shape of the structure rather than the initial,
undisplaced shape.
Liquid spray release High pressure release of a liquid hydrocarbon which gives rise
to a suspension of the fuel in the air similar to a gas cloud which
is capable of deflagration on ignition.
Loss Prevention The general term used to describe a range of activities carried
out to minimize any form of accidental loss, such as damage to
people, property or the environment or purely financial loss due
to plant outage.
Lower flammability limit (LFL) The lower level of gas concentration which will result in
combustion of the gas. This is the same as Lower explosive limit
(LEL).
Mass Burning Rate The mass burning rate of a pool fire is the mass of fuel supplied
to the flame per unit time, per unit area of the pool. Units are
typically kg/m2/sec.
Monitoring activities All inspection, test and monitoring work related to health, safety
and environmental management.
Natural Period The time required for a freely vibrating structure to complete one
cycle of motion.
Nominal explosion frequency The frequency of occurrence of a release which is ignited and
results in detectable overpressure (>50 mb). This is used as the
top point in the simplified generation of an exceedance curve -
Prexp
Non-Linear Analysis A type of structural analysis that allows the geometry and/or the
material properties to be non-linear.
Phenomenological models Simplified physical models, which seek to represent only the
essential physics of explosions.
Potential loss of life (PLL) The (fractional) no of individuals predicted to become fatalities
over a specified period of time – usually one year.
Preparedness analyses The analysis has to be traceable and will normally - though not
necessarily - be quantitative.
Pressure Burst The rupture of a system under internal pressure, resulting in the
formation of missiles which may have the potential to cause
damage, and perhaps a blast wave.
Pressure difference The pressure difference across an obstacle greater than 0.3m in
the direction of flow, calculated from the pressure time histories
at the front and back of the obstacle. - Pdiff
Primary means of escape The means of escape which was assumed during design.
Proof Stress The stress at which the plastic strain of a material reaches a
particular value, for example 0.2 %. Proof stress, is a valuable
concept in materials which do not exhibit a sharp yield point.
Quality Assurance All systematic actions that are necessary to ensure that quality
is planned, obtained and maintained.
Release The type and quantity of fuel which can possibly be ignited.
Representative peak Time averaged over 1.5ms and space averaged over explosion
overpressure affected area. – Prep
Required endurance time The estimated time for people to travel from their work stations
to the TR, then to the primary or secondary means of escape,
allowing for the possibility of helping injured colleagues.
Rise Time The time taken for the overpressure to increase from zero to the
peak overpressure.
Risk The product of the chance that a specified undesired event will
occur and the severity of the consequences of the event.
Risk acceptance criteria Criteria that are used to express a risk level that is considered
(RAC) tolerable for the activity in question
NOTE 1 - The risk analysis term covers several types of analyses that
will all assess causes for and consequences of AEs, with respect to
risk to personnel, environment and assets. Examples of the simpler
analyses are SJA, FMEA, preliminary hazard analysis, HAZOP, etc.
Risk Evaluation The evaluation of the likelihood of undesired events and the
likelihood of harm or damage being caused, together with the
value judgements made concerning the significance of the
results and their tolerability, including issues of risk perception
where appropriate.
Risk Issues Issues that impact on the nature and perception of safety related
risks and the role of risk based analysis techniques
Safety critical element (SCE) Any structure, plant, equipment, system (including computer
software) or component part whose failure could cause or
contribute substantially to a major accident is safety-critical, as
is any which is intended to prevent or limit the effect of a major
accident.
Safety objective Objective for the safety of personnel, environment and assets
towards which the management of the activity will be aimed
Safety Plan All documented policies, standards and practices which the
Operator shall initiate to ensure the activity is planned,
organized, executed and maintained to achieve safety and
protect the environment in accordance with the acts or
regulations
Safety-critical elements As for SCE, those elements of the installation which are critical
(SCEs) to safety.
Screening criteria The values or standards against which the significance of the
identified hazard or effect can be judged. They should be based
on sound scientific and technical information and may be
developed by the company and industry bodies, or provided by
the regulators.
Secondary means of escape Means of escape which should be available if the primary
means of escape is not available.
Section Factor The ratio of heated perimeter (Hp) to cross-sectional area (A).
Serviceability Limit A design limit beyond which the structure may become
unserviceable, for example, a specified maximum deflection.
Should Verbal form used to indicate that among several possibilities one
is recommended as particularly suitable, J without mentioning or
excluding others, or that a certain course of action is preferred
but not necessarily required
Significant Overpressure An overpressure > 50m bar. This is the pressure at which
pressure relief panels should operate.
Skin Friction The frictional force caused by the passing fluid flow which acts
tangentially to the surface of the body.
Societal Risk The relationship between frequency and the number of people
suffering from a specified level of ham1 in a given population
from the realization of specified hazards.
Specific Heat The amount of heat, measured in Joules, required to raise one
kilogram of a substance by one degree C. Units are
Joules/kg/ºC.
Stagnation Overpressure The excess pressure above that in the approach flow which
occurs on the front face of a surface where the gas velocity is
brought to rest.
Standard Fire Test A furnace fire test using a time temperature curve which
simulates a standard fire and which results in an ‘A’ or ‘H’ rating
for successful specimens.
Stoichiometric mix Air/fuel mixture is such that it contains exactly the required
amount of oxygen to completely consume the fuel.
Strength level analysis An explosion response assessment where the SCEs including
structure and supports are required to remain elastic. An elastic
method is used for structural response with code/utilization
checks as the performance standard.
Strength level blast (SLB) Representative peak overpressure used to test robustness of
equipment and structure. Elastic structural analysis is
appropriate.
Thermal Conduction Heat transfer through a medium via random molecular motion.
Threshold overpressure Peak overpressure below which explosion assessment need not
be performed.
Time Domain A solution technique for structural dynamics in which results are
obtained at regular time intervals when a time variable force or
other load is applied.
Turbulent Burning Velocity The burning velocity of the flame when turbulence is present in
the flammable mixture.
Two-Phase Flow A flow in which both the liquid and vapour phases co-exist within
close proximity.
Unconfined Vapour Cloud Defined as for VCE and is an imprecise term (see below).
Explosion
Upper flammability limit The fuel concentration above which combustion will not occur.
(UFL)
Vapour Cloud Explosion The preferred term for an explosion of a cloud made up of a
(VCE) mixture of a flammable vapour or gas with air in open or semi-
confined conditions.
Ventilation Controlled Fire A fire in which the combustion rate is controlled by the
availability of oxygen rather than the supply of fuel.
View Factor The proportion of the field of view of a receiving surface that is
filled by a flame.
Volume blockage ratio The ratio of the volume occupied by the obstacles to the total
volume.
Volume Production The overall rate of increase in volume caused by the combustion
process.
Water Deluge System A network of small bore pipe work nozzles connected to the
firewater main which is capable of delivering the design water
spray to the protected area.
Water Screen A series of wide angle and/or mist spray nozzles connected to
the firewater main that protect a specific area in the module from
the passage of heat, smoke and billowing flames.
Yield Point The stress at which a steel sample departs from linear elastic
behaviour to plastic deformation in a standard tensile test.
Yield, Dynamic The apparent yield stress exhibited by metals such as steel
when they are strained at a rate which is significantly faster than
the normal testing rate.
Yield, Effective For materials which exhibit no clear yield point – such as mild
steels at elevated temperatures, the stress corresponding to a
particular plastic strain, often 0.2 % (see also Proof Stress).
APPENDIX C - CHECKLISTS
This appendix contains the checklists published in Reference [22] ‘Explosion assessment
guidelines’, for the HSE June 2001.
Key techniques Low complexity method Medium complexity method High Complexity method
High sophistication methods may be used where more sophisticated methods of assessment
which may result in reductions in conservatism and hence cost are considered more
appropriate.
Typical NUIs with confinement or congestion e.g. due to high equipment density, NUIs
Application with relatively high manning e.g. > four visits per year
Manned platforms with separation process, gas treatment, but with considerable
segregation between TR and hydrocarbon hazard e.g. bridge-linked.
Heading Checklist Guidance
Scenario Have scenarios For the low sophistication case, the scenario identification is
Identification been considered primarily concerned with the geometry of the area where an
and excluded? On explosion could potentially take place. However, a medium
what basis? complexity analysis will probably entail a probabilistic analysis of
the likelihood of an explosion occurring. This must in turn entail a
treatment of the likelihood of a flammable mixture being present
in an enclosure, which should consider all the influencing factors.
It is likely that some scenarios will be omitted from the analysis,
and so the inspector must be satisfied that the grounds for
omission are firm.
Does the scenario Possibly there is insufficient inventory in the leaking system to
account for build-up an explosive mixture throughout the domain being
available considered. This could be the case for successful ESD /
inventory? Blowdown. This scenario is therefore not credible. The analysis
should consider "partial fill" situations.
Does the scenario Some scenarios may be omitted from the analysis on the basis
account for that the ambient wind conditions prevent the formation of an
external effects explosive mixture. The analysis must consider the full range of
such as wind wind speeds and directions, and account for uncertainty in order
speed and to omit scenarios on this basis.
direction?
Are confined Does the HAZID address the possibility of explosions in vents
explosion and drains e.g. due to the back flow of air into a vent drum and
scenarios the subsequent formation of a flammable mixture. These should
identified? be addressed in the design of vent drums, vent pipes and
headers, pipe supports, FPSO cargo tanks and so on.
How are Usually, the Fire and Explosion Risk Analysis will consider the
unconfined potential for gas build-up and ignition. Typically ignitions are
explosions characterised as immediate or delayed. Immediate ignitions arise
addressed? from "near-field" ignition sources, probably associated with the
cause of the initial leak e.g. hot-work. Delayed ignitions are
caused by "far-field" ignition sources e.g. static or intermittent
sources such as faulty electrical equipment. These are in turn
variously described as explosions and flashfires, or "strong" and
"weak" explosions. A flashfire or weak explosion is usually not
considered in terms of overpressure damage, only as a cause of
fatality for persons directly exposed to the event. Criteria for
assessing a delayed ignition as either a flashfire or a strong
explosion should be identified at the outset, if a blast scenario is
dismissed as not credible.
Are severe It is well known that enriched gases and mists result in changes
explosions to known flammability limits and blast overpressures, compared
identified? to single-component explosions. The inspector must ensure that
the scenario identification accounts for this possibility and that
this is incorporated into the uncertainty analysis as appropriate.
Typical NUIs with confinement or congestion e.g. due to high equipment density, NUIs
Application with relatively high manning e.g. > four visits per year
Manned platforms with separation process, gas treatment, but with considerable
segregation between TR and hydrocarbon hazard e.g. bridge-linked.
Heading Checklist Guidance
Blast Analysis General For a small, simple installation it is probably sufficient to identify
worst-case overpressure scenarios and determine if the structure
and facilities are able to withstand it. Small open structures
should not experience severe overpressures and so it is simple
and practicable to protect against worst-case or near-worst-case
scenarios. Larger geometries will inevitably lead to rather more
severe explosions given the increase in inventory size or an
increase in the amount of equipment representing both
congestion and vent blockage. For larger, more complex
geometries it is likely that worst-case overpressures will be much
more severe than the structure and equipment can cope with.
For a given geometry, the worst-case scenario will depend on
ignition source strength and location, and also on the local gas
concentration.
Assessment of The analysis should use a variety of ignition point locations to
ignition point array show that worst-case conditions have been determined. These
- random? could either be through expert judgement e.g. selection of the
most confined or congested areas, or by random selection. It is
likely that the use of an ignition point array is used to derive a
probabilistic exceedence curve (see below). It is difficult to say
how many ignition locations and overpressure calculations have
to be carried out to determine an adequate curve, however the
case should be convincing that a sufficient number has been
carried out.
Is there any effect The analysis must account for the possibility that a severe
of flashing liquid / explosion can result from a mist or concentration of enriched
condensate on gas.
blast over-
pressures?
Have drag forces The analysis should be capable of being used to calculate drag
been quantified? forces, in order to demonstrate the survivability of vulnerable
SCEs such as hydrocarbon pipework, vent pipework, cable trays
and so on.
Has the effect of For new-build designs, the initial analysis may only consider the
design "growth" on geometry down to crude limits. Calculated overpressures are
the analysis been likely to be exacerbated as more detail is introduced to the
accounted for? analysis e.g. small diameter pipework, cable trays etc., however
once the design overpressure is selected it is difficult to iterate
the design - the blastwall has already been specified and
ordered. The analysis should attempt to show the degree of
increase in blast overpressure brought about by design growth or
alternatively should calculate the overpressure at the end of the
design to demonstrate that there has been no more than a small
effect.
Other factors The calculation of blast overpressure should consider the effect
affecting Blast of temporary blockages such as wind-walling / tarpaulins /
overpressure - scaffolding or a workover MODU placed against the platform, if
MODU or wind- this interacts with the module being analysed e.g. the wellbay.
walling
Can the analysis Generally, blast models are most useful in assessing the effect of
successfully model layout changes such as equipment location and venting. For any
mitigating effects? level of sophisticated analysis, the model should be able to
demonstrate the worth of mitigation measures e.g. deluge to
mitigate explosions.
Typical NUIs with confinement or congestion e.g. due to high equipment density, NUIs
Application with relatively high manning e.g. > four visits per year
Manned platforms with separation process, gas treatment, but with considerable
segregation between TR and hydrocarbon hazard e.g. bridge-linked.
Heading Checklist Guidance
Blast Impulse What is the As above - it is likely that for larger more congested modules it is
Magnitude methodology for not practicable to stiffen structure and supports to withstand
Selection selection of lower- calculated worst-case scenarios. Thus, a methodology is needed
than-worst-case to arrive at a design value that is lower than the worst-case. This
blast loadings for is likely to be probabilistically based, and result in the production
design? of an "exceedence curve", that shows the probability that an
explosion will be greater than a given overpressure. Therefore, if
an estimate of explosion frequency is available, this is combined
with the exceedence curve probability to arrive at physical
impairment frequencies. This approach readily lends itself to
cost-benefit analysis in support of ALARP.
If an exceedence curve technique is adopted, the methodology
needs to be reviewed carefully. If it is constructed from the
results of explosion analysis, the inspector must ensure that a
sufficient number of calculations has been carried out to reduce
uncertainty to a tolerable level.
Work has been done to compile data relating to estimates of
blast magnitude and frequency for North Sea installations of
varying sizes. If statistics are used to compile or compare
exceedence probabilities, then the inspector must ensure that
they are applicable to the installation type under scrutiny.
How has Analytical uncertainty arises as a result of inevitable modelling
uncertainty been imperfections compared with actual events. Uncertainty in
addressed? overpressure estimation could arise due to uncertainties
regarding scenario definition, model limitations or uncertainties
regarding the value of the input variables.
Scenario definition. In fact, it is impossible to know the ignition
location for a gas cloud with any degree of certainty, and the
concentration at the ignition location. The literature describing most
models generally claims that they are just as likely to underpredict as
overpredict the overpressure for a given blast scenario. Uncertainty
is therefore typically reduced by carrying out many calculations for
an array of ignition points and gas concentrations, and producing an
exceedence curve.
Model limitations. Uncertainty can arise if the model is unable to
calculate overpressures at a single location e.g. riser ESDV, if within
the model domain. Relatively crude phenomenological models are
usually unable to meaningfully calculate anything other than a peak
throughout the domain. The average overpressure may be close to
the SCE survivability, producing a "cliff-edge" risk effect on the QRA
results. The inspector must be satisfied that cliff-edges have been
identified.
Input variables. Puttock [84] explains that model uncertainties mainly
affect calculated overpressure by their influence on the flammable
cloud burning rate, and suggests that applying a log-normal
distribution to the laminar burning velocity within the model. This is
quite sophisticated and may not be possible within the confines of
"black-box" models bought off-the-shelf. A crude method is to simply
adopt a conservative approach and factor up the predictions
according to expert judgement, alternatively it may be possible to
show that that modelling uncertainties are not significant given the
inherent strength of the SCE being considered.
What are the The inspector should establish that the safety case has explored
practicable the practicable limits for overpressure protection on the basis of
protection limits? the worst-case overpressure and any probabilistic analysis. Is it
possible to design for the worst-case, even though this is a
remote event? This goes a long way to removing uncertainty.
Typical NUIs with confinement or congestion e.g. due to high equipment density, NUIs
Application with relatively high manning e.g. > four visits per year
Manned platforms with separation process, gas treatment, but with considerable
segregation between TR and hydrocarbon hazard e.g. bridge-linked.
Heading Checklist Guidance
Assessment of Has assessment It is probably valid to consider escalation effects resulting from
explosion of escalation been SCE failure, given that there could be a significant effect on risk
consequences attempted? levels. This must consider the failure modes and the likely
escalation that results. Typically, in the event of failure of a blast
wall, say, the QRA rule set may assume universal fatality
amongst POB on the other side of the blast wall. This may be
inappropriately conservative, given that "failure" of the wall is
merely exceeding the buckling failure limits of the wall and
supports rather than rapid and complete demolition.
Is fatality It is common to assume universal fatality in the area containing
estimation realistic the blast. If it is assumed that POB have no chance to escape
for the module before the blast, then the likelihood of immediate fatality may be
type? inappropriately high. As a result, the numbers of delayed
fatalities e.g. due to escalation effects may be low, and so the
benefit of risk reduction methods intended to mitigate and control
escalation e.g. TR functions may be under-reported.
Layout Has published There is a lot of published guidance regarding the most
optimisation guidance been advantageous layout for areas where there is an explosion
used to lay out the hazard e.g. EN ISO13702 [34] and Bjerkervedt, van Bakke. The
module inspector should be satisfied that the explosion analysis has
equipment? considered the effect of following the guidance.
Have the effect of Location of equipment can affect the degree of blockage. The
equipment location inspector should be satisfied that e.g. the axis of vessels is along
changes been the vent path. If the layouts are fixed, the inspector should look to
addressed? see that some sensitivity work has been done, to check that the
effect of relocating equipment is not significant.
Have the effects of Leading on from the above, the inspector should be satisfied that
changing wall the dutyholder is aware of the impact of the effect of layout
locations, removal changes, and has included a process for assessing and
of blockages and controlling the key factors affecting explosion risk in the design or
congestion safety management process.
reduction been
assessed?
For new-builds, For an open module, it is generally accepted that a "long & thin"
have the benefits layout should serve to reduce explosion likelihood and
changing module magnitude. The layout encourages dispersion, whilst the vent
shape been paths are short. On the other hand, high overpressures can
assessed? result if the available vent path is on the long axis of the module.
The inspector should be satisfied that the advantages of this
layout have been addressed within the design of the facility.
Structural and Has quantification In order to assess the survivability of pipework, it is necessary to
Equipment of structural analyse the deflection of primary structure arising from the
Optimisation deflections using design event. This must be realistically done, in order to be able
dynamic analysis to show that deflection does not result in escalation to e.g. vent
been carried out? header pipework.
Have blast The Safety Case should include an analysis of local structural
vibration / accelerations arising from severe explosions. Performance
accelerations been standards should be set for SCEs to withstand blast-induced
determined? accelerations where appropriate e.g. TEMPSC davits; UPS;
panels.
Typical NUIs with confinement or congestion e.g. due to high equipment density, NUIs
Application with relatively high manning e.g. > four visits per year
Manned platforms with separation process, gas treatment, but with considerable
segregation between TR and hydrocarbon hazard e.g. bridge-linked.
Heading Checklist Guidance
Do Survivability Following from the above, the inspector must ensure that SCE
Performance Survivability criteria are based on the ability to withstand:
Standards Overpressure effects (direct loading);
consider all blast Loading arising from flow effects i.e. drag forces;
effects? Acceleration resulting from blast effect on primary structure
Note that SCEs located in non-hazardous or safe areas are
vulnerable to blast-induced acceleration.
Check for local Points to consider in the assessment are:
plastic deformation Has the structural design accounted for heavy explosion loads giving
and redundancy rise to plastic deformation;
Has sufficient redundancy been build into the structure;
Has the effect of plastic deformation on SCEs been accounted for in
the Safety Case?
ALARP Is cost-benefit For larger, more complex installations, it is envisaged that these
Assessment analysis used to require greater risk exposure on the part of operations POB to
assess risk inspect and maintain the plant items. As exposure increases, so
reduction the use of cost-benefit analysis (CBA) becomes more
measures? Is it meaningful. Care is needed to ensure that the analysis is
conservative? conservative, and that the criteria used are valid. Conservatism
in cost-benefit analysis relates to ensuring:
Costs associated with implementing remedial measures are not
over-stated (some remedial measures can be implemented as part
of an ongoing scope of work and so offshore mobilisation costs etc.
are therefore not applicable);
POB exposure is not underestimated;
Gross disproportion is accounted for;
Where benefits are marginal, other losses - production and so on -
are accounted for. These could point to a conclusive overall benefit.
The costs of risk reduction measures require careful "reality"
checking, so that the benefit is accurately measured. Where the
results of CBA are counter to historical experience, the
dutyholder must show that the preferred way forward follows best
practice.
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Heading Checklist Guidance
Scenario General All the points from the low and medium sophistication checklists
Identification apply here also. At this high level of sophistication, it is clear that
the Dutyholder cannot always be expected to have specialist
explosion expertise in-house to facilitate and advise.
Nonetheless it is clear that such expertise is available in the
market-place and so at this level there should evidence that the
dutyholder has commissioned an appropriate level of
consultancy support for scenario identification, blast analysis,
response analysis and so on.
Has ingress from For large, multi-module installations, the potential for gas
neighbouring migration and gas build-up from remote areas must be
modules been considered e.g. in the HAZID. For an FPSO, this could include
accounted for? gas migration and accumulation over the tank top, if the process
decks are all plated.
Have local high For areas of high congestion around equipment, it may be
emission appropriate to check for local high gas concentrations resulting
concentrations from small leaks. CFD (design) or real-time tests (existing
been identified? installations) can be used to see if there are occasions when
natural ventilation is insufficient to disperse leaks and to check
for mixture build-up. The inspector should be satisfied that the
Safety Case accounts for the possibility of small concentrations
giving rise to a local explosion hazard.
Have external The hazard from external explosions is most severe for large
explosions been integrated facilities, as it is likely that SCEs are located in
identified? modules adjacent to the explosion location. The TR and EER
facilities may be directly vulnerable to blast effects (see below).
Blast Analysis Is the philosophy All the points from the Medium Sophistication Checklist apply
for blast analysis here also. It is envisaged that the explosion analysis for an
clearly stated? integrated facility, FPSO etc. will be carried out using a CFD-
based code, due to the inability of phenomenological models to
tackle non-standard module configurations and the inability to
calculate local overpressures with any degree of confidence. Use
of CFD follows from the high explosion risk potential, complex
layouts, increased computer power, and the expectation that
blast protection can be optimised. Given the resources available
to the operators of large integrated facilities, it is expected that
they should respond to challenges present at the leading-edge of
explosion and structural response research. Operators must be
prepared to resource detailed studies and tests which seek to
demonstrate the clear interaction between the calculation of blast
overpressure coupled with structural response, and which aim to
deal with the numerous uncertainties associated with detailed
calculations.
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Heading Checklist Guidance
Has the effect of Explosion overpressures are exacerbated by high cloud
cloud turbulence turbulence as is likely in the event of a large or catastrophic leak.
been accounted It is not clear if complex, sophisticated CFD-based explosion
for? modelling techniques can tackle this sort of turbulence. Full-scale
trials are intended to investigate the effects of turbulence:
hitherto, full-scale experiments have been based on quiescent
clouds. The analysis should address this phenomenon and its
potential for increasing the likelihood of SCE failure.
Identification of It is envisaged that the explosion analysis for an integrated
local high Blast facility, FPSO etc. will be carried out using a CFD-based code.
Overpressures The degree of analysis should be sufficient to indicate areas of
high local overpressure to allow suitable mitigating measures to
be specified and implemented.
Assessment of Blast analysis is typically carried out within a set "domain" that
other blast reflects the extent of the partial confinement and effectively
phenomena marks the limit of the calculation. In fact, explosion effects are
not limited to domains and there are two important phenomena
to account for in explosion analysis:
External explosions arise as a result of turbulent unburnt gas being
pushed out of the partially confined volume and subsequently
ignited. This can have a magnifying effect on the overpressure in the
partially confined volume containing the initial explosion as it
prevents venting. External explosions also result in areas not
exposed to the initial explosions receiving unexpectedly high incident
overpressures and drag forces. The analysis should account for the
possibility of external explosions.
Blast-funnelling. Vented gases from a module can encounter
confinement in neighbouring modules which will "funnel" the gases,
producing high local gas velocities. This in turn can result in
potentially severe overpressure and drag force effects.
Far-field overpressures. In the event of a strong explosion in an area
of partial confinement, these can have an effect on items some
distance from the limit of confinement as the overpressure pulse
decays. The analysis should consider the effect of explosions on
exposed SCEs that located outside of the explosion analysis
domain.
Blast Impulse What is the CFD codes require a lot of computing power to operate and run
Magnitude methodology for times are lengthy. At present this probably precludes a full
Selection selection of lower- probabilistic analysis arriving at an exceedence curve, as the
than-Worst-Case number of runs required to build up a convincing dataset would
blast impulse be prohibitively time-consuming. CFD codes are of most use in
magnitude for determining local overpressure effects. Puttock [92] has
design? described a technique for combining CFD results at local
locations to exceedence calculation results from a
phenomenological model to arrive at a "transfer function" that
can be used to provide an exceedence curve for a given location
- or SCE. Elsewhere, Huser et al has described a how a
database of dispersion and overpressure results can be used as
a basis of a probabilistic analysis. Talberg et al seems to
describe a similar approach. It is clear that effort is being directed
to using CFD codes to input to a probabilistic analysis; the
inspector must be aware of these and assess whether the
installation Safety Case under scrutiny has used such tools in the
ALARP demonstration. (See Scenario Identification / General for
the duty holder's requirement to ensure they obtain competent
consulting support where necessary).
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Heading Checklist Guidance
How have It is likely that overpressures in complex multi-module
practicable installations can rise to high values. SCE protection may not be
protection limits practicable for the worst-case. The assessment must show that
been determined? sufficient structural and piping stress analysis has been carried
out to determine ultimate strength for the applied load. This will
naturally lend itself to determining whether additional strength
can be built into the structure and supports in line with cost-
benefit analysis.
Assessment of Has a detailed At this level, an attempt should be made to properly demonstrate
explosion escalation analysis the effect of SCE failure on the capability of the emergency
consequences been carried out? response functions of the installation and ultimately the individual
and group risk levels. This is additional to the simple calculation
of direct and indirect fatality referred to in the Medium Complexity
checklist. It is only by fully considering the effect on SCEs that
full cost-benefit analysis of explosion risk reduction measures
can be carried out.
Layout Show that local The blast analysis should be of a suitable degree to identify
optimisation overpressures and areas of locally high overpressures. Evidence should be
drag forces are not presented that the layout has been optimised to reduce these
excessive potentially damaging local overpressures to a tolerable level in
order to demonstrate ALARP.
Structural and Has non-linear It is likely that structure and supports have a great deal of
Equipment analysis been residual strength after undergoing plastic deformation brought
Optimisation used to determine about by blast overpressure. Non-linear analysis of the structure
the residual can determine the degree of plasticity and whether actual failure
strength? of e.g. the blast wall and primary connections.
Is the structural Typically, structure is assumed rigid throughout the applied blast
response analysis load profile, which is assumed unaffected by any resulting
coupled to the deformation. Robertson et al describe how "coupling" the
blast analysis? structural response model to the blast overpressure model
resulted in a more realistic representation of the effect of blast.
Effectively, the structural model allows the loading to interact with
the structural deformation so that both loading and deformation
were considerably reduced.
Uncoupled analysis is the norm, and so it is Robertson suggests
that coupling the analyses effectively removes unnecessary
conservatism from the response analysis.
Has non-linear It is possible that the calculated structural deflections have been
analysis been used in a relatively simple fashion in assessing the survivability
used to check the of process pipework. This could be conservative, if the
effect of structural survivability is linked to a code stress level rather than the
deflection on ultimate strength of the pipe then effectively the pipe will never
pipework? survive any significant deflection. Non-linear analysis can be
used to demonstrate the point at which pipework loses
containment. It will probably be prohibitively time-consuming to
subject every pipe length to such a degree of analysis, but
perhaps expert judgement can be used to identify particularly
vulnerable sections that can be subject to close study.
Has all vulnerable Following from the above discussion on "far-field" effects, the
structure and analysis must ensure that items outside the blast model domain
equipment been are also optimised for blast resistance.
accounted for?
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Heading Checklist Guidance
ALARP Use of robust Following on from the above, a fully integrated QRA is
Demonstration quantitative risk necessary. This should address risk to SCEs as well as directly
analysis to to POB, because sometimes it is difficult to directly relate SCE
demonstrate failure to the QRA. This will reduce uncertainty in the final risk
explosion results, where uncertainty arises in the analysis of causes of
management fatality.
reduces risks to
ALARP
London Office:
2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU.
Tel: 020 7802 2400 Fax: 020 7802 2401
Aberdeen Office:
9, Albyn Terrace, Aberdeen, AB10 1YP
Tel: 01224 626652 Fax: 01224 626503
Email: info@ukooa.co.uk
Website: www.oilandgas.org.uk