GP 24-20 - Fire and Explosion Hazard Management - Offshore - 0900a8668010d2ac PDF

Document No.
GP 24-20
Applicability Group
Date 30 December 2005
Guidance on Practice for

Fire and Explosion Hazard Management of
Offshore Facilities
GP 24-20
BP GROUP
ENGINEERING TECHNICAL PRACTICES
30 December 2005 GP 24-20
Guidance on Practice for Fire and Explosion Hazard Management of Offshore Facilities
Foreword
This is the first issue of Engineering Technical Practice (ETP) GP 24-20. This GP is a development of
RP 24-2, which has been divided into a series of GPs and GISs of which this GP is part. Related GPs
and GISs are:
BP
GP 24-10 Fire Protection - Onshore
GP 24-03 Concept Selection for Inherently Safer Design
GP 24-21 Onshore and Offshore Fire Hazard Analysis.
GP 24-22 Onshore/Offshore Gas Explosion Hazard Analysis.
GP 24-23 Offshore - Active Fire Protection.
GP 24-24 Offshore - Passive Fire Protection.
GIS 24-233 Fire Water Pumps and System Design.
GIS 24-071 Fine Water Spray Active Fire Protection.
GIS 24-072 Carbon Dioxide Extinguishment Systems
Page 2 of 64
Table of Contents
Page
Foreword ........................................................................................................................................ 2
1. Scope .................................................................................................................................... 6
2. Normative references............................................................................................................. 6
3. Terms and definitions............................................................................................................. 7
4. Symbols and abbreviations .................................................................................................... 8
5. General.................................................................................................................................. 9
5.1. FEHM Policy ............................................................................................................... 9
5.2. Responsibility and Timing ......................................................................................... 10
6. Fire and explosion hazard management (FEHM)................................................................. 10
6.1. Overview................................................................................................................... 10
6.2. Hazard categories..................................................................................................... 11
6.3. FEHM process .......................................................................................................... 12
6.4. FEHM and CVP ........................................................................................................ 12
7. CVP appraise....................................................................................................................... 13
8. CVP select........................................................................................................................... 13
8.1. General..................................................................................................................... 13
8.2. Hazard identification ................................................................................................. 13
8.3. Hazard evaluation ..................................................................................................... 15
8.4. Hazard conflicts ........................................................................................................ 15
8.5. Catastrophic hazards ................................................................................................ 15
8.6. Final evaluation......................................................................................................... 15
9. CVP define .......................................................................................................................... 15
9.1. Hazard identification during Define stage.................................................................. 15
9.2. Process and layout optimisation................................................................................ 16
9.3. Hazard analysis ........................................................................................................ 16
9.4. Assignment of hazard category................................................................................. 20
9.5. Hazard management strategy ................................................................................... 21
9.6. SCDM selection ........................................................................................................ 23
9.7. SCDM performance standards.................................................................................. 24
10. CVP execute........................................................................................................................ 26
10.1. General..................................................................................................................... 26
10.2. Final risk assessment ............................................................................................... 27
10.3. Documentation.......................................................................................................... 27
11. CVP operate ........................................................................................................................ 30
A.1. SCDM tables........................................................................................................................ 31
A.2. Table descriptions................................................................................................................ 31
A.2.1. General..................................................................................................................... 31
Page 3 of 64
A.2.2. Protected areas and equipment ................................................................................ 31

A.2.3. Fire and explosion hazards ....................................................................................... 31
A.2.4. Default SCDM........................................................................................................... 32
A.2.5. SCDM Rank.............................................................................................................. 32
A.2.6. Hazard management role.......................................................................................... 32
A.2.7. Performance standards............................................................................................. 32
A.2.8. Table notes ............................................................................................................... 33
A.2.9. Common SCDM........................................................................................................ 33
A.3. Default tables ........................................................................................................... 34
A.3.1. Wellbays ................................................................................................................... 34
A.3.2. Oil and condensate separation.................................................................................. 37
A.3.3. Gas drying, purification, and gas liquids recovery ..................................................... 45
A.3.4. Oil pumping and metering ......................................................................................... 47
A.3.5. Gas compression ...................................................................................................... 51
A.3.6. Flare knockout drums ............................................................................................... 53
A.3.7. Export/import systems and risers .............................................................................. 55
A.3.8. Risers and turrets on FPSOs .................................................................................... 57
A.3.9. Hazardous drains systems........................................................................................ 59
A.3.10. Drilling and well service facilities ............................................................................... 61
A.3.11. Methanol storage ...................................................................................................... 63
Bibliography .................................................................................................................................. 64
List of Tables
Table A.1 - Wellbay with low pressure oil production .................................................................... 34

Table A.2 - Wellbay with high pressure gas lifted oil production .................................................... 35
Table A.3 - Wellbay with gas production wells .............................................................................. 36
Table A.4 - Low pressure oil separation in roofed modules ........................................................... 37
Table A.5 - High pressure oil and condensate separation in roofed modules ................................ 39
Table A.6 - Low pressure oil separation on open decks ................................................................ 41
Table A.7 - High pressure oil and condensate separation on open decks ..................................... 43
Table A.8 - Gas drying, purification, gas liquids recovery on top decks and roofed modules......... 45
Table A.9 - Oil pumping and metering in roofed modules.............................................................. 47
Table A.10 - Oil pumping and metering on open or top decks ....................................................... 49
Table A.11 - Gas compression on top decks and roofed modules................................................. 51
Table A.12 - Flare knockout drums on top decks and roofed modules .......................................... 53
Table A.13 - Export/import systems and risers on fixed and floating facilities................................ 55
Table A.14 - Risers and turrets on FPSOs .................................................................................... 57
Table A.15 - Hazardous drains systems in roofed and enclosed modules..................................... 59
Page 4 of 64
Table A.16 - Drilling and well service facilities............................................................................... 61

Table A.17 - Methanol storage ...................................................................................................... 63
List of Figures
Figure 1 - Fire and explosion hazard management summary........................................................ 14
Page 5 of 64
1. Scope
a. This Guidance on Practice (GP) provides guidance on developing, implementing, and

maintaining fire and explosion hazard management (FEHM) for lifecycle of offshore
facilities.
b. Requirements for onshore facilities are in GP 24-10.
c. FEHM is the systematic identification of hazards, evaluation of their likely effects, and
definition of suitable elements to manage hazards and their effects to achieve minimum
risk for those who operate facility.
d. FEHM shall be used to deliver an effective fire and explosion hazard management strategy
for each well, production, processing, and export facility.
e. FEHM guidance is applicable to the following personnel:
1. Project managers.
2. Risk, process, control, and layout disciplines.
3. Hazards analysts.
4. Process safety and fire protection engineers.
5. Operators.
f. Guidance in this GP shall be applied to new offshore facilities and used for assessment of
modifications to existing offshore facilities.
g. There is no requirement for retroactive application of this GP to existing facilities.
h. FEHM shall be applied to identify major accident hazards resulting from fires and
explosions. This should include major non-process flammable and combustible inventories
such as methanol and diesel.
i. FEHM process described in this GP is not specifically required for utility areas or
accommodation fire hazards unless they are required to be protected from effects of
external hydrocarbon fires or explosions. These particular fire hazards should be managed
using established codes and standards for design, construction, and operation.
2. Normative references
The following normative documents contain requirements that, through reference in this text,
constitute requirements of this technical practice. For dated references, subsequent amendments to, or
revisions of, any of these publications do not apply. However, parties to agreements based on this
technical practice are encouraged to investigate the possibility of applying the most recent editions of
the normative documents indicated below. For undated references, the latest edition of the normative
document referred to applies.
BP
GP 24-03 Concept Selection for Inherently Safer Design
GP 24-10 Fire Protection - Onshore
GP 24-21 Onshore and Offshore Fire Hazard Analysis.
GP 24-22 Onshore/Offshore Gas Explosion Hazard Analysis.
GP 24-23 Offshore - Active Fire Protection.
GP 24-24 Offshore - Passive Fire Protection.
Page 6 of 64
GP 30-76 Safety Instrumented Systems (SIS) – Development of the Process

Requirements Specification.
GP 48-50 Major Accident Risk Process.
IMFS BP Integrity Management Functional Standard.
BP HAZID HAZID information in BP.
BP EER Escape Evacuation and Rescue information in BP.
BP OL Offshore Facility and Plant Layout information in BP.
3. Terms and definitions
For the purposes of this GP, the following terms and definitions apply:
Catastrophic hazard
Hazard of severity such that preservation of lives of personnel on facility cannot be demonstrated and
design is such that effects cannot be mitigated to allow controlled evacuation.
Controllable hazard
Hazard that has potential for local damage, harm to personnel, and local escalation but does not have
potential to endanger entire facility or endanger personnel sheltering at muster points or refuges.
Ductile level blast

a. Predicted level of explosion event that facility or facility design is expected to tolerate but
which may cause permanent and significant damage.
b. Explosion overpressure and drag loads may lead to failure or permanent (plastic)
deformation of structure, vessel supports, and pipe systems, which could cause local loss
of containment of hydrocarbon or other flammable substances.
c. Design should prevent such damage from leading to uncontrolled escalation to major
inventories.
d. Key incident control and mitigation SCE should function to allow personnel to escape to
TR (temporary refuge), shelter for designated endurance period, then evacuate if necessary.
Evacuation hazard
Hazard that after a defined period of time may have potential to endanger lives of personnel on facility
through progressive escalation or through eventual impairment of muster areas and evacuation
systems.
Fire and explosion hazard management (FEHM)

a. Systematic identification of hazards, evaluation of their likely effects, and definition of
suitable elements to manage hazards and their effects to achieve minimum risk for those
who operate facility.
b. Part of evaluation process is to determine whether a hazard has potential for leading to
major accidental event.
Fuel
Any flammable gas or liquid.
Hazard category
Hazards are defined in three categories:
a. Controllable.
Page 7 of 64
b. Evacuation.
c. Catastrophic.
Major accidental event

Fire, explosion, or release of dangerous substance:
a. Involving death or serious injury to persons on facility or working at facility. This usually
involves more than one death or serious injury. This does not include occupational hazards
managed through operations management system for facility.
b. Resulting, directly or indirectly, in significant environmental impact.
c. Resulting in major damage to structure of facility or plant, with significant loss of
production capacity.
d. Likely to damage BP reputation.
Muster area
Predefined area for temporary refuge where personnel can safely assemble to assess hazard, take roll
call, and prepare to evacuate facility.
Safety critical design measure (SCDM)

a. Elements of design incorporated specifically to provide FEHM.
b. Elements of structure, layout, plant, protective systems, processes, or procedures may have
defined role in avoidance, prevention, control, or mitigation of each identified hazard.
c. Failure of SCDM could directly or indirectly lead to major accidental event.
Strength level blast

a. Predicted level of explosion event that facility or facility design is expected to tolerate
without permanent or significant damage.
b. Explosion overpressure and drag loads should not cause loss of containment of
hydrocarbon or other flammable substances through failure or permanent deformation of
structure, vessel supports, and pipe systems.
c. Incident control and mitigation SCDM should also function.
4. Symbols and abbreviations
BOP Blow out preventer
CBA Cost benefit analysis.
CFD Computational fluid dynamics.
CVP Capital value process.
DHSV Downhole safety valve.
DLB Ductile level blast.
EER Escape evacuation and rescue.
EHA Explosion hazard analysis.
Page 8 of 64
ESD Emergency shutdown.
FEHM Fire and explosion hazard management.
FEHR Fire and explosion hazard register.
FHA Fire hazard analysis.
FPSO Floating production, storage, and offloading unit.
HAZID Hazard identification study.
HAZOP Hazard and operability study.
NGL Natural gas liquids.
QRA Quantitative risk assessment.
SCE Safety Critical Equipment
SIL Safety integrity level.
SCDM Safety critical design measure.
SDV Shutdown valve.
SIMOPS Simultaneous operations – drilling & construction or operations and construction
SLB Strength level blast.
SSIV Subsea isolation value.
TR Temporary refuge.
5. General
5.1. FEHM Policy

a. BP operations with offshore facilities shall manage fire and explosion hazards to ensure the
safety of personnel from those hazards that may be reasonably anticipated.
b. Each BP operated offshore facility shall have a written process for Fire and Explosion
Hazard Management (FEHM).
c. FEHM implementation will result in considerable protection of assets and against business
losses. Further specific protection for asset and against business losses should only be
performed following request from client/operator and should be subjected to cost benefit
analysis (CBA).
d. To achieve effective FEHM, a wide range of operational groups, plant, procedures, and
process personnel shall work together.
e. FEHM shall be implemented by the following personnel:
1. Project managers and operations managers as these personnel are responsible for
effective FEHM through all phases of facility lifecycle.
Page 9 of 64
2. Major accident risk, process, control, and layout discipline personnel: FEHM enables
them to optimise their designs such that they minimise frequency and consequence of
fire and explosion hazards.
3. Hazard analysts: FEHM enables them to identify and quantify fire and explosion
hazards in a form that can be used by engineers and operators.
4. Process safety and fire protection engineers: FEHM enables them to design active and
passive protection systems applicable to identified fire and explosion hazards.
5. Operators: FEHM enables them to ensure that design and application of fire and
explosion hazard management strategies and systems comply with and support
operations and maintenance philosophy, ensure personnel safety, and protect the
environment.
5.2. Responsibility and Timing

a. Project manager shall be responsible for FEHM process implementation described in this
GP during the design and construction of a new facility or modifications to an existing
facility.
b. Decisions arising from FEHM process shall be approved, accepted, and implemented by
future operations managers throughout the facility lifetime.
c. FEHM process shall begin during CVP (Capital Value Process) appraise stage and shall be
applied to all CVP stages throughout the facility lifetime.
6. Fire and explosion hazard management (FEHM)
6.1. Overview
6.1.1. Philosophy
a. FEHM shall demonstrate that fire and explosion risks have been identified, understood,
and systems and processes are in place to effectively manage these risks.
b. FEHM shall demonstrate that risks to personnel on facility comply with BP reporting
criteria identified in GP 48-50 and/or comply with project risk criteria.
c. FEHM shall comply with any client/operator risk criteria or national risk criteria.
d. FEHM should be agreed upon by future operator of facility to ensure that operator:
1. Knows purpose and capability of all SCDMs (safety critical design measures).
2. Can operate SCDMs properly.
3. Has adequate maintenance schemes in place.
4. Has included these maintenance schemes into operating procedures.
6.1.2. Fire and explosion hazard hierarchy

Fire and explosion hazards shall be managed according to this hierarchy:
a. Elimination.
b. Prevention.
c. Detection and control.
d. Mitigation.
e. Emergency response, including muster and evacuation.
Page 10 of 64
6.1.3. SCDM hierarchy

SCDMs to manage hazards shall be selected according to this hierarchy:
a. Passive.
b. Active.
c. Procedures.
d. External support.
6.2. Hazard categories
6.2.1. General
a. In implementation of FEHM, the project or operational team shall identify hazards and
then determine what hazard category the identified hazard shall be placed. Hazard
categories determine how each hazard will be managed.
b. Fire and explosion hazards shall be sorted into three hazard categories:
1. Controllable.
2. Evacuate.
3. Catastrophic.
6.2.2. Controllable hazards

a. FEHM should reduce severity of hazards such that they are in the controllable category.
b. Controllable hazard risks shall comply with all required BP Group or project risk criteria.
c. Controllable hazards shall be managed such that:
1. Evacuation is not required and personnel shall remain safely on the facility.
2. Damage to facility is minimal.
Precautionary evacuation may take place if it is safe to do so. In areas of the world
where evacuation has significant inherent risks, larger hazards may be included in
the controllable category.
d. Controllable hazards shall be defined as hazardous events that have potential for:
1. Local damage.
2. Harm to personnel.
3. Local escalation.
e. Controllable hazards shall not have potential to directly endanger:
1. Entire facility.
2. Personnel sheltering at muster areas.
6.2.3. Evacuation hazards

a. Evacuation hazards shall be defined as events that have potential to endanger lives of all
personnel on the facility through progressive escalation and/or through eventual
impairment of muster areas and evacuation equipment.
b. Evacuation hazards shall comply with all required risk criteria including major accident
risk criteria in GP 48-50.
c. During project design, evacuation hazards should have nominal combined frequency of
less than one in 10 000 yr (10-4/yr).
Page 11 of 64
d. Evacuation hazards shall be managed such that integrity of escape routes, muster areas,
and evacuation equipment is maintained for a defined time period, during which it can be
demonstrated that controlled evacuation from the facility can be performed.
e. Frequency of evacuation hazards shall be actively managed over and above that required
for controllable hazards.
f. The project team shall design facilities such that frequency of evacuation is at lowest
reasonably practical level, particularly if it is inherently hazardous to evacuate due to
weather conditions and location.
6.2.4. Catastrophic hazards

a. Catastrophic hazards shall be defined as severe events in which preservation of life of
personnel on facility cannot be demonstrated and effects of hazard cannot be controlled or
mitigated such that controlled evacuation can be performed.
b. Catastrophic hazards shall comply with all required risk criteria including major accident
risk criteria in GP 48-50.
c. During project design, catastrophic hazards should have nominal combined frequency of
less than one in 100 000 yr (10-5/yr).
6.3. FEHM process

a. FEHM process should ensure that fire and explosion hazards are identified and evaluated
and that associated risk is actively managed and reduced to lowest practical level.
b. Resources should be assigned to manage hazards on basis of risk.
c. FEHM process shall:
1. Follow principles of inherently safe design.
2. Identify fire and explosion hazards at early stage in design.
3. Optimise facility layout to minimise impact of hazards.
4. Analyse consequences of fire and explosion hazards.
5. Assign hazards to categories of:
a) Controllable.
b) Evacuate.
c) Catastrophic.
6. Select strategies to manage hazards.
7. Select and specify performance standards for SCDM to implement strategy.
8. Complete final risk assessment and documentation.
9. Implement hazard management strategy and maintain SCDM.
10. Update FEHM strategy and manage changes throughout facility life.
6.4. FEHM and CVP

a. FEHM process throughout various CVP stages is summarised in Figure 1.
b. FEHM should:
1. Begin during CVP appraise stage.
2. Be fully developed during CVP select, define, and execute stages.
3. Continue for facility lifetime through CVP operate stage.
Page 12 of 64
7. CVP appraise
a. The project development team shall identify risks from fires and explosions and costs of
mitigation measures.
b. The project development team shall conduct a preliminary major accident risk assessment
as outlined in GP 48-50.
c. Assessment process outlined in GP 24-03 should be used in this stage
d. FEHM process shall identify primary risk drivers associated with:
1. Well fluid properties: pressure, temperatures, toxicity, corrosivity.
2. Drilling and well service requirements: number of wells, workover requirements.
3. Storage and export requirements and limitations.
4. Limitations on choice of concept (e.g., deep water).
5. Particular processing requirements.
6. Simultaneous operations of future drilling and production of hydrocarbons
e. FEHM process should consider manageability of major hazards. Particular attention should
be paid to major hazards that may expose large numbers of personnel or processes and
equipment that require frequent hazardous intervention.
f. Potential costs, design requirements, and limitations on choice of concept or operations
arising from major accident hazards should be considered in overall commercial and
technical appraisal of development, as outlined in GP 24-03.
8. CVP select
8.1. General
An initial FEHM evaluation shall be conducted.
Select stage requires development of a number of radically different concepts and
selection of best option as described in GP 24-03.
8.2. Hazard identification

a. Hazard identification (HAZID) exercise shall be performed on each potential facility
hazard.
b. HAZID shall begin in parallel with development of structure, reservoir development, and
process design philosophies.
c. HAZID studies shall follow scope as described in GP 24-03.
d. Hazard listing should be continually updated as each concept evolves.
Page 13 of 64
Figure 1 - Fire and explosion hazard management summary
• Identify primary risk drivers.

• Consider risks and manageability of major hazards in
APPRAISE appraisal.
• HAZID on each option.

• Optimisation of each option to minimise risks.
• Initial categorisation of hazards and particular
requirements for each option.
SELECT
• Compare risks, manageability, and particular resources
required for hazards when selecting concept.
• Systematic hazard identification.

• Optimise layout and process to minimise causes,
severity, and consequences.
• Hazard analysis of causes and consequences.
• Reassignment of hazard categories.
DEFINE • Selection of strategy to manage hazards based on
categorization.
• Identify SCDMs and processes to implement hazard
management.
• Specify SCDMs, processes, and performance standards
to implement hazard management.
• Design SCDMs to meet performance standards

throughout working life.
• Develop processes and procedures for operation.
EXECUTE • Perform final risk assessment.
• Prepare hazard management documentation for delivery
to operations.
• Verify implementation, operation, and performance of

hazard management process.
OPERATE
Page 14 of 64
8.3. Hazard evaluation

a. Initial qualitative estimate of likelihood and consequences of each hazard should be
performed and each risk ranked with primary reasons for any high risk ranking listed.
b. Scoping calculations should be performed to determine potential magnitude of fires and
explosions with sufficient duration or magnitude to cause escalation or require evacuation.
Guidance for scoping calculations shall be found in GP 24-21 and GP 24-22.
c. Information should be used to optimise facility layout and process design to reduce fire
and explosion risk.
8.4. Hazard conflicts

a. Initial pattern of risks from fires and explosions should be drawn up as portion of overall
risk picture.
b. Each primary fire and explosion risk driver should be allocated hazard category
(controllable, evacuate, or catastrophic).
c. Particular requirements to manage hazards within category (e.g., SCDM, process changes,
procedures, or operating limits) should be listed.
d. During concept selection process, relative fire and explosion risks of each concept and
costs and difficulties of managing each hazard within the selected category should be
considered as part of overall process.
Conflicts occur if reduction in risks of one hazard increases risks from other
hazards, particularly conflicts between fires and explosions.
e. Concepts with less dependence on evacuation should be considered favourably,
particularly if large numbers of personnel are present, or unfavourable weather conditions
occur.
8.5. Catastrophic hazards

a. Hazards classified as catastrophic shall be mitigated by preventable solutions if at all
possible.
b. All parties, project, operations, and drilling shall formally accept their commitment to
mitigate catastrophic hazards.
8.6. Final evaluation

a. Final concept selection shall take into account risks from fires and explosions and shall
judge practicality of managing them according to category.
b. Judgment shall comply with process in GP 24-03 and GP 48-50.
9. CVP define
9.1. Hazard identification during Define stage

a. Hazard identification shall be performed on formalised systematic basis.
b. Primary means of fire and explosion hazard identification shall be HAZID studies covering
complete facility. This should include all areas of facility and should incorporate changes
and increasing detail as design progresses.
c. Other hazard identification methods may be considered in place of HAZID. Full list of
hazard identification studies will depend on complexity and uniqueness of project.
Page 15 of 64
d. Hazard identification should ensure all hazards have been identified and are considered in
hazard analysis. HAZID process is described in detail in BP HAZID information.
Special note should be made if fires may be preceded by confined explosion.
9.2. Process and layout optimisation

a. In the early phase of CVP define, the project team should highlight hazards that do not fit
within controllable categories.
b. For these hazards, risk reduction at source should be examined and proceed in following
order:
1. Efforts should be focused on reducing hazard severity by:
a) Reducing hydrocarbon release size and duration by minimising processing
pressures, inventories, and potential hole sizes.
b) Reducing likelihood of ignition by maximising ventilation.
c) Increasing distance between ignition sources and hazards.
d) Reducing potential explosion overpressures by maximising ventilation and
minimising congestion and confinement.
e) Minimising fire intensity and external flaming by reducing confinement and
release pressures.
f) Exclusion of flammable clouds from sensitive areas (e.g., preventing releases
from entering confined or adjacent spaces).
2. Efforts should be focused on minimising potential for escalation by:
a) Separation and segregation of explosion hazards and large inventories.
b) Separation of SCDM, muster areas, and evacuation equipment from immediate
effect of explosion and prolonged effect of large fires.
3. Efforts should be focused upon minimising effects on muster and evacuation by:
a) Location of muster areas and evacuation equipment such that they are separate
from major hazards by distance and location.
b) Segregation through fire and blast barriers.
For example, on a fixed jacket facility, lower level location of muster area and
evacuation equipment provides significant protection from external flaming, smoke
gas, and radiated heat.
4. Further guidance may be obtained from the following:
a) Optimising facility layout in BP OL information (Offshore plant layout).
b) Opportunities for reducing severity of hazards in Annexes of GP 24-03.
9.3. Hazard analysis
9.3.1. General
a. Progressively deeper understanding of hazard causes, consequences, and potential for
escalation should be developed during CVP define stage.
Hazard understanding provides core information on which to base hazard
management decisions and designs that flow from them. It is not a retroactive
exercise to be performed on completed design.
b. The project team shall define which hazard analysis studies are required to understand fire
and explosion hazards.
Page 16 of 64
c. Principal understanding of fire hazards is provided by GP 24-21.

d. Principal understanding of explosion hazards is provided by GP 24-22.
e. Initial early scoping studies should be performed. These scoping studies should be used to
define need for more detailed analysis, concentrating on greatest risk drivers and hazards
that are not well understood.
Examples of additional hazard analysis studies that may be required are:
• Smoke and gas ingress analysis.
• Dropped object study.
• Muster area.
• Temporary refuge integrity study.
• Riser integrity or subsea isolation value (SSIV) study.
• Progressive collapse analysis.
• Thermal loading study.
Detailed studies, such as computational fluid dynamics for fires and quantitative
risk assessment, should be carefully managed. Detailed methods should only be used
if early scoping studies indicate cause for concern (i.e., hazards contribute
significantly to overall risk, and deeper understanding is critical to managing
hazards effectively and specifying SCDMs).
f. Hazard analysis shall identify fires or explosions in evacuation or catastrophic categories.
g. Severity of fires and explosions should be quantified in terms of:
1. Type of hazard (e.g., gas jet fire, liquid spray fire, pool fire, explosion).
2. Overpressure and impulse.
3. Heat loadings.
4. Size and duration of heat loadings.
5. Location of items that may fail.
6. How failure can lead to escalation or impairment of muster areas and evacuation
equipment.
7. Timing of failures that can impair muster areas and evacuation systems.
h. Quality of analysis should depend on potential for and timing of escalation and
impairment.
Awareness of hazards and their cause and effect is the greatest risk reducer for an
operating plant. Understanding derived from this systematic examination should be
shared with the whole design team, summarised, and delivered to future operators
either within or as a supplement to fire and explosion hazard register (FEHR).
i. Quality of information from fire and explosion analysis should be re-examined to
determine if the information is sufficient to specify measures to limit severity, withstand
effects, protect plant, and safeguard personnel.
j. Enhanced analysis techniques should not automatically be initiated.
They are only required if level of accuracy of initial scoping studies is insufficient
for decision making or for design of SCDMs, such as fire and blast walls. It is more
important to empirically analyse a large range of scenarios than to accurately
model a small number of specific cases. Enhanced analysis techniques include:
Page 17 of 64
• Process simulation model to accurately calculate release rates versus time for
larger number of hole sizes. This can examine effects of optimised isolation,
different depressurisation rates, and effects of delayed operation.
• Computational fluid dynamics (CFD) models to quantify flammable gas cloud
sizes and concentrations.
• CFD models to quantify explosion overpressures from a range of scenarios.
• CFD models to quantify severity of external flaming from confined modules.
• CFD models to quantify density and toxicity of smoke around escape routes,
muster areas, and evacuation equipment.
9.3.2. Fire hazard analysis

a. The project or operational team shall use the Fire hazard analysis (FHA) as described in
detail in GP 24-21.
b. Fire hazard analysis shall:
1. Establish all distinct fuel inventories based on size and location of equipment, and
arrangement of isolation and blow down valves. Facility should be divided into areas,
and if necessary, sub-areas.
2. Identify mass of flammable material, phase, composition, pressure, and fire hazard
type for each fuel inventory.
3. Consider a range of hole sizes. This shall at least include leaks of
a) 12 mm (0.5 inch)
b) 25 mm. (1.0 inch)
c) 50 mm. (2.0 inch)
4. Examine adequacy of strategies selected to manage hazard.
5. Consider hazard scenarios if passive and active SCDM operate as designed.
6. Examine failure of at least one active SCDM if active SCDMs are present.
For example, 50 mm, 25 mm, and 12 mm diameter holes, in which ESD and blow
down operate as designed, and 12 mm diameter hole, in which ESD operates as
designed, but operation of blow down is delayed.
7. Identify extent and duration of heat loads and smoke generation and dispersion for
each fire scenario.
8. Identify potential for damage.
9. If damage can lead to evacuation, identify timing and paths to escalation for each
scenario.
This should provide sufficient information to enable assignment of hazard to one of
three categories: controllable, evacuate, and catastrophic.
10. Be updated as design progresses and as strategies to manage hazards are selected and
defined.
9.3.3. Explosion hazard analysis (EHA)

a. Explosion hazard analysis (EHA) shall define explosion scenarios to be examined.
This will involve identification of most likely sites for significant release of
flammable gas or other flammable substance and build up of gas cloud. Typical
explosion scenario should include:
Page 18 of 64
• Mass flow rate of flammable release over time, taking into account gas detection
and response times for ESD (emergency shutdown) and blowdown.
• Calculation of flammable cloud development in area concerned with
determining maximum gas cloud volume, buildup time, steady state
concentration, and decay time.
• Most likely ignition sources or assessment of worst case ignition location.
b. EHA should be conducted for cloud size ranges predicted for defined scenarios to
determine range of overpressure and drag loads produced in relation to cloud size.
c. EHA at this stage should correspond to level 2 assessment as defined in GP 24-22.
d. EHA shall identify:
1. Ventilation rates for each area (module) based on various wind speeds and directions.
2. Options for ventilation improvement (grating, plating, walls).
3. Gas cloud sizes using gas accumulation analysis based on project supplied scenarios.
4. Gas cloud size for various leak rates (e.g., 2 kg/s, 5 kg/s, 10 kg/s, 20 kg/s, 40 kg/s, 60
kg/s).
5. Gas cloud size versus wind speed (e.g., 2 m/s, 6 m/s, 10 m/s).
6. Gas cloud size versus wind direction (e.g., east, west, north, south).
7. Effect of design options (e.g., walls, grating, plating, forced ventilation).
8. Effect of leak location and direction.
9. Effect of gas detection reliability (coverage and redundancy) on gas cloud buildup
rate.
10. Effect of blowdown and isolation on buildup rate and decay rate.
11. Explosion effects for each area.
12. Explosion overpressure load and impulse versus cloud size, duration, and variation
with time for both SLB (strength level blast) and DLB (ductile level blast).
13. Structural response to imposed loads for both SLB and DLB.
14. Drag loads for piping and large vessels.
15. Effect of ignition location.
16. Effect of gas cloud location and shape.
17. Effect of changes in design of control or mitigation options (e.g., walls, grating).
18. Structural loads for main structure, walls, decks, equipment, and piping supports.
19. Identification of items of plant and equipment that are vulnerable to explosion load
and failure that could lead to critical escalation.
20. Options for controlling and mitigating explosion hazards.
21. Definition of safety critical design elements for control and mitigation.
e. EHA should be performed with close cooperation between explosion analysts and project
team (management and structural, layout, piping, and safety engineers), as options for
design changes need to be discussed and assessed quickly for rejection or implementation.
f. EHA shall be updated as design progresses and strategies to manage hazards have been
selected and defined.
Page 19 of 64
9.4. Assignment of hazard category
9.4.1. General
a. FEHM process shall assign each identified hazard to one of three hazard categories:
1. Controllable.
2. Evacuate.
3. Catastrophic.
b. Assignment of hazards to these categories should be based on potential for and timing of
damage and escalation from FHA and EHA.
Core of FEHM process is determination of hazard category. This defines how
hazard is managed, defines what hazard management strategies and SCDMs are
needed, and sets performance requirements of SCDMs.

a. FHA shall demonstrate that controllable hazards do not have sufficient severity to directly
endanger entire facility or personnel sheltering at muster areas.
b. Controllable hazards may become evacuate hazards as result of:
1. Fire or explosion effects endangering overall infrastructure of facility such that it is
not practical to control incident or prevent escalation. This should consider combined
impact on facility structural integrity, electrical, process monitoring and control, ESD,
internal and external communications, well control systems, firewater, and access and
escape routes.
2. Potential for progressive escalation, particularly multiple hydrocarbon releases
following explosion.
3. Impracticality of protecting against severity of event, particularly for high
overpressures or large prolonged fires.
4. Physical effects of hazard on muster areas and evacuation systems.
5. Psychological impact on personnel and their insistence upon evacuation.
9.4.3. Evacuate hazards

a. Fire and explosion hazards that are not controllable should be initially assigned evacuate
category.
b. Hazards initially assigned to evacuate category should be examined in escape evacuation
and rescue (EER) study to confirm that EER can be successfully accomplished in defined
time period. EER study process is described in detail in BP EER information (Escape,
Evaluation, and Rescue).
Typical time required for personnel to accomplish controlled evacuation of large
facility is 45 min to 60 min.
c. Evacuation hazards may become catastrophic hazards for the following reasons:
1. Overall impact of hazard such that it is impractical to protect muster point for
sufficient duration to allow orderly muster and evacuation.
2. Hazard zone size such that it is impractical to locate evacuation systems such that at
least one means of controlled evacuation is viable and not exposed to excess heat and
smoke.
Page 20 of 64
3. Hazard zone is very large and creates so much disruption that personnel are divided
and unable to muster in one place, accurate head count cannot be achieved, or each
group cannot evacuate in safe controlled manner.
4. Hazard escalates so rapidly that muster areas and evacuation equipment become
overwhelmed before controlled evacuation can be achieved.
Hazards may include continuous releases from reservoir arising from drilling, well
service, or completion failure. Hazards may result from large liquid processing
inventories where smoke and flaming effects of very large fires create prolonged
exposure of plant and muster areas. Hazards may also be associated with
hydrocarbon releases concurrent with SCDM failure, such as failure of ESD to
close.
Projects should avoid classifying riser releases outboard of topsides SDV (shutdown
valve) as evacuation hazards, particularly on fixed single jacket facilities. Resultant
fires could be catastrophic and should be classified as such. Fitment of subsea
isolation valves might reduce duration and immediate effects of these failures, but
they can still result in multiple fatalities.

Hazards for which successful EER cannot be demonstrated in defined endurance period shall be
assigned to catastrophic category.
Typical example of catastrophic hazard is release from gas export line downstream
of last SDV.
9.5. Hazard management strategy
9.5.1. General
a. Management strategy and mitigation methods shall be selected for each fire and explosion
hazard.
b. Strategy selected shall be appropriate for the hazard category to which the hazard has been
assigned.
c. Five basic hazard management strategies should be applied sequentially until adequate
defence in depth is provided. The five basic strategies are, in descending order of
preference:
1. Eliminate.
2. Prevent.
3. Detect and control.
4. Mitigate.
5. Emergency response (including muster and evacuation).
d. Hazard management strategy should include comprehensive suite of prevention measures
and measures to detect, control, mitigate, and potentially evacuate.
e. Particular strategy should be selected early in the design phase while it is still possible to
optimise design, minimize hazards, and take credit for these features before committing
expenditure on extensive protection.
f. Default set of strategies and SCDMs for a large integrated facility are described in Annex
A.
g. Selection of SCDM to implement these strategies and performance required of those
SCDMs is defined in 9.6 and 9.7.
Page 21 of 64
h. Active management strategies should be used to provide knowledge of hazards and

associated risks. Chosen strategies shall attempt to reduce risks to personnel to lowest
feasible level.
It is not acceptable simply to provide an array of SCDMs and to retroactively
attempt to justify their adequacy.

a. Hazards in controllable category shall be managed through engineering codes and
standards, BP Group ETPs, and established operational practices and controls.
If FHA demonstrates hazard is in controllable category, it may be managed by
application of prevention measures specified in BP Group ETPs and codes and
standards, such as API RP 14C, API RP 14G, and API RP 14J.
b. Combination of measures to manage controllable hazards should include:
1. Prevention: to minimise frequency of loss of containment.
2. Detection: to identify hazards and initiate actions before harm occurs.
3. Control: to limit severity of hazards such that they do not impair muster areas and
such that it is possible to protect against effects.
4. Mitigation: to prevent escalation from these limited hazards and to protect personnel
until event is over.
c. Adequacy of strategies for controllable hazards shall be verified during process hazards
analysis (e.g., HAZOP and “What if?” review).
Precautionary evacuation may take place, if safe. It shall be possible to safely
remain on facility for these hazards. In areas of the world where evacuation has
significant inherent risks, larger hazards may be placed in controllable category.
9.5.3. Evacuation hazards

a. Evacuation hazards shall be managed such that integrity of escape routes, muster areas,
and evacuation equipment is maintained for sufficient period of time to allow controlled
evacuation from facility.
b. Combination of measures to manage evacuation hazards should include:
1. Prevention: to minimise frequency of hazards having potential to overwhelm facility.
2. Detection: to identify hazards, assist with assessment, and initiate emergency
response.
3. Control: to limit severity of hazards such that they limit hazardous effects upon
escape, muster, and evacuation systems until personnel can leave facility.
4. Mitigation: to delay catastrophic escalation and failure of SCDM and to suppress
effects of prolonged fires until evacuation is accomplished.
5. Muster and evacuation: to protect personnel and allow controlled evacuation to
safety.
Extensive measures to shield muster areas and evacuation equipment should be
considered as a last resort. If severity of event requires these measures, disruption
to entire facility is likely such that it is unreasonable to expect these measures and
other SCDM to work effectively. Characteristics of hazards of this scale and
unpredictability of escalation are such that orderly muster and effective evacuation
are unlikely to be successful.
Page 22 of 64
c. Facilities to muster and evacuate should always be provided. Choice of hazard

management strategies should reduce dependence on these facilities to minimum.
d. Evacuation is only acceptable as response to infrequent fire and explosion hazards.
Evacuation should only be considered if application of other strategies is unable to limit
damage and potential for escalation or reduce event frequency.
e. Emergency response and recovery plans shall be developed for each hazard.
f. Evacuation plans shall be developed for each evacuate category hazard.
g. Adequacy of escape evacuation and rescue systems provided shall be demonstrated in an
escape evacuation and rescue study (EER).

a. Measures to manage catastrophic hazards shall be limited to:
1. Operational limits to stop processing or drilling or to de-man facilities if activities are
planned that may create these hazards.
An example of this type of de-manning is when personnel are removed from an
offshore platform in advance of an impending hurricane.
2. Elimination of causes using inherently safer design principles should be reviewed
during CVP define phase for all hazards having potential to overwhelm facility.
3. Prevention measures to minimise frequency of hazards having potential to overwhelm
facility.
4. Detection measures to identify precursors of these hazards such that operations and
hazardous activities may be shut down or personnel removed from area.
b. Catastrophic hazards shall have sufficient QRA (quantitative risk assessment) performed to
demonstrate that they comply with all required risk criteria.
9.6. SCDM selection
9.6.1. General
a. FEHM process shall define role of SCDMs in managing impact of hazards.
b. FEHM shall clearly define performance and required survivability such that effective
SCDMs may be specified.
c. Specification of SCDMs shall follow processes described in appropriate ETPs.
d. SCDM selected to implement hazard management strategy shall comply with the IMFS.
e. Default set of strategies and SCDMs for large integrated facility are in Annex A.
f. SCDM selection should emphasise effectiveness and minimise potential for failure,
particularly through human error.
g. SCDM should include protective systems referred to in element 5 of the IMFS.
h. SCDM choice should also minimise maintenance with the reduced associated exposure of
personnel (i.e., fewer tasks in which to make mistakes and fewer people exposed).
i. SCDM should be classified in descending order of preference:
1. Passive
2. Active.
3. Procedural (i.e., operational controls).
Page 23 of 64
9.6.2. Passive SCDM

The project or operational team shall use GP 24-24 for details of design for passive systems.
Passive SCDMs act upon the hazard simply by their presence. Passive SCDMs do
not need to react to hazard nor need operator input at the time of occurrence in
order to be effective. The only modes of failure are long term deterioration, physical
damage, or removal. They are preferred because they are inherently most reliable,
requiring only inspection and maintenance, thereby reducing need for personnel in
hazardous locations.
Typical examples are bunds (dikes) to limit spread of oil leaks, natural ventilation,
fire and blast barriers, underlying structural integrity, passive fire protection, and
ignition prevention.
9.6.3. Active SCDM

a. The project or operational team shall use GP 24-23 for details of selection and design for
active systems.
b. The project or operational team shall use GP 30-76 for details on performance
requirements for safety instrumented systems.
Active SCDMs depend on detection of hazards, control signals, and mechanical,
electrical, or other end devices to prevent, control, or mitigate hazard.
Active SCDMs are susceptible to failure and unavailability due to downtime. As
such, they are less reliable than passive SCDMs, particularly if failures are
unknown. They require inspection, testing, and maintenance, and are susceptible to
human error or omission. They also increase staffing levels causing more personnel
to be exposed.
Typical examples are isolation systems, depressurisation systems, fire and gas
detection, and deluge.
9.6.4. Procedural SCDM

Procedural SCDMs depend primarily upon personnel either to initiate SCDM or to
perform the function.
Procedural SCDMs can be least reliable, particularly in emergencies, and require
fully trained alert personnel to ensure their operation, with associated minimum
competence and procedures.
Procedural SCDM effectiveness is wholly dependent upon operators, who should
understand dependence on these measures.
Typical examples are manual setting of choke valves to prevent sand erosion, visual
detection of oil leaks, and manual initiation of ESD.
9.7. SCDM performance standards
9.7.1. General
a. Performance standards shall be set for all SCDMs, including competencies and procedures
required to implement hazard management strategy.
Performance standard is a statement, expressed in qualitative or quantitative terms,
of performance requirement of SCDMs, item of equipment, person, or procedure
used as basis for managing hazard through lifecycle of facility.
b. Performance standards shall be endorsed by future operators and shall be documented for
delivery to future operations group.
Page 24 of 64
c. Performance standards shall reflect minimum level of reliability and performance to be

achieved over facility lifetime.
In some countries, the minimum standards are set in the regulation. The IMFS also
requires definition of minimum standards.
d. Performance standards should address the following with respect to assigned hazards:
1. Role.
2. Functionality.
3. Reliability.
4. Availability.
5. Survivability.
e. It should be practical to assess achievement of performance standards throughout lifecycle.
There should be realism about what is achievable in setting performance standards
for procedural controls. This should account for number of times activity would be
performed in operating lifetime, working conditions and competency and training of
personnel.
f. Level of detail adopted in setting performance standards should be commensurate with
magnitude of risk being managed.
Caution should be exercised to avoid setting performance standards for SCDMs or
components of SCDM that contribute little to overall risk reduction.
9.7.2. Role
Exact role that SCDM provides shall be defined before performance standard is set. Role shall
be defined with respect to particular hazards.
For example, role of a depressurisation system may not simply be to meet a
particular depressurisation rate in code. It could be prevention of vessel rupture in
high pressure condensate fire or reduction of duration of gas fire such that it does
not cause equipment failure.
9.7.3. Functionality
a. Minimum performance necessary to fulfil role shall be defined.
b. During operation of SCDM, failure to achieve minimum performance shall require
immediate repair or replacement or shall be considered a change and therefore initiate
management of change systems.
Codes and standards often provide or infer default standards and the means to
achieve them. If these are the start point, code suitability should be verified against
specific hazard requirements to confirm effectiveness.
Typical examples of functional performance for engineered SCDM are:
• Sensitivity and response time of gas detectors.
• Fire rating of passive fire protection: J30, H60, etc.
• Application rate of firewater to keep specified vessel temperature.
• Maximum blockage of ventilation or venting spaces.
For example, functional performance standard of fire pump may be defined by
response time, run time, and flow and pressure curve that can meet different and
multiple demands of each major accident hazard scenarios in which water is critical
to mitigation.
Page 25 of 64
c. Safety factor shall be applied if there is uncertainty about accuracy of results of hazard
analysis.
d. Safety factor shall be applied if performance of SCDM may reduce over time due to
mechanical deterioration, corrosion, or environmental degradation.
Research has shown that intensity of process hydrocarbon fire and explosions may
be greater than that used as basis of international codes and standards. Products
may have been developed and certified against these hazards of lesser intensity.
Appropriateness of any default design code shall be confirmed. If there are no
internationally recognised codes and system design is based upon interpretation of
research, an appropriate design safety factor shall be applied above minimum
successful test results.
9.7.4. Reliability and availability

a. Probability of failure on demand of SCDM shall be set based on expected frequency of
initiating event and hazard severity.
Probability of failure on demand has two components: reliability and availability.
These affect probability that functionality of SCDM will be achieved.
b. Reliability shall be verified by functional testing at predetermined intervals.
c. Availability shall be defined by maximum allowable downtime in fixed period.
d. Existing criticality systems may be used to set probability of failure on demand. For
example, there are existing criticality systems for competence, corrosion management,
structural integrity, and instrumented safety systems. These should be integrated into
overall system for facility hazard management such that there is common perception of
relative importance of all systems.
For example, instrumented safety system or interlock will have probability of failure
on demand defined by Safety Integrity Level (SIL). Criticality system for setting of
SIL levels is in GP 30-76.
9.7.5. Survivability
a. SCDMs required to operate or maintain integrity during or after an event shall have
sufficient strength, protection, or redundancy to comply with performance standards for
specified period after initial event. This should be defined by standards for survivability
and expressed in terms of severity of event that it should survive.
For example, flammable gas detection system does not need to survive fire or
explosion, as it has already fulfilled its role in incipient stages of the event.
Separator and connected piping and instruments may have to maintain integrity if
exposed to 500 mbar explosion overpressure, and ESD valve actuator and power
supplies may have to be fail safe and protected from jet fire until it has closed.
b. Survivability of critical SCDM shall be demonstrated in emergency system survivability
study.
10. CVP execute
10.1. General
a. SCDMs required to implement FEHM strategy shall be designed such that minimum
performance can be achieved throughout working life of facility.
b. Purchase specification should include allowance for performance deterioration.
Page 26 of 64
c. Changes in process or layout shall be managed by rigorous management of change

procedure. If necessary, specification of strategies and SCDMs should be revised.
Explosion overpressures in confined modules may increase as detailed design
progresses. Extent of increased congestion or reduction of vent area should be
carefully monitored, and explosion modelling should be rerun if necessary.
Source model for process should be updated and significant changes in release rates
or durations should be evaluated to determine if fire characteristics or loadings
have exceeded SCDM provisions.
10.2. Final risk assessment

a. Overall assessment of risks shall be performed during execute stage. This shall confirm
that:
1. Fire and explosion hazards have been identified.
2. Sufficient understanding of causes and consequences exists to allow fire and
explosion hazards to be managed effectively.
3. Hazard categories for each hazard are valid.
4. Combination, provision, and type SCDM to manage hazards (i.e., prevent, detect,
control, mitigate, and emergency response) provide appropriate strategy for hazard
category.
5. Future operators accept risks, categorisation of hazards, and obligations for
implementing FEHM process.
6. Overall risks from fires and explosions, in combination with all other risks to facility,
comply with GP 48-50.
Operator should take part in assessment process. This will contribute to operator
acceptance of FEHM philosophy.
Final risk assessment does not specifically require QRA for fire and explosion
hazards.
b. Assessment requiring further risk reduction should proceed systematically in the following
order:
1. Improve SCDM performance.
2. Add additional SCDMs.
3. Revisit hazard categorisations.
4. Reconsider layout and process design.
5. Revisit concept selection.
10.3. Documentation
10.3.1. General
a. There shall be adequate communication and documentation between each stage of project
to next and to operators such that hazard management decisions are understood and
recorded. This should be performed through fire and explosion hazard register (FEHR) and
supporting documentation.
The BP IMFS specifically requires that hazard register shall be developed which
provides clear links from identified hazards to measures, SCDM, processes and
procedures to manage/mitigate risks.
Page 27 of 64
b. FEHR should be progressively developed to reflect changes in design and level of detail as
design progresses.
FEHR is core document for FEHM in the design of facility and future operation and
should be accepted by future operator. FEHR should cross reference hazards to
decisions to implement strategies and SCDM needed to implement strategies.
c. FEHR should demonstrate that safety goals and risk criteria have been met. This should
include demonstration that:
1. Overall process to identify, understand, and manage hazards is complete.
2. BP risk reporting criteria have been met.
3. National regulations are satisfied.
4. IMFS is fully honoured.
Rigorous proactive approach to management of hazards that has been followed and
documented provides over 90% of demonstration, as process itself should deliver
design that is safe and practical. Project HSSE review process described in
GP 48-01 should provide some of this assurance.
d. If there is major threat to life, environment, or BP reputation, it may be necessary to have
independent verification by BP risk management specialists that risks are in compliance
with corporate risk reporting criteria.
10.3.2. Fire and explosion hazard register (FEHR)

a. FEHR shall be encompassed within overall plan for management of all facility hazards.
Management plan should contain following:
1. Hazard management philosophy.
2. Specific listing of each fire and explosion hazard (e.g., separator fire).
3. List of groups of generic hazards (e.g., jet fires, liquid spray fires, explosions).
4. Emergency response plans.
5. Documentation of performance standards for all SCDMs.
b. FEHR should be prepared by responsible personnel with input from all disciplines and
from operator.
c. FEHR should record any changes and show that changes have been assessed in
management of change procedures.
d. FEHR should be structured such that when delivered to operations, register/hazard
management plan can be used to identify personnel responsible for SCDM, and processes
such as maintenance routines that manage them.
10.3.3. Information required
10.3.3.1. General
For each identified hazard and groups of generic hazards, the following information shall be
required:
a. Description and quantification of hazard, including cause and routes to escalation.
Summary is acceptable if linked by reference to supporting documentation.
b. Category of hazard (controllable, evacuate, or catastrophic).
c. Strategy to manage hazard.
d. List of engineered prevention, control, and mitigation SCDM.
Page 28 of 64
e. List of procedural SCDMs.

f. Performance requirements for SCDMs.
g. Details of evacuation systems for each evacuate hazard.
h. Nominated responsible persons for each prevention, control, and mitigation SCDM.
10.3.3.2. Support documents

a. The following support documentation shall be provided for SCDM and FEHR shall
reference supporting documentation:
1. Performance and design standards, for example:
a) Corrosion thickness.
b) Impact deck strength.
c) Response time and minimum size of event for fire and gas detection.
d) ESD closure time.
e) Blowdown times.
f) Drainage flow rate.
g) Passive fire and blast protection rating.
h) Deluge application rate.
i) Availability and reliability.
j) Survivability.
2. Controls and operating restrictions during maintenance or unavailability of SCDM,
for example:
a) Control of heavy lifts during impact deck panel removal.
b) Deployment of portable deck monitors during deluge system maintenance.
c) SIMOPS plans and procedures.
3. Documentation for procedural SCDMs, for example:
a) Corrosion inspection procedures.
b) Wireline, BOP (blowout preventer) assembly, connection, and test procedures.
4. Maintenance procedures and frequencies.
5. Inspection procedures, test frequencies, and performance acceptability limits, for
example:
a) Maximum valve closure time.
b) Minimum wall thickness.
6. Emergency response procedures.
7. Demonstration that design complies with BP and legislative risk criteria.
b. FEHR shall be living document that conveys information to all responsible personnel for
safe operation.
FEHR should be concise and easily read. It should not be overly detailed and should
defer to supporting documentation if possible.
10.3.3.3. Timing
a. FEHR shall be prepared during CVP execute and completed before CVP operate.
Page 29 of 64
b. FEHR should develop as each item of information becomes available.

c. Fire and explosion quantification and engineering sections should be substantially
complete before construction.
d. Prior to commissioning, operational and procedural sections should be completed and
delivered to commissioning/operating team.
e. FEHR supporting documentation should form basis of checklists and acceptance
procedures for SCDM during inspection, test, and commissioning.
10.3.3.4. Review
a. FEHR shall be support document to any safety case requirements and shall be completed
in time for submission, if necessary.
b. If drilling and well completion operations commence prior to production, the FEHR
sections related to these operations shall be completed.
c. FEHR shall be regularly reviewed and shall be updated as required during management of
change process.
11. CVP operate
a. Information on hazards and strategies for hazard management, the FEHR developed during
the CVP execute stage, shall be provided to future operators of facility.
b. SCDM shall be operated so as to achieve intent and performance for lifetime of the
facility.
c. Safety critical procedures shall be developed with arrangements for provision of competent
personnel for commissioning and operation.
d. Inspection, testing, and maintenance program shall be developed to verify that SCDM
meet required performance, both at commissioning and during operation.
e. Rigorous management of change process shall be followed for all changes that could
undermine achievement of FEHM goals, introduce new hazards, exacerbate existing
hazards, or impact management of hazards.
f. Commissioning and operations shall provide personnel, practices, procedures, and levels of
competence required to meet intent of FEHM such that goals may be achieved for lifetime
of the facility.
SCDMs must also operate within any limitations determined during development.
These limitations should have been developed in agreement with future operator.
SCDMs must be tested, inspected, maintained, and operated to achieve required
performance.
Page 30 of 64
Annex A
(Normative)
Minimum default hazard management strategies and safety critical
design measures (SCDM) tables for large integrated facilities
A.1. SCDM tables
a. This Annex is a set of tables of minimum default hazard management strategies and
SCDMs (safety critical design measures) for permanently manned integrated fixed
platforms and FPSOs (floating production, storage, and offloading units).
b. These facilities can pose the greatest risk to personnel from fire and explosion due to
higher personnel numbers, continuous exposure through work in hazardous areas, living
and sleeping nearby, and from high level of process scale and work complexity requiring
permanent personnel occupancy.
c. These tables principally provide standards for life safety but also provide some asset
protection.
d. These minimum default standards are guidance only.
e. These minimum default standards may be relaxed for facilities having inherently lower
risk. Such facilities may have separate personnel accommodations, non-resident operation,
or normally unattended status.
f. SCDM should be based on analysis of hazards and major accident risk reduction process to
determine identified exposure and consequences and which, therefore, require protection.
g. If default minimum standards are used, then retroactive fire analysis should confirm that
provision, performance, and extent of protection is adequate. Retroactive analysis may also
reduce default provisions.
A.2. Table descriptions
A.2.1. General
A.2.2 through A.2.9 describe each element of SCDM tables.
A.2.2. Protected areas and equipment

a. Area where hazards may originate and type of hazard.
b. In some cases, there may be separate tables for different hazards in same area, such as
explosion, gas fires, and high pressure or low pressure oil.
FPSO fire and explosion hazard management is similar to that of fixed jacket
supported platform for process deck modules and utility modules. However, space
between main deck and process deck, usually filled with cargo oil tank pipes,
process run down, and offloading mains should be regarded as enclosed space.
Design effort should be made to eliminate flammable gas from this area and
minimise congestion.
A.2.3. Fire and explosion hazards

a. Fire and explosion hazard that may arise in each area.
b. These are categorised as controllable events and evacuation events.
c. Concept of these different events is described in 6.2.
d. Categorisation of these events should be determined by analysis.
Page 31 of 64
There is specific differentiation between high pressure and low pressure oil fires.
This arises from differences in design requirements and effectiveness of systems with
high pressure releases. The difference originates from type and release pressure of
liquid at time the escalation could realistically occur. Default for this failure time
needs to be determined by the project team. If plant operates at these pressures or
has depressurised below these values within the escalation time, it may be
considered as low pressure.
A.2.4. Default SCDM

a. Preferred type of system to limit severity and protection against fire or blast effects.
b. Active systems may be used for frequent or controllable events, but it is preferable to rely
upon passive systems for controllable events, as controllable events are more likely to
disrupt active system supporting infrastructure.
c. These entries should be cross-referenced to role of system and performance standard in
adjacent columns.
A.2.5. SCDM Rank

Systems are ranked 1, 2, or 3 according to priority as follows:
1. Default provision.
2. Provided only if required by fire risk analysis.
3. Not provided unless risks are intolerable and there is no other way to manage risks.
A.2.6. Hazard management role

a. Role of default system. In effect, this is high level performance standard for system. This
does not presume that there is sufficient inventory to cause escalation or effects described.
b. Conflicts may arise between explosion risk reduction and fire mitigation. They are:
1. Improved ventilation and reduced obstruction could reduce probability of gas cloud
development and reduce potential overpressure. However, fire barrier may be
necessary to mitigate consequences of fire on muster area and evacuation facilities.
The only way to resolve this is to conduct an explosion consequence analysis and fire
consequence analysis to determine effects of a barrier on severity and escalation
potential and then decide on best compromise.
2. Improved ventilation and improved venting of explosion products may require decks
to be grated. However, fire protection (and other issues like dropped object
protection) may required plated decks. The only way to resolve this is to conduct an
explosion consequence analysis and fire consequence analysis to determine effects of
grated and plated decks on severity and escalation potential and then decide on best
compromise.
A.2.7. Performance standards

a. These are the primary functional standards for system:
1. Application rate for deluge system.
2. Rating for passive fire protection system.
b. For explosion hazard management:
1. Common objective is to reduce explosion overpressure to an SLB (strength level
blast) of 500 mbar or less to avoid widespread design difficulties with structural
strength of items like pipe and vessel supports.
Page 32 of 64
2. If DLB (ductile level blast) is defined, objective should be to reduce explosion

overpressure to less than 2 bar. This is reasonable maximum tolerance for steel
structures. Structure can be designed to tolerate higher overpressure, but
consequences of such on SCDM and personnel is uncertain.
3. Of particular concern are potential areas of stress concentration under very high
accidental load conditions, which can cause failure of blast barrier connections and
supporting structure. In general, nonlinear analysis will be required to ensure that
structure is able to withstand predicted explosion overpressure pulse. DLB may lead
to evacuation, but barrier, if intended to withstand fire, shall remain able to perform
that role after DLB event.
A.2.8. Table notes

a. Most table notes refer to specific clauses in the table.
b. A few notes are general commentary for the entire table.
A.2.9. Common SCDM

The following common SCDM should also be implemented to manage detection and control of
fire and explosion hazards:
a. Containment integrity of hydrocarbon carrying systems and equipment.
1. This is commonly achieved through application of codes and standards, but in some
critical areas additional design measures may be required to minimise major accident
risk.
2. Riser integrity outboard of ESD (emergency shutdown) valves under major accident
conditions is particularly significant (e.g., fire on sea surface).
b. Automatic fire and gas detection designed to detect 500 m3 gas clouds with 90% reliability
and larger clouds with 98% reliability.
c. Fire (flame, heat, or smoke) detection appropriate to identified risk.
d. Automatic (or manual initiation) emergency shutdown system to isolate process
inventories and external inventories (well fluids and riser fluids), with automatic blow
down of gas inventories within 1 min of confirmed detection of gas or fire
e. Low congestion, open modules, and natural ventilation to prevent gas cloud build up and
reduce severity of explosion.
f. Ventilation should provide at least 50 air changes/hr.
Page 33 of 64
A.3. Default tables
A.3.1. Wellbays
Table A.1 - Wellbay with low pressure oil production
Protected areas and equipment

Low pressure oil production wellheads, manifolds, and flow lines.
Open naturally ventilated module protected by solid impact deck. Should be grated as far as possible on lower deck.
Controllable events
Low pressure gas or oil release leading to small flammable gas cloud. Delayed ignition leading to low pressure explosion
unlikely to cause structural damage. (1)
Isolated oil inventories in manifolds and flow lines from pumped or naturally flowing low pressure low gas content wells,
creating pool fires possibly affecting areas beyond and above with external flaming and smoke.
Evacuation event
Continuous well release in wellbay arising from isolation failure or failure of swab valve joint during well servicing, creating
pool or low pressure spray fires.
Default SCDM Rank Hazard management role Performance standards
ESD: master, wing, and downhole 1 Limit fire severity and duration below that Master and wing valves
safety valves. which could cause failure. close within 1 min.
Deluge: general area medium 1 Reduce wellbay temperatures to suppress 12 l/min/m2.
velocity. combustion, external flaming, and
vaporisation of hydrocarbon liquids.
Structural: epoxy intumescent 1 Prevent collapse of drilling rig. H60.
passive protection. (2)
Fire and blast barriers to segregate 1 Prevent escalation to other areas. H60 and blast rated to SLB.
wellbay from nonhazardous areas. Prevent impairment of muster and
(3) evacuation areas.
Fire and blast barriers to segregate 2 Prevent escalation to process area. H60 and blast rated to SLB.
wellbay from process areas. (3)
Notes:
1. Low pressure wells with low gas content create fires that should be easily suppressed by moderate rate
deluge. Deluge performs three functions: cool plant, suppress combustion, and limit hydrocarbon
vaporisation. Simultaneous protection is not normally required in adjacent areas.
2. Structures and walls should be passively protected even if deluge is provided. Structures and walls
should be designed to withstand infrequent events, such as flow line failure without well isolation or
failure of swab valve joint during wire lining and continuous well release.
3. Structures and walls are unlikely to be deformed by explosion. If analysis shows that deformation is
possible, specification of barriers should require fire rating to be maintained over expected deformation
range.
Page 34 of 64
Table A.2 - Wellbay with high pressure gas lifted oil production

High pressure or gas lifted oil or condensate production wellheads, manifolds, and flowlines.
Open naturally ventilated module protected by solid impact deck. Should be grated as far as possible on lower deck.
Controllable events
High pressure gas or oil release with flash gas, but low mass flow rate (small hole), leading to development of flammable
gas cloud less than 25% module volume. Delayed ignition leading to explosion overpressure lower than structural
strength limit (SLB).
Isolated oil and gas injection/lift inventories in manifolds and flowlines producing intense high pressure oil and gas sprays
with total engulfment of wellbay. Oil fires probably affect areas beyond and above with external flaming and smoke
potentially affecting drilling facilities.
Evacuation events
High pressure gas or oil release with flash gas leading to rapid development of flammable gas cloud. Delayed ignition
leading to potentially high overpressure explosion capable of causing structural damage and displacement of manifolds
and pipes. Could cause widespread releases and fire.
Continuous well release in wellbay arising from isolation failure or failure of swab valve joint during well servicing,
producing high pressure spray fires. (1)
Backflow of complete annulus contents of gas lifted wells.
ESD: master, wing downhole 1 Limit fire severity and duration below that Master, wing, and annulus
safety, and gas lift annulus valves. which could cause escalation to other valves close fully within 30 s.
plant and equipment or structural failure.
Deluge: general area medium 1 Suppress combustion, external flaming, 20 l/min/m2.
velocity operating at high pressures and smoke.
to reduce droplet sizes and Reduce module temperatures to prevent
maximize combustion interaction. structural and process escalation.
Structural: epoxy intumescent 1 Prevent collapse of derrick and J60.
passive protection. (2) progressive structural collapse.
Fire and blast barriers to segregate 1 Prevent escalation to nonhazardous J60 and blast rated to SLB
wellbay from nonhazardous areas. areas. and DLB.
(3) Protect muster and evacuation areas.
Gas lift ESD valve: passive 2 Prevent annulus gas backflow. J60.
protection.
Fire and blast barrier to segregate 2 Prevent escalation to process area. J60 and blast rated to SLB.
Deluge: specific wellhead 3 Prevent wellhead and christmas tree 400 l/min/wellhead.
protection. (4) failure by direct cooling.
Notes:
1. There is high probability of large release with erosion and fatigue of flowlines and multiple live joints.
Fires will engulf and spread beyond wellbay but in most cases would not last long enough to cause
escalation beyond wellbay itself. Deluge can be used to reduce external effects on personnel.
2. Passive protection should protect against infrequent events, such as continuous well releases or release
of gas lift annulus contents. Passive protection should prevent passage of heat, flame, and smoke into
other areas, limiting negative effects and allowing controlled evacuation. General area deluge coverage
to suppress external effects of oil fires and allow response measures to regain well control may also be
needed for these events, particularly for centre bay drilling.
3. Structures and walls are unlikely to be deformed by explosion. If analysis shows that deformation is
possible, specification of barriers should require fire rating to be maintained over expected deformation
range.
4. Wells with fully integrated christmas trees and downhole safety valves should not require specific
wellhead deluge. Wellhead and trees are unlikely to fail if exposed to isolated well releases. Likelihood
of this failure combined with downhole safety valve (DHSV) failure before evacuation is very low.
Page 35 of 64
Table A.3 - Wellbay with gas production wells

Gas production wellheads, manifolds, and flowlines.
Open naturally ventilated module protected by solid impact deck. Lower deck should be grated where possible.
Controllable events
High pressure gas or oil release with flash gas, but low mass flow rate (small hole), leading to development of flammable
gas cloud less than 25% of module volume. Delayed ignition leading to explosion overpressure lower than structural
Isolated gas inventories in manifolds and flowlines that will generally have insufficient inventory to cause escalation and
have little effect beyond wellbay. (1)
Evacuation events
High pressure gas or oil release with flash gas leading to rapid development of flammable gas cloud. Delayed ignition
leading to potentially high overpressure explosion capable of causing structural damage and displacement of manifolds
and pipes. Could cause widespread releases and fire.
Continuous well release in wellbay arising from isolation failure or failure of swab valve joint during well servicing, creating
gas jet fires. These may also be associated with post explosion fire scenarios.
Default SCDM (2) Rank Hazard management role Performance standards
ESD: master, wing downhole, 1 Limit fire severity and duration below that Master, wing, and annulus
safety, and gas lift annulus valves. which could cause escalation to other valves to close fully within
plant and equipment or structural failure. 30 s.
Fire and blast barriers to segregate 1 Prevent escalation to nonhazardous J60 and blast rated to SLB
wellbay from nonhazardous areas. areas. and DLB.
(4) Protect muster and evacuation areas.
Depressurisation. (5) 2 Reduce gas cloud size. Initiated within 1 min.
Reduce fire size and duration below that
capable of causing escalation.
Fire and blast barrier to segregate 2 Prevent escalation to process area. J60.
Notes:
1. Isolated gas inventories normally should not have sufficient inventory to cause escalation unless there
are large quantities of condensate, in which case refer to row above regarding high pressure gas. ESD is
normally all that is needed. In extraordinary cases, depressurisation can be added. Deluge is not effective
preventing local escalation and will have limited effect on suppressing external flaming.
2. Deluge is not provided because it is ineffective against gas jets and there is low chance of escalation
from frequent events if ESD is effective.
3. Passive protection should protect against infrequent events such as continuous well releases or release of
gas lift annulus contents. Passive protection should prevent passage of heat, flame, and smoke into other
areas, limiting negative effects and allowing controlled evacuation. General area deluge coverage to
suppress external effects of oil fires and allow response measures to regain well control may also be
needed for these events, particularly for centre bay drilling.
4. Structure and walls could be deformed by explosion. If analysis shows that deformation is possible,
specification of barriers should require fire rating to be maintained over expected deformation range.
5. Failure or slow operation of isolation or blowdown could lead to extended release and large gas cloud
development. This possibility should be tested.
Page 36 of 64
A.3.2. Oil and condensate separation
Table A.4 - Low pressure oil separation in roofed modules

Low pressure separators, oil heaters/coolers, and dehydrators. Naturally ventilated module with solid roof. Should be
grated as far as possible for natural ventilation and explosion venting.
Controllable events
Pressurised oil release with flash gas, normally limited in duration by blowdown. Development of flammable gas cloud to
half module volume. Delayed ignition leading to explosion overpressure lower than structural strength limit (SLB).
Low pressure oil spray or pool fires. Isolated releases from separation and oil processing inventories, typically 5 tonne to
20 tonne, contained by drainage systems. Significant external flaming if not controlled. (1)
Prolonged releases creating pool fires from very low pressure dehydrators up to 100 tonne.
Small gas jet fires with small release rates and inventories, most unlikely to cause significant escalation. (2)
Evacuation events
Pressurised release with flash gas leading to rapid development of flammable gas cloud. Delayed ignition leading to
potentially high overpressure explosion capable of causing structural damage and displacement of manifolds and pipes.
Could cause widespread releases and fire. DLB event. (3)
Multiple oil releases caused by explosions, although this is most unlikely unless releases from high pressure sources
migrate into area.
Prolonged fires associated with safety system failure.
External fire exposure from adjacent area, particularly oil pumps underneath and high pressure separators alongside. (4)
ESD: inventory isolation blowdown. 1 Limit fire severity and duration below that All isolation valves to close
(5) which could cause failure. fully within 30 s.
Blowdown initiation in 1 min.
Deluge: general area medium 1 Suppress combustion and reduce 12 l/min/m2.
velocity. (6) vaporisation rate of pool fires.
Control and disposal of released 1 Limit pool fire size, control its spread, and Drains and bunding to
oil. (8) safely dispose of unburned inventory. remove oil, capacity 115% of
combined maximum
hydrocarbon release rate
plus deluge rate.
Fire and blast walls to segregate 1 Prevent escalation to nonhazardous H60 and blast rated to SLB
area from other process areas, areas. and DLB.
wellbay, utilities, and muster areas. Protect muster and evacuation areas.
(9)
Epoxy intumescent passive 1 Prevent vessel movement and collapse. H60 and supports able to
protection of vessel supports. (7) withstand blast of SLB and
DLB.
Gas lift ESD valve: passive 2 Prevent annulus gas backflow. J60.
protection.
Fire and blast barrier to segregate 2 Prevent escalation to process. J60.
Deluge: specific wellhead 3 Prevent wellhead and christmas tree 400 l/min/wellhead.
protection. failure by direct cooling.
Manual foam addition to deluge. 2 Extinguish prolonged releases. 30 min duration over entire
drainage containment area
of source module.
Passive protection of vessel outlet 3 Ensure ESD valve operation, sealing, and H60.
ESD valves. joint integrity.
Notes:
1. Fires resulting from oil processing in roofed areas create high heat fluxes within module, smoke
generation due to poor ventilation, and potential of external flaming at sides of module, with major
Page 37 of 64
impact on entire facility.

2. Low pressure gas inventories will only have of order of 2 kg to 400 kg of gas and release rates of 0.5
kg/s from 25 mm hole. These will not cause significant escalation.
3. For severe explosion, high overpressure load on decks and equipment could lead to structure supporting
equipment being deformed. This could cause displacement of pipes and equipment leading to
widespread loss of containment. Structural response to SLB and DLB should be examined and suitable
strength built into key structure.
4. This area might be affected by fires from other areas, primarily for infrequent events. In these cases,
there should be sufficient firewater capacity to protect source and this area. As these events should be in
infrequent category, it will be permissible to assume that all fire pumps will be available.
6. Combination of containment of spills, manually operated depressurisation, and general area deluge
should be sufficient to reduce size and intensity of fires such that they do not have major impact on
facility. Without deluge, prolonged external flaming may require evacuation. For large inventories, safe
containment and disposal of unburned oil is critical. Although deluge should effectively suppress fire, it
may be desirable to add foam for very large inventories (order of 100 tonne) to reduce duration of
incident and allow recovery.
7. Structural passive protection should use epoxy intumescent systems. This is only required if structures in
the area support tall structures, large liquid inventories, or heavy loads, such as drilling rigs, if their
collapse couple leads to critical escalation. If structural failure in the area could also lead to overall loss
if integrity of entire topsides structure, it should be protected unless analysis shows that there is adequate
redundancy elsewhere.
8. Most infrequent events should be controllable by deluge and drainage. Low gas pressures provide very
low explosion probabilities and overpressures. Even if ESD fails to close, fire should be limited in size
by drainage. Structures and firewalls should retain integrity for 60 min even if deluge does not work.
9. Firewalls should be provided to separate process areas from safe areas, such as utilities, safety systems,
muster, and accommodation areas. Fire and explosion analyses should be used to determine need for
walls and ceilings to separate process and wellbays. There are conflicting requirements: free ventilation
to disperse flammable gas and allow explosion venting versus limitation of size and spread of gas clouds
and prevention of fire spread and escalation to other areas. Presence and location of walls should be
guided by GP 24-20. Walls, if provided, should meet defaults requirements, with fire exposure
protection on both sides if necessary.
Page 38 of 64
Table A.5 - High pressure oil and condensate separation in roofed modules

Separators and slug catchers. Area may also contain natural gas liquids (NGL) knockout. See gas processing for hazard
descriptions and protection measures.
Naturally ventilated module with solid roof that should be grated as far as is possible.
Controllable events
High pressure gas, condensate, or oil release with flash gas, normally limited in duration by blowdown. Development of
flammable gas cloud partially filling module volume. Delayed ignition leading to explosion overpressure of structural
High pressure oil spray or condensate fires. Isolated releases from separation and oil processing inventories, typically 5
tonne to 20 tonne. Creates very large intense spray fires filling modules and causing severe external flaming.
Moderate gas jet fires with potential for escalation to other plant in module or specific structural members.
Evacuation events
High pressure gas, condensate, or oil release with flash gas leading to rapid development of flammable gas cloud.
Delayed ignition leading to potentially high overpressure explosion capable of causing structural damage and
displacement of manifolds and pipes. Could cause widespread releases and fire. (1)
Multiple oil releases caused by explosions arising from high pressure volatile liquid releases, high pressure gas, or NGLs
if present in area. (2)
Large hole sizes from very high pressure large inventories (25 mm and above) may also have to be classified as
“infrequent” events because of severity and overall impact on facility.
Prolonged and more intense fires associated with ESD and depressurisation failure.
External fire exposure from adjacent areas, particularly oil pumps underneath, or FPSO cargo tanks. (3)
ESD: inventory isolation blowdown. 1 Reduce gas inventory below that which All isolation valves to close
(4) could cause escalation. (5) fully within 30 s.
Reduce release pressure, size, and Blowdown initiation in 1 min.
intensity of gas jet and liquid fires. (6)
Prevent rupture of process vessels. (7)
2
Deluge: general area medium 1 Suppress combustion, external flaming, 12 l/min/m .
velocity operating at high pressures and smoke.
to reduce droplet sizes and Reduce module temperatures to prevent
maximize combustion interaction. structural and process escalation.
Passive protection of vessel 1 Prevent vessel movement and collapse. J60 and supports able to
supports. (8) withstand blast of SLB and
DLB.
Epoxy intumescent passive 1 Prevent progressive structural collapse, J60 and able to withstand
protection of critical structures. (8) loss of support for other large inventories, blast of SLB and DLB.
and collapse of tall structures.
Fire and blast walls to segregate 1 Prevent escalation to nonhazardous areas J60 and blast rated to SLB
this area from other process areas, and protect muster and evacuation. and DLB.
wellbays, utilities, and muster
areas. (9) (10)
Containment, drainage, and safe 1 Transfer unignited or unburned liquids Capacity 115% of combined
disposal of unburned hydrocarbon where they cannot burn or combustion maximum hydrocarbon
liquids. would not cause hazard to facility. release rate plus deluge
rate.
of source module.
2
Specific deluge of condensate 2 Prevent vessel rupture. 20 l/min/m .
vessels.
Notes:
1. High pressure separation in roofed modules is major hazard on fixed platforms that may lead to severe
external flaming and potential of escalation to other oil inventories and structural collapse. High
Page 39 of 64
pressure separation may be located at the same level or below refuge and safety systems, and ventilation
restrictions will increase smoke toxicity. All Rank 1 systems shall be effectively combined to allow
these hazards to be controlled. As there is a significant explosion risk, multiple releases and system
failure is significant possibility; therefore, evacuation case should rely only on passive systems.
2. For severe explosion, high overpressure load on decks and equipment could lead to the structure
supporting equipment being deformed. This could cause displacement of pipes and equipment leading to
3. This area might be affected by fires from other areas, primarily infrequent events. In these cases, there
should be sufficient firewater capacity to protect the source and this area. As these events should be in
the infrequent category, it will be permissible to assume that all fire pumps will be available.
5. With high pressure oil and condensate separation, either plant can be depressurised such that release
pressures are classified as low before escalation can occur (find guidance on definition of high pressure)
or else fires can be treated as high pressure using default systems in this row. Limiting external flaming
is essential to keep fire severity in frequent or controllable category.
6. Depressurisation plays key role in managing high pressure liquids hazards. Design should achieve three
roles listed. Reduction of liquid release pressure will reduce fire size and enable deluge to be effective.
Without depressurisation, size and intensity of fires may be on the limit of controllability, particularly
for large high pressure inventories. Without it, there may be prolonged external flaming from modules,
which may require evacuation. Combination of deluge and depressurisation should limit external
flaming and extent to which fire maintains vessel pressure. This may need to be confirmed by
calculation.
7. Vessel rupture is more likely with condensate than oil due to fluid boiling properties. It could increase
severity of an event to that which requires evacuation (i.e., from frequent or controllable event to an
infrequent/evacuation case). Depressurisation of both fire source and exposed vessel should usually be
sufficient to prevent rupture but this should be verified by calculation. If this is not practical, additional
specific deluge may be applied. Passive vessel protection is not desirable because of corrosion
underneath, inspection restrictions, and difficulties in reinstatement during operation.
8. Structural passive protection should use epoxy intumescent systems. It is only required if structures in
the area support tall structures, large liquid inventories, or heavy loads, such as drilling rigs where their
collapse couple leads to critical escalation. If structural failure in the area could also lead to overall loss
if integrity of the whole topsides structure, it should be protected unless analysis shows that there is
adequate redundancy elsewhere.
9. Firewalls should be provided to separate process areas from safe areas, such as utilities, safety systems,
muster, and accommodation areas. Fire and explosion analyses should be used to determine need for
walls and ceilings to separate process and wellbays. There are conflicting requirements: free ventilation
to disperse flammable gas, explosion venting, limitation of size and spread of gas clouds, and prevention
of fire spread and escalation to other areas. Presence and location of walls should be guided by GP 24-
20. Walls, if provided, should meet default requirements herein, with fire exposure from both sides if
necessary. These should be effective even if active systems fail to operate (i.e., for infrequent/evacuation
events).
10. Structure and walls could be deformed by explosion. If analysis shows that deformation is possible, then
Page 40 of 64
Table A.6 - Low pressure oil separation on open decks

Oil separation, including separators, oil heaters/coolers, and dehydrators. (1)
Open deck without roof over plant. (2)
Controllable events
Low pressure oil spray or pool fires. Isolated releases from separation and oil processing inventories, typically 5 tonne to
20 tonne. Direct effect of fire will be limited to source processing area and other plant at its immediate boundaries.
Prolonged releases from very low pressure dehydrators of up to 100 tonne.
Low release rate with small gas jet fires or small gas cloud sizes are most unlikely to cause significant escalation. Small,
long duration jet fire caused by failure of isolation and blowdown can lead to critical escalation.
Evacuation events
Very large releases resulting from large hole sizes (> 50 mm) or releases that may exceed drains capacity and overflow
into other areas.
Exposure to fires from adjacent areas or underneath (solid deck may help limit risk from fire underneath but may cause
increase in severity of explosion for areas underneath). (3)
(4) could cause escalation. fully within 30 s.
intensity of gas jet and liquid fires.
Prevent rupture of process vessels.
Containment, drainage, and safe 1 Transfer unignited or unburned liquids Drains and bunding to
disposal of unburned hydrocarbon where they cannot burn or combustion remove oil, capacity 115% of
liquids. (5) would not cause hazard to facility. combined maximum
hydrocarbon release rate
plus deluge rate.
2
Deluge: local vessel and plant 1 Prevent further release of major oil and Vessels: 10 l/min/m .
application. (6) condensate inventories. Pumps and other plant: 10
2
l/min/m of plan area for
plant.
Passive protection of vessel 1 Prevent vessel movement and collapse. J60 and rated to withstand
supports. SLB.
Epoxy intumescent passive 1 Prevent progressive structural collapse, J60 and rated to withstand
protection of critical structures. loss of support for other large inventories, SLB.
of source module.
Notes:
1. These vessels should have low probability of rupture and should not be passively protected.
2. Lack of roof and location of this processing on top deck significantly reduces fire intensity and its
overall impact on facility. Processing should be located either at same level as accommodation, refuge,
muster, and lifeboats or above it. Combustion will carry flames and smoke over these areas, and free
ventilation will not increase smoke toxicity.
3. Fire and explosion impact may arise through events underneath module or hazards located in adjacent
modules.
4. Open aspect and free ventilation means that a flammable cloud is unlikely to develop unless there is
very little wind. Even if an explosion occurs, venting will be upwards into open space and only low
overpressure generated.
5. Control of liquid spills and ability to handle deluge capacity, as well as oil, is critical. So long as oil is
contained, fire size and location are manageable. Failure to limit its spread can allow sea fires alongside
Page 41 of 64
FPSOs and cascading oil fires on other facilities. Both situations can bring fire closer to personnel,
hindering evacuation, or cause escalation and loss of safety systems.
6. It may be impractical to apply water into combustion zone and onto hydrocarbon pools to suppress
combustion and limit vaporisation. Therefore, it is preferable to allow fire to burn out. As it is on an
open deck, fire plume should rise safely above platform or FPSO without serious flame or smoke impact
onto refuge and lifeboats. Foam may put out fire in conjunction with containment and depressurisation,
but success cannot be guaranteed. It may be worth considering for very large inventories (~ 100 tonne).
General notes:
a. With infrequent events, evacuation would depend on limitation of further escalation and containment of
liquids. It should not be necessary to install firewalls on top deck. It is impractical to build them high
enough to limit fire impact, and they will simply reduce ventilation, hinder escape, and increase chance
of explosion.
Page 42 of 64
Table A.7 - High pressure oil and condensate separation on open decks

Oil and gas condensate separation, including separators and slug catchers.
Open deck without roof over plant. (1)
Controllable events
High pressure oil spray or condensate fire. Isolated releases from separation and oil processing inventories, typically 5
tonne to 20 tonne. These high pressure releases can create very intense large spray fires, but open deck should allow
cleaner combustion and convection of smoke and flames above muster points and lifeboat. Pressurised effects may
direct fire into adjacent areas with potential for escalation. (2)
Moderate gas jets with potential for local escalation within source module.
Evacuation events
Prolonged oil fires caused by ESD failure or very large fires caused large holes (> 50 mm).
Post explosion fires. Top deck explosions are rare and of lower intensity than enclosed modules. Fires involving multiple
small releases (< 20 mm) and safety system failure.
External fire exposure from adjacent areas, particularly oil pumps underneath, or FPSO cargo tanks (a solid deck may
help limit risk from fire underneath but may cause an increase in severity of explosion for areas underneath). (3)
could cause escalation. fully within 30 s.
intensity of gas jet and liquid jet fires.
Prevent rupture of process vessels. (4)
disposal of unburned hydrocarbon where they cannot burn or combustion remove oil: capacity, 115%
liquids. would not cause hazard to facility (either of combined maximum
retain oil in fire area or safely dispose of hydrocarbon release rate
unburned inventory). plus deluge rate.
2
Deluge: specific high velocity 1 Prevent further release of major oil and 20 l/min/m of vessel
deluge of separators, slug condensate inventories. surface.
catchers, and process plant. (5) (6) Prevent vessel rupture.
2
20 l/min/m of plan area for
plant.
Epoxy intumescent passive 1 Prevent progressive structural collapse, J30, H60, and rated to
protection of critical primary and loss of support for other large inventories, withstand SLB.
secondary structures. and collapse of tall structures.
Prevent movement and collapse of
preassembled units.
Passive protection of vessel 1 Prevent vessel movement and collapse. J30, H60, and rated to
supports. withstand SLB.
Manual foam addition to deluge. 2 Extinguish prolonged releases from large 30 min duration over entire
inventories. drainage containment area
of source module.
Passive protection of vessel outlet 3 Ensure ESD valve operation, sealing, and J30, H60.
Notes:
1. Lack of roof and location of this processing on top deck significantly reduces fire intensity and its
overall impact on facility. Processing should be located either at same level as accommodation, refuge,
muster, and lifeboats or above it. Combustion will carry flames and smoke over these areas, and free
ventilation will not increase smoke toxicity.
2. As with lower pressure fires, control of spills is critical, but in this case, liquid dropout from release is
less likely in first few minutes.
modules.
4. Vessel rupture is more likely with condensate than oil due to the fluid boiling properties. It could
Page 43 of 64
increase severity of an event to that which requires evacuation (i.e., from a frequent or controllable
event to infrequent/evacuation case). Depressurisation of both fire source and exposed vessel should
usually be sufficient to prevent rupture but should be verified by calculation. If not practical, additional
specific deluge may be applied. Passive vessel protection is not desirable because of corrosion
underneath, inspection restrictions, and difficulties in reinstatement during operation.
5. It may be impractical to apply water into combustion zone and onto hydrocarbon pools to effectively
suppress combustion and limit vaporisation. Therefore, it is preferable to allow fire to burn out. As it is
on an open deck, fire plume should rise safely above platform or FPSO without serious flame or smoke
impact onto the refuge and lifeboats.
6. Higher rate high velocity deluge is needed to be effective against high pressure impinging spray fires
and to be effective in high winds in open areas. If depressurisation can reduce source to low pressures
before failure times, then low pressure fire application rates may be used.
General notes:
a. High pressure release can easily direct fire such that it completely engulfs adjacent modules. This may
have to be classified as a frequent event if fire size cannot be reduced before likely failure times. In these
cases, fire pump capacity should be based on this scenario, with a reserve pump in support.
b. Gas fires cannot be controlled by deluge, but combination of ESD, depressurisation of source, and
exposed plant should be sufficient to prevent escalation. Fire analysis should predict fires based on
combined loss of gas through depressurisation and accidental release. It may be necessary to optimise
depressurisation rates to prevent escalation.
c. With infrequent events, evacuation would depend on limitation of further escalation and containment of
liquids. It should not be necessary to install firewalls on top deck. It is impractical to build them high
of explosion.
d. Open aspect and free ventilation means that flammable cloud is unlikely to develop unless there is very
little wind. Even if explosion occurs, venting will be upwards into open space and only low overpressure
generated.
Page 44 of 64
A.3.3. Gas drying, purification, and gas liquids recovery
Table A.8 - Gas drying, purification, gas liquids recovery on top decks and roofed modules

Gas, purification, drying, and liquids recovery. Gas coolers/liquids condensers, liquids knockout vessels, amine, MOL
sieves, TEG contactors, and glycol regeneration units.
Default requirements apply to roofed, naturally ventilated modules, open top decks.
Controllable events
Isolated high pressure gas fires of moderate inventory and duration. These may be just capable of localised escalation.
Isolated high pressure gas liquid fires, generally mixtures of propane, butane, pentane, and hexane with some triethylene
glycol in contactors. Generally, these have separate inventories less than 1000 kg and are only capable of escalation
under quite specific circumstances. (1)
Gas cloud buildup in roofed modules can lead to explosion if ignition is delayed.
Evacuation events
Severe explosion possible, particularly in roofed modules. Post explosion events with multiple releases and impaired
safety systems. This may only apply to roofed areas with significant explosion overpressures.
External flame exposure from other process plants either below or alongside such as separation. (2)
ESD: inventory isolation blowdown. 1 Reduce gas inventory below that which All isolation valves close
(3) (4) could cause escalation. fully within 30 s.
intensity of gas jet fires. (6)
Prevent rupture of process (particularly
NGL) vessels. (5)
Epoxy intumescent passive 1 Prevent collapse of tall vessels onto other J30 and rated to withstand
protection of supports of vessels parts of plant. SLB.
containing more than 2 tonne of Prevent catastrophic release of gas Supports for large vessels
gas liquids, 4 tonne of gas, or liquids. should be designed to
vertical vessels more than 8 m withstand DLB to prevent
high. Limit further escalation.
escalation through toppling.
Epoxy intumescent passive 1 Prevent progressive structural collapse, (8)
protection of critical structures. (7) loss of support for other large inventories,
Fire and blast barriers (roofed 1 Prevent fire spread to other areas and J30 and rated to withstand
modules only). (9) inventories. SLB and DLB. (10)
2
Specific deluge of glycol 2 Quench glycol spill fires by dilution. 10 l/min/m over top and
regeneration unit (only on facilities sides.
with firewater infrastructure). (11)
Notes:
1. Gas and gas liquids inventories will normally be from 1 tonne to 2 tonne, and this will not normally
sustain fire at a size that can cause escalation beyond source inventories. Main risks are flash fires and
explosions, particularly in roofed modules. These hazards associated with NGL liquids are particularly
severe. Gas/vapour spread and explosion effects may extend into adjacent modules leading to multiple
releases involving both source plant and adjacent processing.
modules.
3. Hazards in roofed modules are more severe with poorer gas dispersion and confinement of fire around
the plant, hence default to automatic depressurisation rather than manual.
4. Larger liquid inventories might also need to be depressurised to reduce damaging fire sizes.
5. Plant, if exposed to damaging fire loads from other fire sources, should be depressurised to prevent
vessel rupture.
Page 45 of 64

7. Structural protection would not normally be required, as plant is usually towards top of facility with no
major inventories above it. If there are large inventories either of gas or NGLs and they could cause
failure of critical structures as defined in the role, including flare tower, then fire cases without ESD and
depressurisation should be used to define protection with a default of J30.
equipment being deformed. This could cause displacement of pipes and equipment, leading to
9. For open modules, open aspect and free ventilation means that flammable cloud is unlikely to develop
unless there is very little wind. Even if explosion occurs, venting will be upwards into open space and
only low overpressure generated.
11. Glycol fires are unlikely to escalate to other parts of plant or overwhelm installation. Deluge is generally
not needed on gas production plants without significant liquids, so they will not have full firewater
infrastructure. Need for protection of glycol units does not justify installation of this infrastructure if it is
only hazard requiring deluge protection.
General notes:
a. Top deck may use fin fan coolers, which may be vulnerable to fire and fail in a shorter time than vessels
or piping. Their location would make failure of little concern for life safety.
Page 46 of 64
A.3.4. Oil pumping and metering
Table A.9 - Oil pumping and metering in roofed modules

Oil pressurisation and metering for export. This may be high pressure (up to 100 bar) via pipeline or low pressure transfer
to tankers or other platforms.
It may include booster pumps, heat exchangers, metering skids, condensate reinjection pumps, main oil line pumps,
which would normally be electric motor driven but may use diesel/gas engines or gas turbines, export lines and offloading
mains on deck of an FPSO.
Controllable events
Oil will either be fully stabilised or have residual vapour pressure of up to 10 bar.
Stable oil or that with very low vapour pressure and NGL content may be treated as a low pressure release once ESD
has stopped pumps, burning initially as spray and decaying to a pool.
Higher vapour pressure oil with high NGL content or condensate may burn as a spray for some time after ESD stops
pumps. Explosion risk should be low.
Isolated inventories can range from 3 tonne to 20 tonne (could be 200 tonne or more on FPSO), creating prolonged fires.
Pumps will generally be located on or near bottom deck of platform and location in roofed module can cause severe
external flaming, affecting accommodation and muster areas of facility, possibly requiring evacuation if not controlled.
Also have potential to cause failure of primary structure in and around area. Also may also cause failure of secondary
structure in roof, which may support large inventories such as separators.
Evacuation events
Releases from medium holes (25 mm and above) with high vapour pressure fluids (10 bar) and large inventories (> 10
tonne) combined with deluge system failure.
Risk of explosion in area, particularly from atomised condensate and volatile oil. May lead to multiple releases, larger
fires, and damage to fire and safety systems. (1)
Failure to isolate separators feeding pumps. This would lead to longer duration incidents but not necessarily larger ones.
ESD: isolation of oil lines and 1 Shut down pumps and reduce release Isolation within 1 min.
equipment, plus shutdown of pressures.
pumps. (2) Limit oil inventory and consequent
duration of fire.
Containment, drainage, and safe 1 Prevent spread of burning oil to adjacent Drains and bunding to
disposal of unburned hydrocarbon areas: remove oil: capacity 115% of
liquids. Transfer unignited or unburned liquids combined maximum
where they cannot burn or combustion hydrocarbon release rate
would not cause hazard to facility (either plus deluge rate.
retain oil in fire area or safely dispose of
unburned inventory).
Deluge: general area medium 1 Prevent further release of major oil and 20 l/min/m2.
velocity operating at high pressures condensate inventories. May be reduced to 12
to reduce droplet sizes and Prevent vessel rupture. l/min/m2. (4)
maximize combustion interaction.
(3) Prevent progressive structural collapse or
loss of support for tall structures.
Epoxy intumescent passive 1 Prevent progressive structural collapse, H60 and rated to withstand
protection of critical structures. This loss of support for other large inventories, SLB.
will normally include both primary and collapse of tall structures.
structure for decks above and
secondary structure supporting
equipment above.
Fire and blast barriers (roofed 1 Prevent fire spread to other areas and H60 and rated to withstand
modules only). inventories. SLB.
Notes:
1. Severe explosion may originate in same module but from other equipment (e.g., gas lines). These
considerations may dominate design of deck structure, fire and blast barriers, and equipment supports.
Page 47 of 64

3. Protection specified here does not consider specific risks associated with pump drivers. Deluge should
be sufficient to deal with hazards originating from open diesel or gas engines, but turbines should be
fitted with their own protection as specified elsewhere.
4. If oil has low vapour pressure and external flaming and smoke cannot impair refuge and evacuation,
intensity of fires and need to suppress external flaming are reduced. It is therefore permissible to reduce
general area deluge application rates to 12 l/min/m2.
General notes:
a. Fire risks from oil pumps are significant threat to fixed integrated facility. Multiple joints, intervention
for repair, and rotating seals have high likelihood of leakage. Usually gravity fed from separators and on
bottom deck. With roofed module, this creates low level source of external flaming and dense smoke,
which can have major impact on facility. If fires are not brought under control and suppressed, they can
affect all levels above with horizontal smoke spread that can engulf all areas at source elevation and
above. They also have potential to escalate vertically to separation modules above. If topsides structure
relies on primary structure running through or alongside pump area rather than an underdeck module
support frame, it would be exposed to fire effects possibly leading to progressive collapse of topsides.
b. Identification of oil leaks is critical. Low vapour pressure oil will be unlikely to give off significant
amounts of vapour that could be picked up by gas detection system. It may be necessary to monitor
pumping conditions, drains systems, and use manual observation for detection.
Page 48 of 64
Table A.10 - Oil pumping and metering on open or top decks

Oil pressurisation and metering for export. This may be high pressure (up to 100 bar) via pipeline or low pressure transfer
to tankers or other platforms.
It may include booster pumps, heat exchangers, metering skids, condensate reinjection pumps, and main oil line pumps,
which would normally be electric motor driven, but may use diesel/gas engines or gas turbines.
Controllable events
Oil will either be fully stabilised or have residual vapour pressure of up to 10 bar.
Stable oil or that with very low vapour pressure and NGL content may be treated as low pressure release once ESD has
stopped pumps, burning initially as spray and decaying to a pool.
Higher vapour pressure oil with high NGL content or condensate may burn as spray for some time after ESD stops
pumps. Explosion risk should be negligible.
Isolated inventories can range from 3 tonne to 20 tonne (could be 200 tonne or more on FPSO offloading main), creating
prolonged fires. Without effective spill control, it may spread to other areas.
Location of pumps on top deck allows heat and smoke to rise above other inventories, structures, and critical areas
containing accommodation, muster, evacuation, and safety systems. This allows facility to withstand relatively large
events in “control” category. There may be some flame impingement upon adjacent processing. (1)
Evacuation events
Releases from large hole (> 50 mm) with high vapour pressure fluids (10 bar) and large inventories (> 10 tonne)
combined with deluge, ESD, or spill containment failure.
Post explosion fires are low likelihood unless heavy gas vapour clouds migrate from other areas and pump area is
particularly congested.
ESD: inventory isolation blowdown. 1 Shut down pumps and reduce oil release Pumps to stop within 1 min.
(2) (3) pressure to the vapour pressure. All isolation valves to close
Limit size and duration of fires. fully within 30 s.
Reduce gas inventory in other parts of Blowdown initiation in 1 min.
facility.
Containment, drainage, and safe 1 Prevent spread of burning oil to adjacent Drains and bunding to
disposal of unburned hydrocarbon areas. remove oil: capacity 115% of
liquids. Transfer unignited or unburned liquids combined maximum
where they cannot burn or combustion hydrocarbon release rate
would not cause hazard to facility (either plus deluge rate.
retain oil in fire area or safely dispose of
unburned inventory).
Epoxy intumescent passive 1 Prevent progressive structural collapse, H60.
protection of critical structures, both loss of support for other large inventories,
primary and secondary. and collapse of tall structures.
For FPSO offloading or rundown
line release, fire could be of long
duration and threaten primary
structure above. (4)
Deluge: specific high velocity 1 Prevent further release of major oil and 20 l/min/m2.
general area deluge of pumps and condensate inventories.
process plant. (5) (6) Prevent vessel rupture.
Manual foam addition deluge. 2 Extinguish prolonged releases from large 30 min duration over entire
inventories. drainage containment area
of source module.
Notes:
1. On top decks, effects are controllable unless oil is allowed to spread into other areas, creating larger fires
and endangering safety systems, muster points, and causing further escalation. Oil carryover to sea
should be prevented as effects and location can be unpredictable. It may be better to contain oil in source
area and allow it to burn out under controlled conditions.
2. ESD of pumps will make step change in size of fires and in most cases will change them from intense
spray to pool or low pressure release. These fires are much more controllable both by deluge and
Page 49 of 64
drainage systems. Without isolation of pressure source, size of fires may lead to evacuation.
4. Fire and explosion impact may arise through events underneath module (e.g., under process deck on
FPSO) or hazards located in adjacent modules.
5. Deluge should control and probably extinguish pool fires. With higher vapour pressures and spray fires
(see Table A.7), deluge should also provide degree of suppression but extinguishment is not assured.
6. Protection specified here does not consider specific risks associated with pump drivers. Deluge should
be sufficient to deal with hazards originating from open diesel or gas engines, but turbines should be
fitted with their own protection as specified elsewhere.
General notes:
a. Oil pumping is significant risk, with possibility of frequent failures of joints, seals, and regular
intervention for maintenance.
b. Identification of oil leaks is critical. Low vapour pressure oil will be unlikely to give off significant
amounts of vapour that could be picked up by gas detection system. Good ventilation on top deck will
make this situation worse. May be necessary to monitor pumping conditions and drains systems, and use
manual observation for detection.
c. With infrequent events, evacuation would depend upon limitation of further escalation and containment
of liquids. It should not be necessary to install firewalls on top deck. It is impractical to build them high
of explosion.
d. Severe explosion may be caused by large gas release from other equipment (e.g., gas lines, risers). These
considerations may dominate design of deck structure and equipment supports.
Page 50 of 64
A.3.5. Gas compression
Table A.11 - Gas compression on top decks and roofed modules

Gas compression for liquids recovery, export, and reinjection.
Equipment may include reciprocating and centrifugal compressors, turbo compressors and expanders, discharge coolers,
tube and shell, printed circuit, and fin fans.
It may also include knockout drums to prevent liquid carryover. If large quantities of gas liquids knockout are present, see
default provisions under gas processing.
This covers hazard inside roofed modules and in open air. (1)
Controllable events
Hazards will range from low pressure release on vapour recovery units to very high pressure injection compressors with
pressures of up to 400 bar. Significant releases are flash fires endangering personnel working in area and explosions, if
releases could cause a large gas buildup in poorly vented and congested areas.
Top deck freely vented locations offer lowest risks.
With low pressure compression, size of releases is small even with moderate sized holes of 25 mm, and it is unlikely that
isolated inventory is capable of causing escalation.
With high pressure compression, initial release could cause fires capable of engulfing adjacent module and in extreme
cases, adjacent plant. Isolated inventories are small, and these larger events will only last a short time and insufficient to
cause escalation.
Miscible gas reinjection compressors are a special case and should be specifically examined to determine fire and
explosion risks.
Evacuation events
Under normal circumstances, fires originating from gas compressors are unlikely to require evacuation, even if ESD
systems fail to close. These fire cases could be preceded by explosion originating from compressor. This would normally
only be associated with compressors in roofed modules.
Explosion damage to adjacent equipment, supporting structure, and local equipment rooms could occur.
(2) (3) could cause escalation. fully within 30 s.
intensity of gas jet fires.
Fire and blast barriers (roofed 1 Prevent fire spread to other areas and J15 and rated to withstand
modules only). (4) (5) inventories. SLB, unless failure under
DLB conditions would lead
to escalation and fire in
other areas.
Epoxy intumescent passive 1 Prevent progressive structural collapse, J15 and rated to withstand
protection of critical structures. loss of support for other large inventories, SLB. (6) (7)
Notes:
1. Open aspect and free ventilation in open areas means that flammable cloud is unlikely to develop unless
there is very little wind. Even if explosion occurs, venting will be upwards into open space and only low
overpressure generated.
2. In general, automatic ESD is only control system needed to limit the danger potential of gas compressor
fires. If there is a very large inventory, this is likely to be associated with very large throughputs, large
knockout vessels, or direct feed from separators. In these cases, additional segregation of inventories
should be considered.
3. Automatic depressurisation of compressors should only be considered after consultation with
compressor Vendor and BP rotating machinery experts. Automatic depressurisation can cause seal
damage, and it is rare that compressors need depressurisation to prevent escalation.
4. Fire and blast walls should not be needed to prevent escalation, rather to prevent gas releases spreading
into other areas and to contain explosion and flash fire effects. Default has been specified as J15,
Page 51 of 64
although plain steel blast wall should be sufficient and unlikely to fail in gas fire, providing nothing
critical is mounted on or located against the safe side.
development. Fire could also be prolonged. This possibility should be tested.
modules.
General notes:
a. Deluge systems should not be installed over compressors. They are ineffective against gas jet fires, and
escalation arising from secondary release of their inventory in fire is usually of little consequence.
Applying saltwater deluge to compressors is likely to cause rapid cooling of hot surfaces and corrosion.
Page 52 of 64
A.3.6. Flare knockout drums
Table A.12 - Flare knockout drums on top decks and roofed modules

High and low pressure flare liquids knockout drums, flare headers, and liquids return pumps.
Controllable events
Normal operating pressures of flare are so low that any gas fires would be subsonic and of little consequence.
During depressurisation, flare system goes through transient temperatures, liquid slug flow, and potentially hydrates. This
is most likely time for an incident. Typically, it would be gas jet maintained at pressures of process discharge into system.
Typically, this is around 7 bar, reducing as plant depressurises over period of 15 min to 30 min. This would create fires
capable of engulfment of adjacent plant and potentially flare header. Hole sizes of 25 mm and above may have sufficient
size and duration to cause escalation.
Second scenario is liquid release from pumps returning flare liquids to process plant following shutdown. These are
generally low flow units with working pressure equal to that of receiving vessel. They will create pool fires once pumps
shut down. These will be volatile liquids, and fires could cause escalation if fed by a large inventory in knockout drum, but
they would be unlikely to cause sustained external flaming from roofed modules.
Evacuation events
Most severe incident in this area is shear of high pressure flare line and simultaneous actuation of process
depressurisation. This might be caused by explosion in area or by stresses in flare line. Effects would completely fill a
roofed module creating external flaming. Duration depends on total gas inventory in process plant but could continue 10
min to 15 min.
Incidents in adjacent plant may cause fire exposure of flare drums and headers leading to failure if not protected. (1)
ESD: inventory control during 1 Limit support of inventory to those process
blowdown. systems feeding flare.
Shut down return pumps and isolate
liquids feeding pumps from flare knockout
pots.
Epoxy intumescent passive 1 Prevent collapse of flare header. J30, H60, and rated to
protection of flare header supports Prevent movement and collapse of flare withstand SLB.
and knockout drum supports. (2) KO drums and release of blowdown
products.
Control and disposal of liquid 1 Limit size and spread of any pool fire. 115% of combined deluge
releases from the return pumps. application and credible
hydrocarbon release rate.
2
Local deluge application onto flare 1, 2 Preserve integrity and operability if 10 l/min/m of vessel
knockout drums on oil processing exposed to fires from outside flare area. surface.
platforms. (3)
2
Specific deluge onto flare liquid 2 Suppress vaporisation and combustion of 20 l/min/m .
return pumps on oil and pool fires.
condensate production platforms. Prevent failure of liquids outlet and returns
system from flare drums.
Epoxy intumescent fire protection 2 Prevent progressive structural collapse J30.
of secondary structure supporting from catastrophic flare failure.
large hydrocarbon liquid Prevent further escalation.
inventories.
Notes:
1. Should flare header or venting systems in enclosed space rupture during blowdown, then severe
explosion with high overpressure load on decks and equipment could lead to structure supporting
strength built into key structure. Failure of flare header or knockout drums is likely to be caused by
explosion or fire from another event. Addition of blowdown products may not be significant in ongoing
context of initiating event. This should be examined.
2. Passive protection of flare header supports is recommended throughout hydrocarbon processing areas of
Page 53 of 64
platform. It is impractical to protect headers themselves. This should be achieved by closer spacing of
pipe supports and cooling effects of depressurising gas.
3. It is critical that flare system maintain its integrity, even during infrequent events. Passive protection is
default for these scenarios both to withstand credible external effects and failure of flare system itself.
This should be augmented with deluge onto vessels. Passive protection for these vessels is not
recommended because of difficulties of removal, inspection, and corrosion underneath system.
General notes:
a. Damage to flare system causes both loss of that safety system and potential redirection of whole gas
inventory on facility into one area. Event may be controllable if system is located on top deck but is
likely to have severe impact on fixed platform if flare is located lower in process area. May cause
structural failure and be much more likely to escalate to other inventories.
Page 54 of 64
A.3.7. Export/import systems and risers
Table A.13 - Export/import systems and risers on fixed and floating facilities

Gas and oil export and import risers.
Well fluid import from remote wells and fields.
Topsides ESD valves.
Pig sphere launchers and receivers, kicker lines, and instrumentation.
Controllable events
Controllable events are associated with isolated releases from facilities inboard of riser ESD valves (e.g., flowlines,
manifolds). These may be high pressure export, injection or lift gas high pressure well fluids with a high gas content, low
pressure predominantly oil well fluids, export oil with high pumped pressure, and low vapour pressure.
Likely release points are launcher doors and instrument tappings. These inboard facilities will have between 0,5 tonne
and 5 tonne, with larger oil inventories having sufficient inventory to cause escalation. Typically, damaging fires should be
of moderate duration, 20 min to 30 min, but larger short duration fires may have an impact on escape routes and
potentially muster areas.
Fire sources may be in three locations: roofed modules, under process decks, and in open deck spaces, such as top
decks or outer walkways. If there is roof or deck over leak source, effects will be more severe, with possibility of external
flaming and fire spread over adjacent plant.
Evacuation events
Release directly from riser outboard of ESD or release from inboard facilities combined with failure to close or serious
leakage through topsides ESD valve.
Exposure to fires from adjacent processing leading to loss of containment of flowlines or any exposed riser sections
outboard ESD valve.
For high pressure gas risers, severe explosion is possible, particularly if gas is released towards enclosed modules or
spaces on facility. These could lead to critical escalation due to very rapid buildup of large gas cloud.
Location and protection of risers 1 Avoid exposure to major accident risks Major accident risk to be
and riser ESD valves. (1) arising from processing or facility minimised.
operations. Riser SDV and flowlines are
Avoid impairment by dropped objects, commonly at risk from
impact (ship impact), fire, or explosion process explosion and fire
hazards (from process and other risers). hazards.
Location such that major accident
involving riser has least possible effect on
refuge, muster, and evacuation systems.
ESD: isolation of riser Inventory 1 Prevent riser inventories feeding through Riser and process isolation
and process plant, plus blowdown. to the facility. valves close fully within 30 s.
Reduce intensity and duration of any jet Blowdown initiation in 1 min
fire from inboard inventories and prevent
escalation to other risers.
Reduce risk of process inventories being
released, causing escalation.
ESD of remote and subsea wells. 1 Limit duration of well riser release. High integrity well isolation
(2) system to provide rapid
shutdown.
disposal of unburned hydrocarbon where they cannot burn or combustion remove oil: capacity 115% of
liquids. For releases or fire on would not cause hazard to facility (either combined maximum
facility. (3) retain oil in fire area or safely dispose of hydrocarbon release rate
General area deluge of oil export 1 Prevent failure and ensure ESD 20 l/min/m2.
and import pigging facilities. (4) operability under major accident
conditions.
Suppress combustion and vaporisation of
hydrocarbon liquids.
Page 55 of 64
Passive protection of top of riser, 2 Ensure ESD valve operation, sealing, and J30, H60, and designed to
ESD valves, actuators, their power joint integrity. withstand SLB and DLB
supplies, and riser structural Prevent catastrophic failure of pig events. (see Notes)
supports. (5) launcher system including door assembly.
Epoxy intumescent protection of 2 Prevent structural failure leading to riser J60 extending 5 m below
structures supporting heavy loads impact and release. lowest inboard processing.
that may collapse onto riser of
ESD.
Subsea or secondary off 2 Limit duration of riser fire such that Same performance as riser
installation isolation valves. (2) evacuation is not required. isolation.
2
Specific deluge of inboard oil 3 Prevent further release of oil that may 20 l/min/m .
export/import piping underneath then endanger the risers.
main platform decks.
Notes:
1. Fire hazards from import/export facilities must be controlled effectively if riser failure is to be
prevented. Effective isolation of risers and process is all that is required for gas fires. Oil facilities also
require deluge suppression of oil fires around pig launcher/receiver facilities.
2. Riser ESD valves shall be able to close under accident conditions. This means that actuators may need to
be protected from fire and blast for a short period (up to 3 min) from jet fire and blast.
3. Fire on the sea is a possibility that should be considered. Bunding and drainage for process facilities in
event of large release of oil may discharge collected oil to sea, but these facilities should be designed to
extinguish fire before discharge to sea. Fire on the sea may prevent evacuation and lead to catastrophic
event.
4. Oil inventories should not be sufficient to cause prolonged external flaming from roofed module. If
such, general area deluge over pigging facilities may need to be extended over entire module.
5. If possible, platform should be arranged such that passive protection of riser ESD valves and risers is not
required. This will require relocation of all instruments and joints other than those on ESD valves to
another location. If there are multiple risers, leakage from ESD joints onto another riser may increase
need for passive protection.
General notes:
a. Explosion effects on risers and ESD valves are typically confined to drag loads.
b. Fire and explosion events arising from risers can have most significant impact of all hazards, and release
may rise through or travel underneath other modules.
Page 56 of 64
A.3.8. Risers and turrets on FPSOs
Table A.14 - Risers and turrets on FPSOs

Risers from naturally flowing, gas lifted, and pumped oil wells.
Gas and oil export risers.
Gas lift and gas reinjection risers.
Topsides ESD valves for all risers.
Hydrocarbon and control swivel assemblies.
Import and export manifolds.
Controllable events
These arise from isolated release of hydrocarbons inboard of riser ESD valves. They include high pressure export,
injection or lift gas, high pressure well fluids with a high gas content, low pressure predominantly oil well fluids, export oil
with high pumped pressure, and low vapour pressure.
Likely release points will be swivel joints, manifold connections, and instruments. Isolated inventories should range from
0,5 tonne to 2 tonne of gas, to 10 tonne to 15 tonne of oil. Gas inventories have low probability of escalation and limited
to turret itself. Oil inventories could sustain fires engulfing turret and structure up to 2 hr with radiation onto surrounding
plant. Area of turret below deck level will have very limited ventilation and have fires of moderate intensity. Higher
sections will have sufficient air and pressure fed fires creating high heat fluxes.
Evacuation events
These events are associated with topsides release as described above together with failure to isolate one or more risers.
These may follow explosion in turret area. These may also be associated with leakage from top joint of riser if design
allows hydrocarbons to pass through bearing and hub assembly to burn above them. Hydrocarbons may also escape and
burn outside hull. (1)
Turret may also be exposed to very large fires associated with the oil processing, particularly slug catchers.
Turret may also be exposed to oil fires following catastrophic explosion in cargo tanks.
ESD: isolation of riser inventory 1 Prevent riser inventories feeding through Riser and process isolation
and process plant, plus blowdown. to the facility. valves close fully within 30 s.
(2) Reduce intensity and duration of any jet Blowdown initiation in 1 min.
fire from inboard inventories and prevent
escalation to other risers.
Reduce risk of process inventories being
released to cause escalation.
ESD of remote/subsea wells. 1 Limit duration of well riser release. High integrity well isolation
system to provide rapid
shutdown.
Location or passive protection of 1 Prevent escalation to risers and either J30, H60.
flexible riser joint and riser section further release of their contents in turret
above water (if any). area or their catastrophic failure and
discharge of their contents in uncontrolled
manner.
Location of primary turret bearings. 1 Prevent their catastrophic failure and
(3) maintain their full operability after incident.
Passive protection of the top of 2 Ensure ESD valve operation, sealing, and J30, H60, and designed to
riser, ESD valves, actuators and joint integrity. withstand SLB and DLB
their power supplies and riser events. (4)
structural supports.
2
Peripheral deluge around turret 1 Suppress combustion, heat fluxes, and Minimum of 20 l/min/m over
envelope. (5) external effects of all fire types within entire turret envelope up to
turret. elevation of highest live
Cool swivel and manifolds. hydrocarbon piping or swivel
joint. (6)
disposal of unburned hydrocarbon where they cannot burn or combustion remove oil: capacity 115% of
liquids. (7) would not cause hazard to facility (either combined maximum
retain oil in fire area or safely dispose of hydrocarbon release rate
Page 57 of 64
Epoxy intumescent fire protection 2 Support swivel, deluge, and critical safety
of support structure for swivel and systems.
deluge. Prevent structural collapse onto riser ESD
valves.
Notes:
1. For explosion events, turret assembly is an enclosed area, particularly if weather or wind reduction
screens are included. Given potential for high gas release rates from risers, large cloud can develop
quickly and ignition will lead to high overpressure on decks and high drag loading on systems and
equipment.
2. Prevention of riser failure and assurance of their topsides ESD operability and survivability is critical.
Arrangement of turret will determine whether valves should be individually protected or enclosed within
larger protected space.
3. Operability of turret bearings after an incident is critical so that FPSO may weathervane. If it cannot,
whole mooring and riser system may be at risk when weather changes. This may also apply to
operability of swivel if it cannot be disconnected from either hub or manifolds.
4. It should be possible to limit duration and severity of credible riser events such that further escalation
does not occur and evacuation is not required. This will also need intense deluge to achieve this,
particularly if accommodation is located in bow just forward of turret. It will be necessary to design
deluge such that it can withstand effects of “frequent” explosions and to support it directly from swivel
support and access structure.
5. To achieve suppression, very intense deluge will be required, totally filling area with medium to large
droplets. This should be performed using peripheral deluge supported on structure rather than running
piping within turret. It should be arranged such that water is both injected into air being induced into fire
at deck level and injected into combustion zone at higher levels. This will also provide coverage of
vulnerable equipment.
6. Minimum standard of 20 l/min/m2 has been specified. This should be increased such that full capacity of
firewater system can be applied to turret and immediate process plant. Systems should be sized such that
no single system has demand greater than minimum performance of any fire pump.
7. Purpose of liquids spill containment is to prevent oil spread into process areas and top deck. If design of
turret can contain these liquids and allow deluge water to pass through into sea, this arrangement should
be used.
General notes:
a. Monitors do not provide effective suppression of turret fires and will put operators at risk during
operation. They should not be used for primary protection.
b. Infrequent incidents may cause radiation onto large process vessels, such as slug catchers, requiring
operation of their deluge. Total installed firewater capacity may be used for simultaneous operation of
turret and adjacent process deluge systems.
Page 58 of 64
A.3.9. Hazardous drains systems
Table A.15 - Hazardous drains systems in roofed and enclosed modules

Hazardous closed drains drums.
Hazardous open drains tanks.
Drains caissons.
Recovery and return pumps.
Controllable events
May be associated with leaks from drains systems leading to minor spills and gas leaks from system. They should be
2
limited to small pool fires within containment systems, typically maximum of 20 m or 1 kg/s. Gas releases will be
subsonic and should not cause escalation. Fires are unlikely to cause flaming or serious smoke impairment outside
roofed modules. Leakages from return pumps may be at moderate pressure creating spray fires, but fires should reduce
to pool fires on pump ESD.
Evacuation events
May be associated with process upset condition and will be a function of type of fluid bring processed on platform. There
may be gas breakthrough, heavy vapours from gas liquids, or release of excess quantities of oil or gas liquids due to
isolation failure from large process inventories. These releases should be at virtually atmospheric pressure and not more
than 7 bar. In roofed module, these may cause serious external flaming. As they will be low on facility, may cause
escalation to process above and primary structure and have smoke and flame impact on muster and evacuation systems.
Infrequent events may also be preceded by explosion if there is gas liquids inventory that can be drained into system.
Control and disposal of spills. (1) 1 Limit pool fire size, control its spread, and Capacity: 115% of combined
safely dispose of unburned inventory from maximum hydrocarbon
major process upset (an infrequent event). release rate plus deluge
rate.
ESD of drains return pumps. 1 Reduce pressure of liquid release at High integrity well isolation
pumps. system to provide rapid
shutdown.
Firewalls (for enclosed or roofed 1 Prevent spread of fire arising from H60.
modules). frequent and infrequent events into
adjacent nonhazardous areas, such as
utilities or under platform towards muster
and evacuation systems.
Epoxy intumescent passive fire 1 Prevent progressive structural collapse H60.
protection of primary structure arising from frequent and infrequent
within drains area. incidents.
Epoxy intumescent passive fire 1 Prevent loss of support of tall structures, H60.
protection of critical secondary large liquid hydrocarbon inventories, and
structure within drains area. critical safety systems arising from
frequent and infrequent incidents.
2
Oil and condensate production 1 Suppress combustion and vaporisation 12 l/min/m .
platforms only: general area deluge from pool fire.
over containment area of drains
return pumps, tops of atmospheric
tanks and other recognised leak
points.
2
Oil and condensate production 2 Prevent further loss of inventory. 10 l/min/m .
platforms only. Specific deluge onto
hazardous closed drains drum
2
Oil and condensate platforms. 2 Suppress combustion and vaporisation 12 l/min/m .
General area deluge over whole of from pool fire.
roofed drains areas.
ESD: isolation of drains’ drums and 2 Minimise inventory feeding fire.
tanks and outlets feeding return
pumps.
Full process ESD. 2 Isolate feed to vessels that may be
supplying drains’ drums.
Page 59 of 64
Notes:
1. Hazardous drains tanks and vessels will be located at lowest practical point relative to process plant and
may be at same level or lower than muster, accommodation, fire pumps, and evacuation systems. Under
normal circumstances, leaks and fires in drains may be frequent but small. They should not have
inventory or fire size to cause escalation or overwhelm platform such that evacuation is required.
General notes:
a. For gas production facilities, amount of liquids in process plant are considered to be such that, even
under process upset conditions, insufficient inventory would be fed to drains system to have potential for
major escalation. This should be confirmed by examination of process. If this is case and platform has
firewater infrastructure, default requirements for oil processing platform should be applied.
b. There are circumstances if major inventories may be drained down or isolation failure causes large
continuous feed to system from process plant. These events could give rise to events of scale such that
all consequences could be realised. Compact fixed platforms with processing and utilities on several
levels will be most vulnerable with possibility of flames spreading under platform towards safe areas.
Firewalls would be required to prevent this fire spread and deluge suppressing combustion if required.
Page 60 of 64
A.3.10. Drilling and well service facilities
Table A.16 - Drilling and well service facilities

Drill floor and drilling equipment.
Derrick.
Kill lines and manifolds.
Mud pumps and tanks.
Mud returns systems and shale shakers.
Blowout preventer and hydraulic package.
Wireline unit.
Coiled tubing unit.
Wireline/coiled tubing lubricator and blowout preventer.
Controllable events
Events are associated with smaller releases or seepages of oil and gas from well or returning with drilling fluids. They are
limited scale such that it should be possible for well to be brought back under control using kill systems or for flow to be
stopped using blowout prevention equipment and other isolation in safe of well service.
These releases may occur on drill floor, underneath, on wireline/well service deck, or with hydrocarbons appearing at
mud returns system.
Fires associated with oil based muds are not considered, as these should no longer be used. If they are, fire risk analysis
should identify needs for protection.
Evacuation events
Events may involve loss of well control and continuous release of well fluids. May also be associated with major release
and accumulation of oil prior to ignition, with oil accumulations spayed around source and cascading to levels beneath.
With sustained drilling blowout, it will be at relatively high level compared with processing, muster, and evacuation.
Immediate threat would be to derrick structure and any well services not segregated by firewalls or decks.
For well service, point of release can be lower, either in wellbay (see relevant section) or on impact deck. This lower level
can have greater impact on drilling support structure, with possibility of complete facility collapsing onto other wellheads.
Similar consequences may arise from shallow gas blowouts where diverter fails, causing major gas release under drilling
support structure.
Drilling facilities may also be exposed to process events and external flaming from other areas.
Well control and blowout 1 Control and stop continuous well releases. BP well operations
prevention systems. standards.
Containment, drainage, and safe 1 Limit pool fire size, control spread, and Capacity: 115% of combined
disposal of unburned hydrocarbon safely dispose of unburned inventory from maximum hydrocarbon
liquids. moderate events. release rate plus deluge
Prevent oil spreading to nonhazardous rate.
and critical well control areas during
uncontrolled well release.
Fire and blast barriers to segregate 1 Prevent fire and oil spread towards muster J60, with SLB and DLB
drilling and well service areas from and evacuation areas. events.
nonhazardous areas (except on top
decks).
Fire and blast barriers to segregate 1 Allows drill crews to achieve well control. J60, with SLB and DLB
drilling from mud and well control events.
equipment (except on top decks).
(1)
Fire and blast barriers to segregate 1 Prevent escalation to process areas until J60, with SLB and DLB
drilling from process areas (except evacuation. events.
on top decks). Prevent collapse of the drilling rig onto
wells before evacuation.
Epoxy intumescent passive fire 1 Suppress combustion of oil carried over J60.
protection on drilling support mud returns.
structure and skid beams.
Page 61 of 64
2
General area deluge over shale 1 Cool derrick, drilling equipment, and BOP. 20 l/min/m over shakers
shaker area (oil and condensate and radius of 3 m.
fields only).
Top deck monitors (only on 2 Assist disposal of oil and suppress 4 of 3600 l/min capacity.
platforms with existing firewater combustion of oil seepage not the drill
infrastructure of sufficient capacity). floor.
(2)
2
Drill floor deluge (only on oil and 2 Cool wireline coiled tubing BOP. 20 l/min/m .
condensate fields). (2)
Impact deck monitors (oil and 2 2 of 3600 l/min capacity.
condensate production platforms
only).
Notes:
1. Reservoir, type of drilling, and well service activity will determine type of event and impact on
platform. Passive protection should be used to protect drill crews attempting to run well kill equipment
and to shield personnel during evacuation from infrequent events, such as uncontrolled well releases.
2. For active systems, deluge and monitors should be used to control lesser events on oil reservoirs.
Monitors may also be used to delay structural failure of derrick during larger events, such as blowouts.
Active systems should be of large capacity and use as much of platform firewater capacity as possible.
Active systems should be located as far from drilling facilities as possible to allow wider coverage and
safe operation by the fire crews.
General notes:
a. If possible, live firewater connections to derrick that might be vulnerable to damage in fire, either
directly or through loss of support, should be avoided.
Page 62 of 64
A.3.11. Methanol storage
Table A.17 - Methanol storage

Methanol storage tanks.
Methanol injection pumps.
Controllable events
Methanol pool fires. Note that methanol burns with a nearly colourless flame.
Evacuation events
None.
Containment and spill disposal. 1 Limit size and spread of methanol pool Capacity: 115% of combined
fire. maximum hydrocarbon
Allow effective dilution of methanol by release rate plus deluge
deluge. rate.
2
General area deluge over leak 1 Dilute and extinguish fire. 12 l/min/m .
points, pumps, and spill
containment areas, only if platform
has firewater infrastructure.
Specific deluge of methanol tank, 2 Prevent release of tank contents if
only if platform has firewater exposed to process fires.
infrastructure.
2
Manual dump of methanol to sea. 2 Safely dispose of inventory. 10 l/min/m .
General notes:
a. Most methanol fires are associated with shallow spills and can be extinguished with dilution. It should
not be necessary to add foam to deluge.
Page 63 of 64
Bibliography
BP
[1] GP 48-01 Project HSSE Review.
[2] GIS 24-071 Fine Water Spray Active Fire Protection.
[3] IMFS BP integrity management functional standard.
API (American Petroleum Institute)

[4] API RP 14C Recommended Practice for Analysis, Design, Installation, and Testing of Basic
Surface Safety Systems for Offshore Production Platforms.
[5] API RP 14G Recommended Practice for Fire Prevention and Control on Open Type Offshore
Production Platforms.
[6] API RP 14J Design and Hazards Analysis for Offshore Production Facilities.
Page 64 of 64

GP 24-20 - Fire and Explosion Hazard Management - Offshore - 0900a8668010d2ac PDF

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

GP 24-20 - Fire and Explosion Hazard Management - Offshore - 0900a8668010d2ac PDF

Enviado por

Direitos autorais:

Formatos disponíveis

Document No.

Guidance on Practice for

A.2.2. Protected areas and equipment ................................................................................ 31

Table A.1 - Wellbay with low pressure oil production .................................................................... 34

Table A.16 - Drilling and well service facilities............................................................................... 61

Figure 1 - Fire and explosion hazard management summary........................................................ 14

a. This Guidance on Practice (GP) provides guidance on developing, implementing, and

GP 30-76 Safety Instrumented Systems (SIS) – Development of the Process

3. Terms and definitions

Ductile level blast

Fire and explosion hazard management (FEHM)

Major accidental event

Safety critical design measure (SCDM)

Strength level blast

4. Symbols and abbreviations

BOP Blow out preventer

CBA Cost benefit analysis.

CFD Computational fluid dynamics.

CVP Capital value process.

DHSV Downhole safety valve.

DLB Ductile level blast.

EER Escape evacuation and rescue.

EHA Explosion hazard analysis.

ESD Emergency shutdown.

FEHM Fire and explosion hazard management.

FEHR Fire and explosion hazard register.

FHA Fire hazard analysis.

FPSO Floating production, storage, and offloading unit.

HAZID Hazard identification study.

HAZOP Hazard and operability study.

NGL Natural gas liquids.

QRA Quantitative risk assessment.

SCE Safety Critical Equipment

SIL Safety integrity level.

SCDM Safety critical design measure.

SDV Shutdown valve.

SIMOPS Simultaneous operations – drilling & construction or operations and construction

SLB Strength level blast.

SSIV Subsea isolation value.

5.1. FEHM Policy

5.2. Responsibility and Timing

6. Fire and explosion hazard management (FEHM)

6.1.2. Fire and explosion hazard hierarchy

6.1.3. SCDM hierarchy

6.2. Hazard categories

6.2.2. Controllable hazards

6.2.3. Evacuation hazards

6.2.4. Catastrophic hazards

6.3. FEHM process

6.4. FEHM and CVP

8.2. Hazard identification

Figure 1 - Fire and explosion hazard management summary

• Identify primary risk drivers.

• HAZID on each option.

• Systematic hazard identification.

• Design SCDMs to meet performance standards

• Verify implementation, operation, and performance of

8.3. Hazard evaluation

8.4. Hazard conflicts

8.5. Catastrophic hazards

8.6. Final evaluation

9.1. Hazard identification during Define stage

9.2. Process and layout optimisation