INHERENTLY SAFER DESIGN CASE STUDY OF RAPID BLOW DOWN ON OFFSHORE PLATFORM

INHERENTLY SAFER DESIGN CASE STUDY OF RAPID BLOW DOWN ON OFFSHORE PLATFORM Volton Edwards bptt Angus Lyon DNV Energy Alastair Bird DNV Energy INTRODUCTION A term now in common usage within the oil & gas industry is inherently safer design. The objective of this phrase is to promote designs for hydrocarbon extraction and processing facilities that, where practicable, eliminate hazards completely or reduce the magnitude of the consequences of hazard scenarios sufficiently to eliminate the need for elaborate safety systems and procedures. This paper presents a case study where the principles of inherently safer design were used to challenge the normally accepted interpretation of the requirements for depressuring (blow down) systems as set out in the standard API STD 521, Pressure-relieving and depressuring systems, (API 2007). Offshore oil and gas extraction platforms have hydrocarbon containing equipment onboard. The hydrocarbon containing equipment has maximum design operating parameters, such as a maximum design pressure. Hydrocarbon extraction is a dynamic process. The hydrocarbon containing equipment is generally equipped with sensors which monitor the value of parameters, such as pressure. The sensors often have associated alarms which notify the plant operator that pressure is increasing. The operator can then take actions to return the parameter to its normal value. If the operator intervention fails there is often an executive action also attached to the sensor which initiates a shutdown of the plant before the design limits are reached. In case the shutdown system fails there is often a secondary protection system. In the case of overpressure this is generally a relief valve that dumps excess pressure to a vent or flare. As well as the protection systems described above, a blow down system is also generally installed. It has two main purposes: 1. to reduce the pressure in the hydrocarbon containing equipment to atmospheric pressure to allow for the breaking of containment for maintenance and other reasons, and 2. To get rid of hydrocarbon inventory and reduce the pressure in the equipment in the event of an emergency on the facility. It is this latter design intent that is the subject of this paper. BACKGROUND When designing pressure-relieving and depressuring (blow down) systems reference is generally made to API STD 521. API STD 521 is intended primarily for oil refineries; it is also applied to oil and gas production facilities. It gives guidelines examining the principal causes of overpressure; determining individual relieving rates; and selecting and designing disposal systems, including such components as piping, vessels, flares, and vent stacks. Section 5.20 of API STD 521 which covers vapour depressuring states: Depressuring systems can be used to mitigate the consequences of a vessel leak by reducing the leakage rate and/or inventory within the vessel prior to a potential vessel failure. More often, depressuring systems are used to reduce the failure potential for scenarios involving overheating (e.g. fire). If vapour-depressuring is required for both fire and process reasons, the larger requirement should govern the size of the depressuring facilities. For pool-fire exposure...this generally involves reducing equipment pressure from initial conditions to a level equivalent to 50% of the vessels design pressure within approximately 15min. Depressuring to a gauge pressure of 100PSI is commonly considered when depressuing to reduce the consequences from a vessel leak. In addition, BP has a series of engineering technical practices with which new platform designs are required to demonstrate compliance. Two which have requirements relevant to the subject of this paper are: 1. Guidance on Practice for Inherently Safer Design, (BP 2008), and 2. Fire and Explosion Hazard Management (FEHM) of Offshore Facilities, (BP 2009) The inherently safer design technical practice requires a process to be followed which assesses all hazards and produces a design which, as far as possible, eliminates hazards or reduces the magnitude of hazard scenario consequences sufficiently to eliminate the need for elaborate safety systems and procedures. The fire and explosion hazard management practices has a similar intent by requiring a fire and explosion hazard management (HEHM) document to be developed which delivers a strategy for each hazard such that major 349

accidents 1 are prevented or adequately managed to assist demonstrating that sufficient thought has gone into the FEHM the practice defines three hazard categories: 1. Controllable hazards 2 2. Evacuation hazards 3 3. Catastrophic Hazards, 4 and requires that every fire and explosion hazard scenario on the facility is categorized as above. Clearly the desired outcome is that where practicable all Fire and Explosion hazard scenarios are categorized as Controllable hazards. This is in line with the intent of Inherently Safe Design. BPTT has recently commissioned a series of small normally unmanned installations (NUIs) (4 6 wells). The initial platforms had their blow down systems deigned to reduce the operating pressure to 50% within 15 min. in compliance with the perceived requirements of API STD 521. CHALLENGE TO THE BLOW DOWN SYSTEM DESIGN The perception that designing the blow down system to achieve 50% reduction in operating pressure in 15 min. is optimum was challenged for the most recent platform design in the series. The challenge was based on: 1. It ignores the fact that the platforms are producing gas and not oil and pool fires are not therefore a credible fire scenario, 2. It ignores the possible benefits of depressuring on reducing the consequences of unplanned process releases from whatever cause. 3. Does it meet the principle of inherently safe design? and 4. Have the maximum number of fire and explosion hazard scenarios been categorized as controllable? To assess whether the challenge was justified the following questions were addressed: Does a more rapid blow down system produce an inherently safer design? Does a more rapid blow down system significantly impact the number of controllable hazard scenarios? Is a more rapid blow down system practicable? 1 An event that can lead to multiple fatalities. 2 Hazard scenarios that allow personnel to remain safely on the facility. Precautionary evacuation may take place if it is safe to do so. 3 Hazard scenarios which have the potential to escalate and cause eventual impairment of the protected muster area and evacuation facilities after a period of time (e.g. endurance period of the protected muster area). 4 Hazard scenarios which preservation of life of personnel on facility cannot be demonstrated and the effects of the hazard scenario cannot be controlled or mitigated such that controlled evacuation can be performed. ASSESSMENT METHOD The assessment was based on evaluating the impact on the consequences of leaks from the process equipment rather than protecting the equipment from overpressure in a fire scenario. In particular, the impact on the escalation potential of fire and explosion hazard scenarios was evaluated as this is the primary criterion for distinguishing controllable from evacuation hazard scenarios. If a process release on the platforms under study ignites early, it is characterized by a jet fire and if the ignition is delayed, a vapour cloud explosion will occur, possibly followed by a jet fire. Escalation can be through failure of other process equipment or structures with the explosion. There are many references which give details of impacts of fires on components, characteristics of jet fires and rules of thumb regarding the time taken for items to fail under fire loading and explosion overpressure. The following is typical and reproduced from Spouge 1999. Figure 1 demonstrates that steel loses it strength at elevated temperatures. A point in time is reached when the heat absorbed by the steel component reduces its strength to the point at which the stress in the component 5 is greater than the remaining strength of the steel and the component fails. The greater the heat flux from the fire the quicker it will fail. The heat flux at the boundary of a gas jet flame depends on the composition of the gas and other factors but is of the order of 200 300 kw/m 2. This value drops of dramatically with distance from the flame as shown in Figure 2. 6 Figure 1. Steel strength v. temperature (Spouge 1999) 5 Either from a structural load or internal pressure. 6 The heat flux at the flame boundary of a liquid pool fire is significantly less, approximately 150 Kw/m 2. 350

Figure 2. Scale diagram of heat flux from a gas jet fire Typical failure time for components is presented in Table 1. From Table 1 it can be seen that the failure times of components are significantly shorter if engulfed in the flame. For example, pipes and vessels can be expected to fail after 5 minutes if engulfed in a jet fire, but would last for 60 minutes if the flame is very close but not engulfing. This information was used to establish a simple escalation rule set as follows 7 : Escalation to process equipment and structures occurs if the component is engulfed in a jet flame for more than 5 minutes When a system containing pressurized gas leaks is isolated, the leak release rate and associated jet flame length decay exponentially. If the system is equipped with a blow down system its activation removes gas from the system, reducing the system pressure, and thus reducing the leak release rate 8 and associated jet flame length. This is shown diagrammatically in Figure 3. A simple spreadsheet was prepared to model leak release rate versus time for given blow down rates and leak holes sizes using the Chamberlain flame length correlation. 9 Leaks can vary in equivalent hole size and are often characterized under the titles of small, medium and 7 Assuming no passive fire protection or active water cooling. 8 The leak release rate is a function of the pressure in the system at any point in time. 9 Flame length (m) ¼ 11.14Q 0.447 Q ¼ release rate (kg/sec). large 10 for the purpose of risk assessments. Statistically the chance of small leaks predominates. The modeling was based on the most likely hole size (small). Screens shots of the spreadsheet model are presented in Appendix A. Figure A1 displays the spreadsheet with the system operating pressure and inventory volume of the platforms discussed in this paper. The blow down is modeled based on reducing operating pressure to 50% in 15 minutes. Figure A2 is the same spreadsheet with the same blow down characteristics and a 10 mm dia. leak. From Figure A2 it can be seen that with blow down 11 the flame length starts at approximately 10.8 m in length, after 5 mins. It is 9.3 m and after 20 mins. It is still 6m in length. This is a significant flame size. In an ideal world, provided that isolation and blow down are successful, all escalations due to fires would be avoided. In reality this requires reducing the jet fire length to less than, says, 1m after 5 minutes. 12 To achieve this requires an initial blow down rate of 41 Kg/sec (see Figure A3). The larger the initial blow down rate, in general, the further the tip of the blow down vent needs to be to the boundary of the platform to ensure that:. flammable gas clouds cannot be blown back onto the platform during a blow down and,. If the vent discharge ignites the level of thermal radiation at the boundary of the platform is within acceptable levels. In practice, achieving an acceptable vent design for 41 Kg/sec proved impracticable, primarily because the platform design was one of a series of clone designs and the required location of the vent tip would have required a complete structural redesign of the topsides. A compromise was reached which reduced system pressure as quickly as possible, commensurate with an initial blow down rate that allowed a vent to be designed without a total topside structural redesign. The initial blow down rate selected was approximately 16 Kg/sec which reduces flame length to approximately 5 m after 5 mins and 1 m after 15 mins (see Figure A4). EVALUATION OF INCREASED SAFETY ASSOCIATED WITH THE INSTALLED BLOW DOWN Although not ideal, the compromise initial blow down rate reduces the severity of process fires associated with small releases measurably. What impact does this have on safety? One of the main driving forces behind this initiative was to influence the decisions that the offshore installation 10 Small leaks 10 mm dia.; medium : leaks 25 mm dia.; large leaks 100 mm dia. 11 It is assumed that isolation has occurred. 12 The actual desired flame length is dependent on the distance of critical equipment to leak sources. 351

Table 1. Typical component failure time from fire loading (Spouge 1999) Times to failure (minutes) Component Type of failure Jet flame Pool flame 37.5 kw/m 2 Steel plate Yield 1 3 20 Steel plate Fire penetration 5 10 60 Steel beam Yield 1 2 60 Steel beam Collapse 5 10 120 Jacket leg Buckling 15 30 150 Pipe/riser/process vessel Rupture 5 10 60 A rated fire wall Fire penetration 15 45 70 H rated fire wall Fire penetration 100 260 400 Table 2. Hazard scenario totals Hazard scenario category Slow blow down Rapid blow down Controllable 28 42 Evacuation 95 71 Total 113 113 Figure 3. Leak Release rate with Blow down manager (OIM) must make subsequent to a confirmed process release on his/her facility. Soon after the release event the OIM must decide whether to keep personnel on the facility or carry out a precautionary evacuation. Evacuation via lifeboat, or other means such as barrel rafts, have their own set of hazards and are not risk free. It is not a decision to that should be made lightly. One of the main considerations that the OIM will base his/her decision on is whether the event is controllable, i.e. are the characteristics of the event such that, provided personnel are protected from the immediate effects, the overall integrity of the facility will not be compromised, in other words the event will not escalate. 13 This fits neatly with the BP requirement to categorise all fire and explosion hazard scenarios as described in Section 2. The difference in the number of controllable and evacuation hazard scenarios was therefore evaluated as a measure of improved safety. Quantified risk assessments (QRAs) have been completed for the clone design NUI platforms. The QRAs evaluate all 14 fire and explosion hazard scenarios. The 13 Escalation is the failure of critical equipment e.g. other pipes, vessels, key structural members or evacuation equipment. 14 Various leak hole sizes and leak locations within the process area. chance of each of each hazard scenario escalating is assessed as part of the QRA. A sensitivity was run on the QRA model simulating the more rapid blow down. The change in risk values and the change in number of fire and explosion hazard scenarios categorized as controllable and evacuation 15 were calculated. The number of fire and explosion hazard scenarios that change their category due to the rapid blow down is shown in Table 2. The Rapid blow down reduces the number of evacuation hazard scenarios by 24 representing a reduction of 25%. The increase in the number of controllable fire & explosion hazard scenarios demonstrates a meaningful contribution to an inherently safer design. DISCUSSION The initial blow down rate is not the only variable that influences the number of controllable hazard scenarios. The volume of the inventory isolated when shut-in also has a significant impact. If, for example, the isolated inventory was reduced by one third, the flame length after 5 minutes would be reduced to 1m rather than the 5 m with the revised blow down rate. 16 The reason for discussing this volume is because the present design of the NUI platforms has emergency shut-down valves at the wells and export riser. The topside is effectively a single inventory. There 15 Evacuation hazard scenarios include fire & explosion hazard scenarios with the potential to escalate. 16 Based on a 10 mm dia. leak. 352

are two manifolds which have manual isolation valves separating them from the remainder of the topside pipe-work. 17 Both manifolds and the topside pipe-work have blow down valves installed. If these isolation valves were actuated and tied into the shut-down system there would have been three isolatable sections each with approximately one third of the inventory. As can be seen form the above when developing the hazard management strategy for process fires there is value in considering variations in both blow down characteristics and isolation philosophy. One item not discussed so far which should not be overlooked when developing the design of a blow down system is the effect that rapid blow down has on the temperature of the hydrocarbon, both upstream and downstream of the blow down valves. Very low temperatures can be generated at high blow down rates and appropriate pipe and vessel materials must be selected. The previous vent design used material good for 2208F. During a rapid blow down the gas temperature was calculated to drop to 2608F. However detailed heat transfer calculations determined that the steel wall temperature never dropped below 2408F. Material suitable for 2408F was procured for the vent. REFERENCES API 2007, Pressure-relieving and Depressuring Systems, Standard 521 BP 2008, Inherently Safer Design bp Group GP 48-04 BP 2009, Fire and Explosion Hazard Management (FEHM) of Offshore Facilities GP24-20 Spouge, John 1999, A guide to Quantified Risk Assessment for Offshore Installations CMPT publication 99/100a 17 Used to isolate a manifold for maintenance purposes. 353

APPENDIX A: BLOW DOWN SPREADSHEET SCREEN SHOTS Figure A1. Blow down to 50% of Operating Pressure in 15 mins. 354

Figure A2. Blow down to 50% of Operating Pressure in 15 mins. 10 mm dia. leak 355

Figure A3. Rapid blow down 356

Figure A4. As installed blow down 357