NORSOK STANDARD

TECHNICAL SAFETY

S-001 Rev. 3, Jan. 2000

This NORSOK standard is developed by NTS with broad industry participation. Please note that whilst every effort has been made to ensure the accuracy of this standard, neither OLF nor TBL or any of their members will assume liability for any use thereof. NTS is responsible for the administration and publication of this standard. Norwegian Technology Standards Institution Oscarsgt. 20, Postbox 7072 Majorstua N-0306 Oslo, NORWAY Telephone: + 47 22 59 01 00 Fax: + 47 22 59 01 29 Email: norsok@nts.no Website: http://www.nts.no/norsok

Technical Safety

S-001 Rev. 3, Jan. 2000

CONTENTS
FOREWORD INTRODUCTION 1 SCOPE 2 NORMATIVE REFERENCES 3 DEFINITIONS AND ABBREVIATIONS 3.1 Definition 3.2 Abbreviations 4 SAFETY EVALUATION, MANAGEMENT AND DOCUMENTATION 4.1 General 4.2 Risk reduction principles 4.3 Analyses and optimisation 4.4 Documentation 5 EVACUATION AND EMERGENCY PREPAREDNESS 5.1 Introduction 5.2 Evacuation 5.3 Rescue 6 SAFETY REQUIREMENTS TO LAYOUT AND ARRANGEMENT 6.1 General requirements 6.2 Area Classification 6.3 Escape routes 6.4 HVAC 6.5 Helicopter deck 6.6 Emergency service areas 6.7 Process area 6.8 Riser area 6.9 Flare boom, flare tower, cold vent 6.10 Drilling and wellhead area 7 SAFETY REQUIREMENTS TO STRUCTURAL DESIGN 7.1 Design accidental loads 8 SAFETY REQUIREMENTS TO PROCESS AND AUXILIARY FACILITIES 8.1 General requirements 8.2 Safety shutdown systems 8.3 Process safety 9 REQUIREMENTS TO SAFETY AND COMMUNICATION SYSTEMS 9.1 General requirements 9.2 Fire and Gas detection 9.3 Emergency shutdown 9.4 Ignition source control 9.5 Alarm and communication system 9.6 Emergency power 9.7 Communication through signs and markings 10 REQUIREMENTS TO EXPLOSION AND FIRE PROTECTION 3 3 4 4 5 5 8 9 9 9 9 10 11 11 11 12 12 12 13 13 13 14 14 14 15 15 15 16 16 17 17 17 17 18 18 18 19 22 23 24 26 26

NORSOK standard

Page 1 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000 26 26 27 27 27 28 28 31 32 32 33 33 33 34 34 34 34 34 35 35 36 37 38 39 42 44 48

10.1 Fire and Explosion strategy (FES) 10.2 General requirements to fireprotection. FES 10.3 Requirements for passive fire protection of equipment, piping and secondary structures. 10.4 Fire technical requirements relating to materials 10.5 Passive fire protection 10.6 Storage and handling of explosives 10.7 Active Fire Protection 10.8 Explosion protection. 11 SAFETY ASPECTS RELATED TO FLOATING PRODUCTION, DRILLING AND STORAGE INSTALLATIONS 11.1 General 11.2 Crude storage 11.3 Layout 11.4 Turret 11.5 Drainage/Ballast water systems 11.6 Emergency re-positioning 11.7 Topside/floater interface 12 NORMALLY NOT MANNED INSTALLATIONS 12.1 General 12.2 Safety evaluation, management and documentation. 12.3 Design principles 12.4 System requirements. ANNEX A - INFORMATIVE REFERENCES (INFORMATIVE) ANNEX B - EVACUATION (NORMATIVE) ANNEX C - MISCELLANIOUS SAFETY EQUIPMENT (NORMATIVE) ANNEX D - LAYOUT (NORMATIVE) ANNEX E - PRESSURE RELIEF (NORMATIVE) ANNEX F - FIRE AND GAS DETECTION (NORMATIVE)

ANNEX G - PROTECTION OF PRESSURE VESSELS AND PROCESS PIPING AGAINST FIRE (NORMATIVE) 55 ANNEX H - FIRE FIGHTING SYSTEM (NORMATIVE) ANNEX I - LIVING QUARTERS (NORMATIVE) ANNEX J - FIRE PROTECTION DATA SHEET (INFORMATIVE) ANNEX K - NORMALLY NOT MANNED INSTALLATIONS (INFORMATIVE) 57 62 63 64

NORSOK standard

Page 2 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

FOREWORD
NORSOK (The competitive standing of the Norwegian offshore sector) is the industry initiative to add value, reduce cost and lead time and eliminate unnecessary activities in offshore field developments and operations. The NORSOK standards are developed by the Norwegian petroleum industry as a part of the NORSOK initiative and supported by OLF (The Norwegian Oil Industry Association) and TBL (Federation of Norwegian Manufacturing Industries). NORSOK standards are administered and issued by NTS (Norwegian Technology Standards Institution). The purpose of NORSOK standards is to contribute to meet the NORSOK goals, e.g. to develop standards that ensure adequate safety, value adding and cost effectiveness and thus are used in existing and future petroleum industry developments. The NORSOK standards make extensive references to international standards. Where relevant, the contents of a NORSOK standard will be used to provide input to the international standardisation process. Subject to implementation into international standards, the NORSOK standard will be withdrawn. Annexes B, C, D, E, F, G, H and I form a normat6ive part of this standard. Annexes A, J, and K are for information only.

INTRODUCTION
The purpose of this standard is to present the principles and requirements for safety design of offshore installations for production of petroleum. ISO 13702 presents the general experiences and requirements from the International offshore industry and NORSOK S-001 adds the specific requirements/experiences from the Norwegian operators. Therefore ISO 13702 and NORSOK S-001 have to be read and understood in conjunction with each other.

NORSOK standard

Page 3 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

SCOPE

This NORSOK standard for Technical Safety describes the principles and requirements for the development of the safety design for offshore production installations; fixed platforms, semisubmersibles and vessels. Where applicable this standard may also be used for Mobile Offshore Drilling Units. Installations intended for short term exploration drilling, shuttle of crude to harbour and general service are not covered by this standard. This Standard together with ISO 13702 " Control and mitigation of fires and explosionsrequirements and guidelines" defines the required standard for implementation of technologies and emergency preparedness to establish and maintain an adequate level of safety for personnel, environment and material assets. This standard will further have to be applied together with NORSOK standards for working environment and environmental care. The principles and requirements for safety evaluation and safety management are described in ISO 13702 Chapter 4 while the objectives and functional requirements to installation layout are described in chapter 5. These methodologies are clarified and detailed in S-001 chapter 4. Requirements to Risk and Emergency Preparedness Analyses are described in NORSOK Z-013 and are referenced concerning required input to the design process. Requirements to Working environment are described in NORSOK S-002

NORMATIVE REFERENCES

The following standards include provisions, which, through references in this text, constitute provisions of this NORSOK standard. Latest issue of the references shall be used unless otherwise agreed. Other recognised standards may be used provided it can be shown that they meet or exceed the requirements of the standards referenced below. API 6FA API RP 521 BS 6755 E&P Forum ICAO BSL 5-1 Fire tests for valves Guide for pressure-relieving and depressuring systems Testing of valves. specification for fire type-testing requirements Guidelines for the Development and Application of HSE Management System. International Civil Aviation Organisation Bestemmelser for Sivil Luftfart 5-1, Forskrift om kontinentalsokkelflygning ervervsmessig luftfart til og fra helikopterdekk p faste og flyttbare innretninger til havs. Electric apparatus for explosive gas atmosphere- Part 10 Classification of hazardous areas. Electric apparatus for explosive gas atmosphere- Part 13 Construction and use of rooms or buildings protected by pressurisation. Mobile and fixed offshore units- Electrical installations. Part 7 area classification Flame spread, surface materials and floorings Analysis, design, installation and testing of basic surface safety systems for offshore production platforms. Page 4 of 66

IEC 60079-10 IEC 60079-13 IEC 61892-7 IMO Resolution A653 ISO 10418

NORSOK standard

Technical Safety

S-001 Rev. 3, Jan. 2000 (Replaces API RP14 C). Petroleum and natural gas industries Offshore production installationsControl and mitigation of fires and explosions Requirements and guidelines. Fire tests - Reaction to fire - Rate of heat release from building products. National Fire Protection Association part 11 Standard for medium- and high-expansion foam systems National Fire Protection Association part 13 Installation of sprinkler systems National Fire Protection Association part 14 Standard for the Installation of Standpipe and Hose Systems National Fire Protection Association part 16 Deluge Foam-Water Sprinkler Systems and Foam-Water Spray Systems Standard for the Installation of Centrifugal Fire Pumps National Fire Protection Association part 72 National Fire Alarm Code Living quarters area Architectural components and equipment HVAC (Heating, ventilation and air conditioning) Safety and Automation Systems (SAS) Piping Design, Layout and Stress Analysis Surface Preparation and Protective Coating. Process Design Working Environment Environmental Care Safety equipment data sheets Telecom Subsystems Risk and emergency preparedness analysis. Regularity, management & reliability technology

ISO 13702

ISO 5660 NFPA 11A NFPA 13 NFPA 14 NFPA 16 NFPA 20 NFPA 72 NORSOK C-001 NORSOK C-002 NORSOK H-001 NORSOK I-CR-002 NORSOK L-002 NORSOK M-501 NORSOK P-001 NORSOK S-002 NORSOK S-003 NORSOK S-011 NORSOK T-100 NORSOK Z-013 NORSOK Z-016

3
3.1

DEFINITIONS AND ABBREVIATIONS

Definition

Acceptance Criteria for risk Criteria that are used to express a risk level that is considered acceptable for the activity in question, limited to the high level expressions of risk. Accidental event Event or chain of events that may cause loss of life, health, or damage to environment or assets. Barrier A measure which reduces the probability of realising a hazards potential for harm and of reducing its consequences. Barriers may be physical, (materials, protective devices shields, segregation etc) or non - physical (procedures, inspection, training, drills) Can Verbal form used for statements of possibility and capability, whether material, physical or casual. Defined situations of A selection of possible events that the emergency preparedness in the hazard and accident (DFU) activity should be able to handle, based on the activitys dimensioning NORSOK standard Page 5 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000 accidental situations associated with a temporary increase of risk and less extensive accidental events. Explosion which in accordance with the defined acceptance criteria represents an unacceptable risk, and which consequently serves as a basis for design and operation of installations and for the implementation of the relevant activity in general. A fire which in accordance with the defined acceptance criteria represents an unacceptable risk, and which consequently serves as a basis for design and operation of installations and for the implementation of the relevant activity in general. Accidental events that serve as the basis for layout, dimensioning and use of installations and the activity at large, in order to meet the defined risk acceptance criteria. The most severe accidental load that the function or system shall be able to withstand during a required period of time, in order to meet the defined risk acceptance criteria Explosion, which in accordance with the defined acceptance criteria represents an unacceptable risk and which consequently, serves as a basis for design and operation of installations and for the implementation of relevant activity in general. A fire which in accordance with the defined acceptance criteria represents an unacceptable risk, and which consequently serves as a basis for design and operation of installations and for the implementation of relevant activity in general. Lighting which will ensure adequate light conditions on the installation in the event of failure of the main power supply. System to ensure continuos power supply to important equipment in the event of failure of the main power supply. This includes generators, control panels, hydraulic pumps, accumulators etc. Safe areas by location where the emergency equipment such as fire pumps emergency generators are located. The pressure generated by violent combustion of a flammable gas or mist which generates pressure effects due to confinement of the combustion induced flow and/or the acceleration of the flame front by obstacles in the flame front. Systems which ensure necessary communication to and from the installation. The total quantity of heat released in the case of complete combustion of all combustible materials in an area, including materials in walls, decks and ceiling. The total system, which supplies water for fire-fighting system, i.e. water inlets with filters, fire pumps, risers, power sources, power transmissions, fuel pipes/tanks and control systems. As defined in ISO 13879 and 13880: Document that specifies the requirements expressed by features, characteristics, process conditions, boundaries and exclusions defining the performance of the product, process or service. Potential for human injury, damage to the environment, damage to property or a combination of these. Page 6 of 66

Dimensional explosion

Dimensional Fire

Dimensioning accidental events (DUH) Dimensioning accidental load (DUL) Dimensioning explosion

Dimensioning fire

Emergency lighting Emergency power system

Emergency service areas Explosion load

External communication Systems Fire load

Fire pump system

Functional specification

Hazard

NORSOK standard

Technical Safety

S-001 Rev. 3, Jan. 2000 Process whereby the results of hazard analyses are considered against either judgement, standards, or criteria which have been developed as basis for decision making. A document providing a brief, but complete, overview of the identified hazards and the measures necessary to manage them. The hazards register also provides references to more detailed information relevant to a particular hazard. Shall mean informative in the application of NORSOK Standards. Work area or work place where inspection, maintenance or other work is planned to last at least two hours a day for at least 50 per cent of the installations operation time. Systems which ensure that messages can be communicated to and from various areas on the installation. Verbal form used to indicate a course of action permissible within the limits of the standard. Work area or work place that is not permanently or intermittently manned. Shall mean normative (a requirement) in the application of NORSOK Standards. Norsk Sokkels Konkurranseposisjon, the Competitive standing of the Norwegian Offshore Sector, the Norwegian initiative to reduce cost on offshore projects. Work area or work place manned at least 8 hours a day for at least 50 per cent of the installations operation time. An institution which is internationally and/or nationally recognised within a professional field, and which possesses adequate competence and experience within that field. Verbal form used to indicate requirements strictly to be followed in order to conform to the standard and from which no deviation is permitted, unless accepted by all involved parties. Verbal form used to indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required. A place provided where personnel can take refuge for a predetermined period whilst investigations, emergency response and evacuation pre-planning are undertaken.

Hazard assessment

Hazards Register

Informative references Intermittently manned

Internal communication Systems May Normally not manned Normative references NORSOK

Permanently manned Recognised institution

Shall

Should

Temporary Refuge (TR)

All terms and phrases within the scope of this standard shall be regarded as defined in the regulations and international codes and standards referred to in this document. Where this is not unambiguous, the definition in this standard shall be used.

NORSOK standard

Page 7 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

3.2 Abbreviations AFFF Aqueous film forming foam API American Petroleum Institute (US) APS Abandon Platform Shutdown ASC Area safety charts BOP Blow Out Preventer CCR Central Control Room CFD Computerised flow dynamic DAL Design Accidental Load DHSV Down Hole Safety Valve DUH Dimensioning Accidental Event DUL Dimensioning Accidental Load EERS Evacuation, Escape and Rescue Strategy (ISO 13702) ESD Emergency Shut Down ESDV Emergency Shut Down Valve F&G Fire and Gas FES Fire Explosion Strategy (ISO 13702) FPDS Fire protection data sheet HAZID Hazard identification HAZOP Hzard and operability HC Hydrocarbons HSE Health, Safety and Environment HVAC Heating, Ventilation and Air Conditioning IEC International Electrotechnical Commission IMO International maritime organisation IP Institute of Petroleum (UK) IR Infra Red KO Knock Out LEL Lower Explosion Limit LQ Living Quarter MOB Man Over Board MSF Module support frame NFPA National Fire Protection Association (US) NNMI Normally Not Manned Installations NPD Norwegian Petroleum Directorate PA Public Address PCDA Process control and data acquisition PCS Process Control System PSD Process Shut Down RAL Deutches Institut fur Gutesicherung und Kennzeichnung e.V., Bonn RP Recommended practice SAS Safety and Automation Systems TR Temporary Refuge UPS Uninterrupted Power Supply UV Ultra Violet VDU Visual Display Unit

NORSOK standard

Page 8 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

SAFETY EVALUATION, MANAGEMENT AND DOCUMENTATION

4.1 General A Health, Safety and Environmental Program (HSE) shall be developed according to the E&P forum guideline: Guidelines for the Development and Application of HSE Management Systems. This program shall among other issues address the follow up and closing of specific safety problem areas. Safety objectives established by operator/project other than those specified by this NORSOK standard and ISO 13702 shall be identified and expressed in the form of design objectivesand performance standards (See 4.4). These shall be developed specifically for each development or modification project. The FES shall reflect the mitigating and consequence reduction measures to be implemented. Ambient conditions (normal operations or emergencies) shall be clearly defined and included in requirements to equipment and systems covered by this standard. 4.2 Risk reduction principles The probability reducing measures shall be given priority over consequence reducing measures. The incorporation of this overall principle in the design calls for consideration of the following, listed in order of priority: Inherent safety Simplicity, comprehensibility, maintainability and recognisability e.g. by elimination of complexity that may lead to human failure Failure mechanisms. E.g. leading to leaks and releases of hazardous substances, ignitions or mechanisms reducing the reliability and survivability of barriers and safety systems. Escalation prevention, e.g. by safety barriers Experience retention from operational reliability and incident databases. 4.3 Analyses and optimisation The design principles presented in clauses 5 to 12 reflect a normally adequate standard for safe design, whereas the project risk acceptance criteria are reflecting the maximum risk level, not necessarily achieved through a standard design. This is because the safety level depends on several factors, partly outside the range of standardisation, e.g. detailed layout and arrangement, operational aspects, environmental conditions, and new technology. Therefore a fit for purpose approach shall be performed through consideration of possible Hazards and Hazardous events in the design. The Hazards and Hazardous events shall be systematically identified and updated regularly along with the development of the project. This process shall be documented, e.g. in a Hazards Register. Risk and emergency preparedness analysis shall be carried out with the objective to identify the hazards, their frequency, causes and consequeces and to verify that the risk acceptance criteria are met. Timing, scope and method of risk and emergency preparedness analysis shall allow for the analysis to be both a tool for decision making as well as, when relevant, a verification of acceptance criteria being met through implementation of technical and operational safety requirements. NORSOK Z-013 states the requirements on the planning, execution and use of risk and emergency preparedness analysis.

NORSOK standard

Page 9 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

A vulnerability/availability analysis shall be carried out to ensure that safety critical systems and functions maintain their integrity and perform their duty during credible accident scenarios for the time period their functions are required. The effects from fires and explosions on operation and stability on ESD, Fire & Gas detection and PA/alarm systems are typical examples of targets for such analysis. See NORSOK Z-013 Clause 5.3.8. HAZOP according to ISO 10418 shall be used as a tool in the system optimisation process to achieve system safety and operability. Cost/benefit evaluation should be applied to study different design alternatives. See NORSOK Z-013 and NORSOK Z-016. 4.4 Documentation The safety design shall be documented to present how the design fulfils regulations, standards and norms as required by the internal control system and to document the basis and assumptions for Risk and Emergency preparedness evaluations. Further, the project documentation provides the basis and necessary information for safe operation, modifications and development of the facility. Documentation should be produced as follows, but with the necessary additions where this is considered necessary the particular needs of each project. The documentation may be one or several documents. 1. 2. 3. 4. 5. 6. HSE program FES (Fire and Explosion Strategy). EERS (Evacuation, Escape and Rescue strategy). Performance Standard for Safety systems. See Note 1 Design accidental load requirements Documented sectionalisation of the process plant including categorization and location of ESD and PSD valves. 7. Fire and gas detection arrangements. 8. Fire Protection Data Sheets / Area Safety Charts 9. Reliability/sensitivity/availability/vulnerability analyses for safety systems 10. Safety arrangements drawings as follows: - Passive fire and blast protection. - Escape ways, muster areas, means of evacuation - Area classification- schedule of sources - Miscellaneous safety equipment. - Active fire protection Safety interface documents shall be produced where relevant to demonstrate how these safety requirements are met, e.g. between: - Fixed platform and mobile offshore units, e.g. drilling rig or accommodation rig. - Fixed platform and storage units - Different contractors. Safety evaluations as required by this standard shall be documented. NORSOK standard Page 10 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Note 1 Performance standard for Safety systems shall define the functional and specific requirements for the design of the ESD/PSD/F&G systems, firewater system, HVAC and isolation of ignition sources. Further it will be presented how these systems is meant to work together to minimize escalation and consequences of mishaps and accidents.

EVACUATION AND EMERGENCY PREPAREDNESS

5.1 Introduction An EERS shall be developed for the installation based on ISO 13702 Chapter 4/Annex B 12 and Emergency preparedness analyses as described in NORSOK Z-013. The EERS for the installation will define and document the adequate strategy and requirements to escape evacuation and rescue installations and equipment. In addition to the requirements in the referred standards the following requirements shall apply: All evacuation equipment shall be type approved according to SOLAS and national maritime regulatory requirements. The layout of presentation mimics and monitors in the Central Control Room shall consider management of emergency situations. The design of the facilities shall consider and cater for an effective execution of the Emergency Preparedness activities.

See Annex B for details relating to evacuation principles. 5.2 Evacuation The requirements relating to safe evacuation will be met by using a combination of means of evacuation according to current practice i.e.: a) b) c) d) Helicopter. Free fall lifeboats. Escape chute with life raft. Bridge to neighbouring installation

Number, size and location of evacuation means shall be established based on manning, risk analyses (e.g. risk exposure of escape routes towards main shelter area), and emergency preparedness analysis. The time for evacuation, together with the required search and rescue operations shall be established and the escape routes and other facilities as firewalls, radiation shields etc. designed accordingly. The minimum number of free fall lifeboats for fixed installations available during a dimensional accidental event shall be corresponding to the maximum number of personnel (100%) on board plus one additional boat. Latter is meant to provide escape for the damage control team. If there is an additional lifeboat located in an area on the installation other than the main evacuation area, this lifeboat shall not be counted, as the additional lifeboat required NORSOK standard Page 11 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

The number of free fall lifeboats for floating installations shall correspond to the maximum number of people onboard and be available in design weather conditions and with dimensional accidental heel angels, plus the significant dynamic heel in the same weather and accidental condition. The manning to be considered shall comprise all personnel on board, including day visitors. The total life raft capacity at escape chutes shall as a minimum correspond to the total number of personnel (100%) on board as documented in the EERS and according to the emergency preparedness analyses. The life raft and boarding rafts shall be lowered together with the chute. By lowering the chute, the boarding chute shall automatically inflate. The distance between lifeboats and escape chute shall be large enough to ensure that a dropped boat will not hit a lowered escape chute. For detailed recommendations related to safety equipment see Annex C. 5.3 Rescue Generally the installation shall be covered by one Man Overboard Boats (MOB`s). This one should be evaluated for use together with the one on the stand by vessel. Other combinations will be acceptable as proven by the emergency preparedness analyses. The functional requirements for time from man overboard alaram until being seaborn shall be defined by the emergency preparedness analyses. Utilisation of the deck crane to lift the MOB on to the installation shall be evaluated.

SAFETY REQUIREMENTS TO LAYOUT AND ARRANGEMENT

6.1 General requirements Reference is given to clauses 5, 7 and 13 in ISO 13702 for layout, orientation and location of equipment and functions. The main principles for layouts are listed below. For further details see Annex D. The wellhead area should be located and designed so as to allow for external fire fighting assistance. Allow for identification of the blowing well in a possible blow out situation. The utility area should serve as a barrier between hazardous areas and LQ/emergency service areas. Good access to areas and equipment shall be ensured in order to achieve effective manual fire fighting both from the installation and by external assistance. Routing of hydrocarbon piping to, or through, the utility area shall be minimised and flanges avoided. One flange connection can be arranged in each fuel line to combustion engines in utility the area. Routing of hydrocarbon piping is not allowed in the living quarter areas. Routing of liquid piping of any kind is not allowed through electrical, instrument and control room Routing of hydrocarbon piping within emergency service areas shall be limited to diesel fuel supply lines for the emergency services themselves. The use of explosion panels and weather protection shields shall be kept to a minimum, with a preference to open naturally ventilated areas. Where such arrangements are likely to cause an unacceptable working environment special solutions such as erection of temporary shields for maintenance operations should be considered.

NORSOK standard

Page 12 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Where explosions panels, walls or shields are provided, the possible utilisation of fire fighting vessels during emergencies should be considered. 6.1.1 Area classification 6.2 Area Classification The definition of hazardous areas shall be in accordance with IEC 60079-10 and IEC 61892-7. For design principles related to pressurisation of rooms, alarms and disconnection upon loss of pressurisation, ref. is made to IEC 60079-13. Gases with molecular weight between 21 and 35 shall be regarded as both heavier and lighter than air (molecular weight air = 29). The classification of hazardous areas shall be based on events and situations associated with normal platform operations, e.g. continuous or periodic venting, evaporation from open handling systems, small leaks from flanges and gaskets, escape of flammable substances during maintenance and workover operations. See Annex D Layout. All electrical equipment in naturally ventilated areas shall be certified safe type apparatus. Where certified safe type apparatus is not available, the apparatus shall be electrically isolated on single gas detection or confirmed gas detection dependent on the importance of the equipment. 6.3 Escape routes The escape routes and the temporary refuge shall be in accordance with ISO 13702 clause 14. Guidelines for the design of escape routes are listed in Annex B. For large manned installations the escape route system and the temporary refuge (TR) shall be available for at least 1 hour, i.e. at least one route of escape from each area not directly affected by the event shall be available. Escape routes shall be well marked, including signs. Escape routes on decks shall be provided with a non-skid, oil resistant coating in the safety yellow colour RAL 1023. On deck grating, two parallel 100mm wide yellow lines shall be painted indicating the width of the escape route. Marking shall show the preferred direction of escape. 6.4 HVAC Natural ventilation and open modules shall be preferred and the effect of natural ventilation shall be assessed and documented. A strategy for active control of possible smoke from fire in living quarters, TR and other mechanically ventilated areas shall be developed and included in the design of HVAC system. Ref. NORSOK H-001 HVAC. All air inlets shall be located in non-hazardous areas, as far as practicable away from possible HC leakage sources, and minimum 3 m from any zones 2 boundary. Simulation studies or wind tunnel tests should be used for location of main HVAC air inlets to ensure operation of HVAC systems serving quarters and emergency equipment rooms to be minimal affected by smoke and escaped gases from incidents onboard. For arrangement and protection of non-hazardous rooms with access to hazardous areas, ref. is made to IEC 60079-13 and IEC-61892-7.

NORSOK standard

Page 13 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

6.5 Helicopter deck The helicopter deck is subject to approval by the national civil aviation administration, ref. BSL D 51. The turbulence effects from wind across and around the installation as well as influence from turbine exhausts and flare/vent shall be considered. Simulation studies or wind tunnel tests shall be performed during design of new installations or modifications of existing ones. The arrangement shall be evaluated with the assistance of an experienced helicopter pilot. The helicopter deck should have 3 access ways, sufficiently separated from each other (one pr. 120 degrees). A continuous walkway around the helicopter deck edge at a level below helicopter deck surface should be provided. (Approximately 1500 to 1200 mm below the level of the helicopter deck) The helicopter deck surface shall be self-draining type, suitable for use by trolleys. The friction coefficient on a wet deck shall be minimum 0,65. The helicopter deck should be provided with an AFFF system (Pop-up, Safedeck or similar). The system shall be functioning according to specification within 20 seconds after activation. The system shall be activated and deactivated from the helicopter deck control room. The system shall be protected against unplanned activation. Details regarding drain system on helicopter deck are covered in Annex D.7. 6.6 Emergency service areas An emergency service area is defined, as an area containing equipment and systems required during emergency conditions. This includes firewater systems, emergency generators and emergency power distribution systems, safety and automation system, communication equipment, emergency ventilation, ballast system and position keeping system. (Ref. ISO 13702). The location and protection of these systems as well as system design shall secure operations during and after an emergency condition. The equipment necessary during evacuation is of particular importance. 6.7 Process area Fire and explosion evaluations shall be made along with the development of the lay out to minimise the built in escalation potential. This shall be ensured through the following principles: 1. Equipment and piping containing high-pressure gas should be located in the upper decks above the Module Support Frame or main hull. 2. Liquid vessels should be located lower than gas equipment. 3. Low-pressure equipment containing large amount of liquids should be located and arranged so that exposure to jet fires is minimised. If jet fire exposure can not be eliminated, the need for passive fire protection shall be evaluated. Process piping, pig launchers and receivers and equipment shall be protected from external impact, e.g. from dropped objects or missiles due to disintegration of rotating machinery or as found required through analysis.

NORSOK standard

Page 14 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

The flare system shall be protected from fire and explosion loads so that its integrity is maintained until the process plant has been depressurised. 6.8 Riser area For all hydrocarbon risers; protection from external impact such as ship collisions and drifting objects shall be evaluated. Locating the risers behind main support structures or dedicated protection structures may be required to mitigate the risk. The following means of protection shall be considered: For two or more gas risers, or one gas riser together with several oil risers: passive fire protection. Pig launchers and receivers: location in open, naturally ventilated areas, at the periphery of the platform, and with hatches directed away from equipment and structures. ESDV's: location in open naturally ventilated areas as close to the sea as practicable to minimise exposure of the risers from topside accidental events. Flanges and instrument connections on the riser side of the ESDV shall not be used on fixed risers. For flexible risers special considerations have to be made. Subsea barriers. Utilisation factor 6.9 Flare boom, flare tower, cold vent Flare booms and flare towers shall be located and designed with due attention to all relevant flaring rates and wind conditions to ensure that the heat radiation level (ref. Annex E, clause E.4 Flaring) will be within acceptance limits in all areas of the installation, with due regard to exposure of operators, structures such as cranes and towers, electrical and mechanical equipment and piping. The flare flame or hot gases shall not represent a hazard due to increased surface temperature in exposed areas. Particular attention should be paid to crane and drill tower wires/structures and personnel in exposed areas. Further the design of the cold vent systems shall cater for heat loads caused by a possible ignition of the discharge. A flare/vent study is required, identifying the potential effects in all exposed areas. 6.10 Drilling and wellhead area The drilling and well head areas shall be located with maximum distance to the living quarters and areas with emergency equipment and functions, and be separated from utility and processing areas in order to minimise the consequences from a blow out. Possible collapse of the derrick shall be evaluated. The well heads shall be located as high as practicable and above the main support frame or main hull in order to minimise exposure from a well head fire, and to facilitate control of a blow out on the installation. Consideration shall be given to the protection of well and BOP equipment, such as control panels and hydraulic systems and their related signal paths. Simultaneous drilling, work over and/or production shall be evaluated in detail taking into account operational procedures to ensure an acceptable safety level of the operation of the installation.

NORSOK standard

Page 15 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

SAFETY REQUIREMENTS TO STRUCTURAL DESIGN

7.1 Design accidental loads Accidental loads shall be identified and taken into account in the structural design. The probability, magnitude and potential consequences of identified loads shall be assessed and analysed. Relevant loads are: Impact loads caused by dropped object, ship collision or others.

Dropped objects: Protection of structure to be dimensioned for falling container, pipes etc. based on estimated weight, probable drop height, vulnerability and criticality of the exposed areas. Ship collision: The possibility of collisions caused by merchant vessels and the need for adequate sea traffic surveillance system shall be evaluated. For supply vessels operating alongside the installation, a collision load of 14MJ shall be assumed. Explosion loads: Explosion loads affecting main structures Explosion loads affecting secondary structures, e.g. walls acting as barriers between main areas. Explosion loads acting on support of pressure vessels, flare headers, fire ring main, ESD valves etc. shall be considered. Explosion loads shall be established by use of recognized computer models, e.g. FLACS. See clause 10.8.

Heat loads caused by jet fires or pool fires on the installation or adjacent installation, from risers or from the sea surface in case of large oil releases to the sea or in case of sub sea gas releases. - Fire: Installations that can be exposed to a dimensioning fire on the sea shall be able to withstand this for a time period sufficient for safe evacuation of the installation. The endurance shall not be less than 1 hour. Fixed installations shall be protected against fire on sea, as identified by risk analyses. For blow-out/fire on sea concerning floating installations, see clause 11.6. Loads caused by extreme weather, earthquake, damage to structural elements (damaged condition) or extreme temperatures. Design accidental loads shall be specified in the design accidental load specification. A weight control database shall be maintained to ensure that jacket or hull loads do not exceed their design weight limit.

NORSOK standard

Page 16 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

8 SAFETY REQUIREMENTS TO PROCESS AND AUXILIARY FACILITIES

8.1 General requirements Process and auxiliary systems shall be designed, manufactured, equipped and installed in such a way that the installations can be operated and maintained safely. Process and auxiliary facilities shall be designed such that no single failure during operations can lead to unacceptable hazardous situations. This principle shall apply to operational errors as well as equipment failure. 8.2 Safety shutdown systems A safety shutdown system shall be independent of and in addition to other systems and equipment used for normal operation, control and monitoring, and shall act as a safety barrier in case of malfunction or maloperation of these systems and equipment. The safety shutdown system shall be logically divided into three main levels of shutdown: Abandon platform shutdown (APS). Emergency shutdown (ESD). Process shutdown (PSD). Basic system philosophy is that a signal on a certain level should never initiate shutdowns or actions on higher levels, but shall always include shutdowns on lower levels. The APS and ESD system shall be separate from the PSD - system For more details reference is given to clause 9.3 Emergency shutdown. 8.3 Process safety Two levels of protection according to ISO 10418 shall control abnormal operating conditions leading to potential hydrocarbon release: Primary level of protection. Secondary level of protection. As far as possible, the two levels of protection shall operate on functionally different basis. Duplication of identical safety devices given different set points does not satisfy the requirement of two levels of protection. The PSD system shall automatically detect abnormal operating conditions within systems or equipment and initiate actions so that uncontrolled release of hydrocarbons is prevented. The systems shall be designed to avoid cascading effects due to partial shutdown within PSD, i.e. shutdown signals should trip all affected systems so that a new abnormality is not developed as a result of the initial trip action. The system philosophy shall ensure that the fail safe principle is applied. I.e. components shall move to, or stay in the predetermined safest position upon loss of signal or power.

NORSOK standard

Page 17 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

The degree and extent of a PSD situation will depend on type of abnormality, and may vary from equipment shutdown with minimum effect on the production rate, to a total process shutdown. Pressure relief and depressurising of hydrocarbon systems is covered in Annex E.

REQUIREMENTS TO SAFETY AND COMMUNICATION SYSTEMS

9.1 General requirements The general requirements to safety and communication systems shall be in accordance with ISO 13702 clause 10 and 14. The line of actions performed by personnel and automatic safety system during emergencies shall be automatically recorded to the extent it can ease investigations and experience retention after any incident. 9.2 Fire and Gas detection

9.2.1 General All F&G detection system display and information facilities shall be centralised, and located in a continuously manned area, normally the central control room Loop faults and -supervision shall be identified according to NFPA 72. With the installation divided into fire areas the design of the F&G system shall presume that each fire area shall be covered by a sufficient number of detectors suitable for detection of probable fires or accidental releases of toxic or flammable gases in the area. The gas detection system shall have detectors for hydrogen sulphide in relevant areas on installations where such gas can occur. The alarm presentation in CCR should in addition to screens (VDUs) be given on a simple fire and gas mimic. Further details regarding screen presentation is found in NORSOK I-CR-002 Safety and Automation Systems (SAS). Local F&G display and status facilities shall be provided in the drilling area incorporating F&G monitoring of the drilling facilities. The F&G system shall be designed so that maintenance, function testing etc. can be carried out without disabling the system. The location of fire - and gas detectors shall be based on defined scenarios, simulations and actual tests. Detail requirements for F & G system is incorporated in Annex F.

NORSOK standard

Page 18 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

9.3

Emergency shutdown

9.3.1 General References are given to ISO 13702 clause 6. The installation shall be analysed to identify potential hazardous conditions and their consequences. The critical operating parameters shall be selected and emergency shutdown logic developed. Due consideration shall be given to the event sequence in relation to the overall installation safety. In the detail assessments of ESD philosophy, actions associated with time delays in the achievement of a state of no escalation potential shall be identified and the implications on ESD philosophy determined. Consideration shall be given to interrelations between fields and installations interconnected e.g. by pipelines or control systems. The ESD hierarchy shall be kept simple with respect to sub-levels. This to ease understanding and future updating. Three main shutdown levels shall be included, see clause 8.2. The ESD principle hierarchy presented in figure 9.1 shall be applied for complex installations and used as guidance for simpler installations. For drilling operations see clause 9.3.4. 9.3.2 ESD valves ESD-valves shall be located and arranged in such a way that the exposure from fires and explosions is minimised. Pneumatic and hydraulic tubing shall be capable of resisting loads from fire and explosion until they have completed the shut down sequence. Instrument tubing from accumulators and hydraulic oil return lines should be protected from mechanical damage, which could adversely affect valve performance. If hydraulic or pneumatic accumulators are used to move emergency shutdown valves to safe position, they should be positioned as close to the valve as possible to ensure the best possible availability. The accumulator capacity should be adequate for at least three operations (close-openclose). Spring return type of valves shall be used when required size is available. On installations that are normally manned, only manual, local to the valve resetting of emergency shutdown valves shall be possible, as advised from the control centre. If an emergency shutdown valve is used as process safety valve, the signal from the emergency shutdown system shall be conducted to the actuator or to a hydraulic/pneumatic control valve for the actuator separate from the process safety system. An evaluation shall be carried out to determine which system design will represent the highest availability during an emergency shutdown. If an ESD valve is connected to the PCS system, the process control function shall be performed completely separate from the ESD functions. Emergency shutdown valves that may be exposed to fire shall preferably have metal to metal seats. If other seats are used, the valve shall be fire tested in accordance with API 6FA or BS 6755. The location of ESD valves shall be determined based on the FES. The design of the emergency shutdown system shall be such as to allow extensive function testing to be carried out without interrupting the operations. Valve leak testing procedures with acceptance criteria shall be developed. NORSOK standard Page 19 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Further the following functional requirements apply to ESD valves: Local position indicators shall be installed and end position indications presented in the control room through the PSD system. The valve shall fail to safe position. Usually closed position.

NORSOK standard

Page 20 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Manual Push Button

APS Activation of: ! DHSV s ! Automatic depressurisation Timerbased shutdown of: ! F&G System ! PA System ! ESD and PSD Systems ! UPS System ! Radio/ext. communication ! Emergency generator ! Bilge/Ballast pumps Gas detected at local HVAC intake

Manual Push Button Gas detected in a non-hazarea

ESD1 Shutdown of: ! Main generator ! All non-ex equip.

Manual Push Button Gas/Water heat exchanger tube rupture Fire detection in a hazardous area

! !

Isolate non-Ex equ. in area Shutdown fans/heaters and close dampers

Start of: ! Emergency generator

Gas detected a hazardous area

ESD2

Manual Push button K.O. Drum LAHH ind. Low-low instrument air pressure (PALL) Low-low hydraulic pressure (PALL)

Isolate all ign. Sources in nat. ventilated areas Activation of: ! DHSV (upon riser- or wellhead fire) ! Riser ESDV s ! Depressurisation (man. or automatic) Shutdown of: ! Fuel gas supply

PSD

Figure 9.1

Emergency Shutdown Principle Hierarchy

NORSOK standard

Page 21 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

9.3.3 Facilities for Manual Shutdown Manual APS stations shall be located at a few strategic positions such as: Muster areas Lifeboat stations Helicopter deck CCR Bridge connections. Manual ESD stations shall be located in essential areas such as: Exits from areas with hydrocarbon piping and equipment e.g. wellheads, drilling, process etc. The need for ESD stations in other rooms and areas shall be evaluated. 9.3.4 Shutdown of drilling and work-over operations Shutdowns of drilling and work-over operations should only be manually activated. Fire or gas detected in rooms critical for the drilling and work-over operations as well as loss of air flow into these rooms shall not give an automatic shutdown, but give alarm to the responsible drilling personnel. The adverse effects of automatic shutdowns shall be thoroughly evaluated for each case of automatic action that are accepted. By any other ESD, the drilling and work-over operations shall not be automatically affected, except for burning on the burner boom, which shall be stopped automatically. Supply of back-up power to the drilling plant in case of main power generation shutdown shall be subject to evaluation. 9.4 Ignition source control Equipment left live after initiation of APS shall be certified for operation in zone 1 areas. Only equipment required for the safety operations, see figure 9.1, which is located in rooms continuously manned or monitored in emergency situations, shall be left live after APS. Such equipment shall be easily isolated manually from the manned area/room. A timer shall be provided to allow for systems to remain in operation until evacuation is completed. Equipment left live in the ESD I situation shall be certified for operation in zone 1 areas. Emergency equipment in LQ and other areas may be left live subject to special considerations. Examples of equipment that can be accepted without certification for zone 1 areas are the following equipment located inside or in the vicinity of the Living Quarter. Emergency generator. Emergency switch gear. Equipment in CCR required for the control of the ESD I situation. Critical equipment for internal/external communication in the living quarter. Equipment in the living quarter connected to the main power supply. "Low gas alarm" - detection anywhere on the installation shall isolate all high-risk ignition sources located in naturally ventilated areas. This includes temporary equipment e.g. combustion engines and electrical sockets including welding sockets, and non- Ex equipment operated under hot work permit. (See figure 9.1) NORSOK standard Page 22 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Confirmed gas detection at HVAC air intake to local electrical/instrument rooms or emergency generator room shall close inlet dampers, shut down fan(s), shut down heater(s) and isolate all nonEx equipment inside the respective room. For above mentioned circuits, no hot conductors shall be found outside their feeding switchboards when isolated. 9.5 Alarm and communication system The objective of the alarm and communication system is to warn and guide personnel as quickly as possible in the event of a hazardous or emergency situation. Location, number, type and effect from alarm systems/equipment/signal shall be easily recognised in any area where distribution of the alarm is required. Alarm voice communication shall be heard in a surrounding noise level up to 83 dB. In areas with noise levels of 85 dB and above the audible alarm shall be supplemented by light signals. Audible alarms and messages shall be recognisable in the muster areas even if initiation of the safety systems or the accident itself increases the background noise level. The alarm signals shall be in accordance with table 9.5.1. An audible alarm signal shall always be followed by an announcement on the Public Address system. For zoning of alarms, see table F.1 and F.2 found in Annex F.

NORSOK standard

Page 23 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000 Table 9.5.1 Alarm signals. Indicates Prepare to abandon installation

Alarm Type Muster Alarm

General Alarm

Toxic Gas Alarm Note 1. Local alarm in rooms protected by CO2 or other gases with lethal concentrations. Inert gas protected rooms/areas. Alert

Signal Continuous audible signal of variable frequency. Yellow flashing light or rotating visual lamp Intermittent audible signal of constant frequency. (1 sec. on, 1 sec. off). Yellow flashing or rotating visual lamp Intermittent audible signal (0,1 sec. on, 0,1 sec off). Yellow flashing or rotating visual lamp Local red light at entrance. Local high freq. tone in room/area and in adjacent room/area providing access. Local red light at entrance. Two level audible tone on PA system.

Fire or gas leak or other serious situations

Toxic gas, e.g. H2S.

Gas released. Note 2.

Gas released. Note 3. Important announcement to follow on PA system

Notes 1. At small local occurrences, local alarm may suffice. 2. Pre-warning signal shall be used in and at doors to rooms protected by gasses that could be lethal. 3. Pre warning before release to be considered in inert gas protected rooms. Note 1 Frequencies for the different alarms are found in NORSOK T-100 Telecom Subsystems. The system shall be designed to give appropriate access priorities. Radio signal transmission for internal communication shall be catered for allowing communication to and from every location on the installation. 9.6 Emergency power The emergency power shall be supplied from a diesel engine driven emergency generator, capable of supplying the consumers with emergency power for at least 18 hours. The emergency generator shall be exclusively dedicated for supply of emergency power during emergency mode of operation. The emergency generator system shall be self-contained. Arrangements for black start shall be provided. Start and monitoring of the emergency power system shall be possible from the CCR where a matrix panel or dedicated VDU picture shall display the status of the generator. In addition to automatic starting provisions a manual starting and testing device shall be provided.

NORSOK standard

Page 24 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

The prime mover for emergency generators can be stopped automatically in the event of: 1. gas detection in ventilation air inlet 2. overspeeding, 3. loss of lubricating oil pressure 4. Item 1 and 3 above do not apply to emergency generator(s) supplying firepump(s) The following equipment/systems should be supplied from the emergency generators. Safety and Automation System (SAS) Diesel transfer systems. HVAC smoke ventilation system. Compressor for instrument air. Sea water utility pumps. Charging of UPS. Emergency lighting. Compressors for smoke diver bottles. De - icing systems. Bilge pumps. Lubrication oil pumps and ventilation fans required for run down of turbines and generators after a shut down Drilling systems (often by separate drilling back-up generator). One deck crane. Purging systems. Fire waters and foams systems (when emergency generators supply fire water/foam pumps, the requirements for such systems apply to emergency generators). Other active fire protection systems, as required by FES. Helicopter landing equipment. Communication systems. Process control system. PSD system.

An uninterrupted power supply (UPS) for emergency equipment and systems shall be installed. Emergency batteries shall have a capacity to supply emergency power for a minimum period of 30 minutes, ref. ISO 13702, table C1. The emergency power distribution system shall be sufficiently protected against fire and explosion to operate during an emergency situation until safe evacuation has been performed. The emergency power generation and distribution shall be separated from normal power generation and distribution to the extent that a local fire cannot put both systems out of operation. The following principles shall be the basis for arrangement/layout of emergency power systems 1. prime movers of emergency equipment with associated equipment shall be located in separate rooms in non-hazardous areas, 2. equipment for emergency power supply is appropriately located and preferably in separate rooms, 3. emergency generators with distribution boards, chargers etc. shall be located in separate rooms in non-hazardous areas, 4. emergency batteries shall be located in separate rooms in non-hazardous areas except for sealed batteries can be located within emergency switchgear rooms, NORSOK standard Page 25 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

5. combustion air for prime movers of emergency equipment is supplied from non-hazardous areas, 6. the combustion air inlet is separated from the ventilation air inlet of the room, 7. fuel for prime movers should not represent an explosion hazard under anticipated operating conditions, 8. exhaust pipes from prime movers of emergency equipment should neither emit sparks nor have a surface temperature which exceeds the ignition temperature of the gas mixture which is produced or stored on the installation. IMO MODU CODE, Chapter 5 provides additional useful guidance. 9.7 Communication through signs and markings Means of communication through signs and markings shall include: a. An emergency preparedness station bill, which shall be efficiently communicated to all personnel on the installation. b. Marking by painting, reflection materials/light surfaces that can be recognised visually or by touching, e.g. a characteristic roughness. c. Signs showing the way to or marking the location of the following: 1. Emergency preparedness equipment. 2. Safety and first aid equipment 3. Evacuation routes. 4. Safe areas. 5. Evacuation equipment. 6. Muster stations Text on signs shall be both in English and Norwegian. Recognised standard for the design of signs is to be found in Norsk Standard (Norwegian Standard) NS-ISO 6309.

10

REQUIREMENTS TO EXPLOSION AND FIRE PROTECTION

10.1 Fire and Explosion strategy (FES) The FES shall be established together with the lay out and later updated and detailed together with the development of the installation concept. The requirements for the development of a FES are defined below and in ISO 13702 clause 4. The FES shall consider the fire and explosion hazards and describe how the installation will deal with the consequences of these hazards. Further the FES will describe the optimisation of passive and active fire protection on one hand and lay out considerations like location of equipment/valves and separation distances on the other. 10.2 General requirements to fireprotection. FES The specific requirements for fire protection are described in ISO 13702 clause 11 and Annex A and Annex B 8. Active and passive fire protection shall be arranged to ensure that a fire is prevented from spreading to other areas within a specified period of time and to protect load carrying structure against critical NORSOK standard Page 26 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

heat loads. Possible failure of the firewater systems and its effect shall be considered. For Major Hazards like riser fires or burning blow outs, the required time period before impairment shall be defined. Shielding of escape-routes and evacuation stations shall be as required to ensure escape from all areas and evacuation from the installation Necessary input will be provided by the risk and emergency preparedness analyses) The fire loads to be considered within an area may be limited through location of ESD or PSD valves. An evaluation shall therefore be made regarding location and categorisation of these valves. Other means to limit the consequences of liquid fires are bunds and drains. Fire protection data sheets shall document the fire protection design / area safety charts see Annex J. 10.3 Requirements for passive fire protection of equipment, piping and secondary structures. A procedure for evaluation of protection of pressure vessels and process piping is included in Annex G. Saddles and secondary structures supporting HC pressure vessels shall be passive fire protected to avoid failure during the defined fire-scenarios. 10.4 Fire technical requirements relating to materials Materials on the installation shall, as a rule be non-combustible. If it is justified from a safety point of view to make use of materials that do not meet the requirements to non combustibility, such materials shall have limited flame spread properties, low smoke development and heat generation. An assessment shall be made of the toxicity of gases emitted in the event of a fire. Documentation shall be available to support the basis for the decision regarding selection of materials. Materials used in the living quarters should to the extent possible be non-combustible. If surface treatment of paint or other coating is used, the properties of the product with regard to flame spread shall be considered. A corresponding evaluation shall also be carried out with regard to textiles. Floor, wall and roof finishes shall pass the fire test requirements in IMO Resolution A 653 (flame spread). In addition, the materials shall comply with the requirements of ISO 5660 (smoke and ignition properties). 10.5 Passive fire protection For separation between main fire areas reference is made to ISO 13702 table C.4. Fire partitions exposed to hydrocarbon fires shall be rated according to an H-class. Living quarters shall be designed and protected so as to ensure that the safety functions they are designed for can be maintained during a dimensioning accidental event. See ISO 13702 Clause 12. If fire technical calculations indicate that the outer surfaces of living quarters in the event of a dimensioning fire may be subjected to a heat flux exceeding 100 kW/m2, they shall be fitted with fire divisions of minimum class H-60.

NORSOK standard

Page 27 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Windows in H partitions shall be avoided. Penetrations, e.g. for ventilation ducts, piping, cables, beams as well as windows and doors in fire divisions, shall not reduce the strength or the fire integrity of such divisions. Fire protection materials used in outdoor areas shall comply with NORSOK M-501 Surface Preparation and Protective Coating. See Annex I for details relating to Living Quarters. 10.6 Storage and handling of explosives Explosive commodities shall be stored and handled such that the risk of fire or explosion is minimised. All explosives shall be separated from other goods. Storage locations shall be clearly marked and located in areas free of ignition sources. The storage location shall be easy accessible with deck cranes for dropping of explosives into the sea if required. Incompatible explosives shall be separately stored. 10.7 Active Fire Protection

10.7.1 General Fixed fire-fighting systems shall be installed in areas representing a major fire risk, and particularly cover equipment containing significant quantities of hydrocarbons. For definition of fire area see ISO 13702. Firefighting systems other than fire water systems are covered in ISO 13702. The fire water system shall be operable at all times including periods of maintenance and shall ensure adequate supply of water for fire fighting. The system shall be designed and calibrated such that deluge nozzles will receive water not later than 30 seconds after a confirmed fire signal has been given. For the fire water system the fail-safe principles shall apply. Design according to the latest edition of NFPA is the minimum requirement if no requirements are given in this standard. See Annex H. The capacity and efficiency of the system shall be verified through realistic full scale testing during commissioning.

NORSOK standard

Page 28 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

FIRE FIGHTING SYSTEM

DEDICATED FIRE PUMPS DEDICATED POWER Fig. 10.1 GENERATION UNITS FOAM /PUMP DISTRIBUTION SYSTEM AUTOMATIC EQUIPMENT

PRESSURE MAINTAINANCE MANUAL EQUIPMENT DISTRIBUTION SYSTEM

F&G /

CONTROL

SYSTEM

OVER BOARD DUMP/TEST LINE

DRAIN

Fig 10.1

Firewater system principles.

10.7.2 Prime Mover and FireWater Pumps. Offshore installations shall be provided with two independent prime mover and firewater pump systems. Each pump system shall have the capacity to supply 100% of the largest fire water demand. The water application rates to the various areas and equipment shall be as follows: Wellhead area Manifolds located on FPSO turrets Area for circulation and treatment of mud Processing area Surface of pressure vessels and tanks containing combustibles 20 l/min m2 20 l/min m2 10 l/min m2 10 l/min m2 10 l/min m2

Other water application rates shall be according to ISO 13702 Annex H. It is recommended that each pump system consist of 2x50% pump units, unless other solutions are evaluated to present similar or increased safety level. Ref. clause 10.2. The following principles shall be the basis for prime mover and firewater pump system design: - NFPA 20 shall be followed - Consideration shall be given to two separate modes, normal mode and maintenance mode - In normal mode the minimum capacity for the system is two separate and independent systems, each with 100% capacity - Measures to compensate for possible shut downs in the system due to maintenance shall be defined and documented as a part of the design. Compensating measures in NORSOK standard Page 29 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

light(maximum 24 h limit of duration) maintenance mode will however, not generate requirements to system design. . The system shall take into account fail to start of a fire pump. This may have implications on system design.

Fire water pumps with a capacity above 2500 m3/h (each) shall be avoided. Fire pump systems shall be independent of other systems. If other system designs are chosen, the reliability of the firewater system shall be equal to an independent system. Automatic stop of diesel operated fire pumps shall normally only be permitted due to overspeeding. Automatic stop can however be accepted if this is documented safer than if the pumps continue to run. The combustion air inlet shall be equipped with a damper initiated by over speed due to entrance of gas. Failure of the overspeed securing device should not cause the prime mover for fire pumps to stop. Simple reset of the systems shall be possible. All active fire protection field equipment shall be certified for operation in Zone 1, gas type IIA, and temperature class T3. Exceptions from this are the diesel engines, electric generators and motors which shall be located in rooms located safe by location and which are not likely to be affected by accidental gas releases. It shall be possible to operate diesel engines when ventilation to the room has been shut off. Dimensioning flow of the fire water pump duty points (100 %) shall include a contingency margin covering: Hydraulic imbalance. Overlap of spray zones of deluge and sprinkler nozzles. Shadow areas requiring additional nozzles Two hydrants. Freeze protection Cooling of the pump and other emergency units.

Provisions for testing of the fire pumps shall be part of the design, including measurement of capacities and pressures. CCR shall be provided with a fire water/foam pump panel with the following control and monitoring capabilities: Selection of fire water/foam pumps for standby/duty. Manual start Start called for Common alarm. Firewater/foam pumps unavailable warning. Firewater/foam pump running Firewater/foam ring main pressure.

All fire water pumps and foam pumps on duty shall start upon confirmed fire detection.

NORSOK standard

Page 30 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

10.7.3 Fire Ring Main. The following requirements apply: a) Fire pump systems are connected to the fire main in such way that damage in one area will not cause loss of all the fire water supply. b) fire main and supply shall be routed outside areas where it could be exposed to damage, and be protected against external forces, such as environment, falling loads, fire, explosion etc.; c) Shut-off valves and cross connections on the fire main shall be included to enable isolation of parts of the fire water ring main and to ensure supply to consumers from two different sections of the ring main. d) Firewater rings main with branch pipes are at all times filled with water. e) Each fire water pump (related to100% capacity) shall be connected to the ring main by dedicated headers with isolation valve between the headers. 10.7.4 Deluge systems Deluge valves should be of a type which regulates the downstream pressure and which is not sensitive to pressure surges in the ring main. Deluge valves shall be provided with a dump line for full capacity testing without wetting the protected area, i.e. an isolation valve shall be provided downstream the test branch-off point. Deluge valves shall be provided with manual bypass including flow restriction to match flow through the valve. The deluge valve skid shall include isolation valves down stream and upstream. It shall be possible to manually activate deluge skids locally, from CCR or release stations located along the escape ways outside the fire area itself. 10.7.5 Firemans equipment For details regarding firemans equipment see Annex C. 10.8 Explosion protection. 10.8.1 General An explosion protection strategy shall be established with the objective of minimising the explosion risk through -preventing explosions to occur -minimising the explosion pressure. -controlling the consequences of explosions Mitigating measures to reduce possible explosion overpressures, such as start of deluge on confirmed gasdetection, shall be evaluated and considered for implementation. (Annex H Fire fighting system has not considered use of deluge for explosion suppression) Reference is given to ISO 13702, clause 13. A procedure for the determination of the dimensioning explosion load is included in 10.8.2

NORSOK standard

Page 31 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

10.8.2 Procedure for establishing the dimensioning explosion loads The first step should be to establish a criterion for selecting the dimensioning explosion load. Prior to assessing the explosion loads the consequences of an explosion considered unacceptable to the installation shall be established. Such consequences may be: - Global collapse of the structure - Rupture or unacceptable deformation of explosion barriers - Deformation of decks leading to unacceptable damage to equipment - Deformation of hydrocarbon containing equipment leading to an unacceptable escalation of the accident - Unacceptable damage to safety equipment or systems that shall function after the explosion The definition of the dimensioning explosion load shall describe the necessary dynamics in the load with regard to pressure, time and area distribution. External blast effects outside of primary explosion area shall be considered. The explosion load shall be determined based on a conservative selection of a defined number of scenarios. If this leads to unrealistically high loads, a probability distribution of explosion loads shall be established based on a probabilistic selection of scenarios taking into account the factors that influence the types and probabilities of scenarios like -layout -leak conditions -cloud formation conditions -ignition conditions. Calculation of explosion overpressures related to the scenarios shall be performed with an advanced explosion simulator e.g. FLACS.

11 SAFETY ASPECTS RELATED TO FLOATING PRODUCTION, DRILLING AND STORAGE INSTALLATIONS

11.1 General This clause contains additional safety design principles related to floating production/ drilling/storage installations. The risk analysis, emergency preparedness analysis and fire risk analysis, ref. clause 4, 5 and 10 shall be performed, taking the special aspects related to the floating installation into consideration. In particular the call for automatic shutdown upon detection of hazardous situations needs to be considered in light of the possible adverse effects. Other issues covered by these standard, clauses 1-10 shall be applied as relevant. Items covered by clauses 11.3 - 11.9 are related to special design solutions and should be applied accordingly.

NORSOK standard

Page 32 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

11.2 Crude storage Crude storage tanks, and in particular large tanks, shall be subject to special safety considerations in light of their fire and explosion potential. Main principles for such tanks are described below: Large crude storage tanks shall be provided with an adequate and safe vent system, and gases shall be routed to either cold vent, flare or reclaiming system. Location of crude pumps shall be made based on a hazard evaluation for operation and maintenance of the pumps. Submersed pumps should be preferred. 11.3 Layout The following additional requirements shall apply concerning the layout of floating installations: Vital control functions, e.g. maritime control/bridge, process control and special emergency preparedness functions, should be arranged in one common control centre for the entire installation. The turret shall be located and arranged to minimise probability and consequences of escalation of fires/explosions to/from neighbouring areas. Hydrocarbon pressure vessels and heavy duty equipment shall not be located within main hull structure unless it is verified that: - The explosion venting is sufficient to prevent unacceptable overpressure. - The fire loads do not cause structural collapse. Process decks and relevant parts of the floater deck shall be arranged with the aim of minimising the risk of large pool fires on decks and tank tops. Process areas, turret areas and piping shall be designed to minimise the risk of jet fires towards tank tops. On floating installation that will be turned up against the wind, equipment that can represent and ignition source should be located as far as possible upwind of potensial leak sources. The effects of green sea on deck shall be carefully evaluated and means of protection arranged. When fire and gas detectors are located, considerations shall be made to environmental effects caused by close location to the sea and necessary protection arranged. Crane coverage and lay down areas shall be arranged to promote safe operations of the cranes and to minimise the risk of dropped objects. 11.4 Turret The following design principles apply to turret design: 1. The turret arrangement design shall aim at achieving open naturally ventilated areas and minimising explosion pressure. Enclosed mechanically ventilated areas shall be restricted to containers or small rooms with control and special equipment that requires special protection or cannot be located in outdoor environment. Such enclosed premises shall have over pressure ventilation, with air taken from and exhausted to a non-hazardous area. Location of the premises themselves as well as their ventilation intakes shall take into account the prevailing wind directions. Equipment that can be ignition sources, e.g. electric equipment should not be arranged in the moon pool area. 2. Anchor handling winches should be located in open areas or in an enclosed non-hazardous area. If located in hazardous area, suitability for operation in hazardous area shall be ensured. Seawater spraying (deluge) for spark suppression may be applied to equipment that is exposed to seawater under normal operations. Where winches are arranged on the deck below Riser Termination and ESD valves, the deck separating the areas shall be solid and gas tight.

NORSOK standard

Page 33 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

3. The use of flexible hose connections for well stream transfer, within the turret and between turret and ship, should be minimised. 4. Fire protection of the turret can be arranged by fixed or oscillating fire monitors located on the ship, e.g. on gantry structure. 5. Production or export/gas injection risers shall be protected against fires in the turret by passive means. Routing of risers within conductors is one acceptable design principle. At riser termination end, the riser connector and first ESD valve shall be protected by passive means. For protection of other parts of the structure, refer to other relevant parts of this standard. 6. Risers shall be protected against damage from wires and chains used for mooring. Arrangements that provide both protections against such loads as well as fire protection are preferred. 7. Decks above moon pool where hydrocarbons leaks may occur shall have an adequate drain routed to a collection tank. 11.5 Drainage/Ballast water systems These systems on floating installations shall be designed to operate satisfactorily for all sea states in which the installation is intended to be operable. Drainage systems for the process systems shall be designed to operate satisfactory for all sea states in which the process system is intended to be operable. Necessary pumps and valve control of the ballasting system shall be fed from the emergency power system during shut down of main power. 11.6 Emergency re-positioning The need for quick re-positioning of the installation in case of specific emergency situations shall be evaluated. Important factors in this evaluation are number and types of risers, riser pressures, sub sea ESDV and mooring arrangement. Anchor moored or dynamically positioned installations located above well(s) shall be able to move 150 m from the normal position in 10 minutes, or as specified based on risk analyses. 11.7 Topside/floater interface All interfaces between the typical maritime floater technology and offshore petroleum technology shall be clarified at an early stage of the design process, and be monitored during the project to ensure compatibility with lifetime operational requirements.

12

NORMALLY NOT MANNED INSTALLATIONS

12.1 General A "Normally Not Manned Installation" (NNMI) is an installation which can be left unmanned and still maintain its intended principal function through remote control from a distant location. This section outlines the safety design principles for the design of a NNMI and has been written for a minimum wellhead platform, but the requirements apply in principle to other NNMI such as riser and pipeline compressor platforms. The need for well maintenance and reservoir stimulation has to be estimated for each location. These operations are manned and will require people to be on board while performing the work. NORSOK standard Page 34 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Dependent on the hours to be spent onboard a decision have to be made regarding possible limited or temporary facilities for personnel to remain onboard for a defined period of time. This clause is limited to the specification of the principle requirements for NNMI, but Annex K lists the minimum requirements for a simple NNMI, which is not designed for any overnight stay of personnel. For installations allowing personnel to stay overnight careful evaluations have to be made regarding the quartering and safety facilities. This will have to be done on a case by case basis. Therefore this standard does not establish requirements for such installations. The standard will focus on principle evaluations and decisions to be made to achieve an adequate safety level and not on detailed design solutions. Operations and maintenance philosophies for a NNMI are important to be able to establish the required manning onboard and are necessary to be able to develop the safety requirements. 12.2 Safety evaluation, management and documentation. The design of the NNMI shall be documented according to the principles laid down in this standard, including standards referred to. The design decisions have to be documented based on these methodologies and standards. Risk acceptance criteria have to be established. The risk evaluations shall take into consideration drilling and process data, environmental conditions, ship traffic, manning and helicopter shuttling. Simple, reliable and sturdy concepts for the purpose of minimising maintenance activities on the installation shall be emphasised through system design and reliability requirements. The following activities related to manned operations onboard shall be established: Drilling/well operations onboard Simultaneous activities. Weather conditions for boarding and departing of the installation. Helicopter shuttling and need for personnel to stay overnight. . An emergency preparedness analyses has to be performed to identify the requirements for emergency planning covering: Need for standby vessels when manned. Call for helicopter. Time to evacuate. Search and rescue Need for lifeboats. Means of evacuation Shelter.

12.3 Design principles The NNMI wellhead installation will typically be designed with a well head area and manifolds on the well head side of the installation and a utility/shelter area to the opposite side. A fire/explosion wall will normally be required to protect the shelter area and the escape function adequately. The installation may be equipped with christmas trees, a production manifold, a test manifold, a test separator and a pig launcher. The installation will have a sheltered area with resting facilities. NORSOK standard Page 35 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

The main power source may be diesel generators onboard the NNMI or cables from neighbouring. Emergency power may be by batteries only. The auxiliary systems may further consist of a methanol system, a closed drain system, and a utility drain system and seawater pump. Requirements for possible quartering facilities have to identified based on the manning requirements taking into account the following: - Scheduled maintenance jobs. - Well monitoring and maintenance. - Start-up following shutdown. The requirements to the support structure concerning resistance to impact from ship collisions shall be developed based on an individual evaluation of each concept. This evaluation shall take into consideration the types of vessel expected to be in the vicinity of the installation, boarding procedures (boarding zone, weather restrictions, loading requirements, call frequency, anchoring philosophy etc.) and the layout and arrangement of the installation. Access to the installation will normally be by helicopter. 12.4 System requirements. The safety system requirements for a NNMI shall be carefully developed based on the hazard identification and risk analyses performed. The need for firewater shall be evaluated and installed if a significant risk reducing effect can be documented. To ensure simplicity, firewater may be provided by alternative means as long as an acceptable reliability is proven.

NORSOK standard

Page 36 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX A - INFORMATIVE REFERENCES (INFORMATIVE)

1989 MODU CODE IEC 61508 International Maritime Organization - Code for the construction and equipment of mobile offshore drilling units, 1989 Functional safety of Electrical/Electronic/Programmable Electronic SafetyRelated Systems. Until the International Standard becomes available the Draft International Standard (FDIS) applies. Recommendation on improved fire test procedures for surface flammability of bulkhead, ceiling and deck finish materials. Institute of Petroleum: Model code of safe practice, Part 15, Area Classification code for petroleum installations. Petroleum and natural gas industries Offshore production installations Requirements and guidelines for emergency response. Fire-resistance tests on door and shutter assemblies. Fire-resistance tests on glazed elements. Fire-resistance tests- Elements of building construction. National Fire Protection Association part 15 Standard for water spray fixed systems for fire protection Insulation of Steel Structures: Fire protection.

IMO Res. A.653 IP Part 15 ISO 15544 ISO 3008 ISO 3009 ISO 834 NFPA 15 NT Fire 021

NORSOK standard

Page 37 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX B - EVACUATION (NORMATIVE)

An EERS covering the operational phase should be developed at an early stage of the conceptual phase. The plan shall be in accordance with clause 14 in ISO 13702. The plan shall take into account the following evacuation principles: The muster area and the access to the evacuation station should be arranged and protected in order to evacuate the actual number of personnel in an organised and efficient way. Area allocation: 0.4 m2 per lifeboat seat. One additional evacuation system in the far end of the installation should be considered if escape to the main evacuation area is impossible. For scenarios where the possibility for gas/smoke on the helicopter deck is within acceptable limits, helicopter may be considered as the primary means of evacuation. For installations connected by bridge to other installations and/or floating accommodation installations, the primary means of evacuation should be the bridge. One additional evacuation system in the opposite end of the installation should be considered if escape to the bridge is impossible in dimensional accident scenarios. Escape chute with rafts should be used as a secondary mean of evacuation in the main evacuation area. The emergency preparedness assessment shall be applied to identify any need for additional evacuation means and the optimum location of these.

NORSOK standard

Page 38 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX C - MISCELLANIOUS SAFETY EQUIPMENT (NORMATIVE)

C.1 Lifeboats

-Should be designed for 10 minutes running in a gas cloud or fire on sea. The external equipment including the engine exhaust system shall not act as ignition sources. -Recovery from sea shall be possible in up to 2 m wave height. Winches for recovery should be fed by main power. -The hoisting speed for recovery should be minimum 3 m/min. -Main power should be provided for charging of lifeboat batteries. The disconnection point should be in the vicinity of the lifeboat and disconnection shall be automatic when dropping or lowering the lifeboat. -Access ways should be provided with anti-skid coating -Cabinet housing should be arranged for winches and consoles -Heaters should be provided for electric motors for the winches. C.2 Escape chutes

-Shall be readily available and easy to operate with clear operating instructions located on the wall inside the container. -Winch for recovery should be fed by main power. -Removal of life rafts for re-certification shall be possible without affecting the suspension system including lifting wire. C.3 Man overboard boat and personnel basket

The MOB shall have a fixed lifting frame with one point suspension for handling by cranes. It should be possible to reach the MOB from two cranes. The MOB shall be visible from the crane cabins during handling. It should be possible to launch and recover the MOB in 5 meters significant wave height. The MOB shall have a minimum speed of 25 knots in calm sea with 3 men onboard. The installation shall be provided with a basket suitable for transport of personnel and another for transport of injured personnel.

NORSOK standard

Page 39 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

C.4

Man overboard related equipment.

One watertight cabinet for storage of gear of the MOB crew should be installed in the vicinity of the MOB. The content of the cabinet should include: - 4 swimsuits of wet suit type - 6 survival suits - 1 thermal protection blanket - 1 VHF radio with suitable charger - 3 life jackets - 1 x 20 litres diesel can - 2 bags, each containing - 30 m lifeline - 1 pair of flippers - 1 divers knife - 1 divers mask with breathing tube - 1 standard size waterproof torch - 1 mini size water proof torch and one 6 kg lead belt - 1 pair of night glasses (for intallations with moon pool work) C.5 Fireman's equipment

Fireman equipment should be stored in sets at not less than two locations separated from each other, so that access to all equipment will not be blocked in the event of a fire in one area. The number of sets of fireman equipment required and the contents of each set must be assessed. The equipment shall be suitable for the tasks of the fire teams, including the need for internal communication, during identified fire scenarios. Each set of fireman equipment should contain at least 4 portable radio sets for internal communication. At least two of the breathing apparatus should be equipped with radio sets. It is assumed that these radio sets shall not be able to become an ignition source, and that they operate in the UHF frequency range in private channels assigned by the National Telecommunications Authority with regard to application for use of private frequencies in the UHF frequency range, or they operate in the international UHF frequency range for on board communication. It should be ensured that the radio sets are suitable for the environmental loads to which they may be subjected during an accidental event, e.g. water from a sprinkler- / deluge system, without their functioning being impaired. Installations should have suitable equipment for refilling breathing apparatus. Replacement of the breathing air in all compressed air bottles shall be carried out at regular intervals to ensure that the air is pure and has an oxygen content above 20 volume percent.

NORSOK standard

Page 40 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

C.6

Safety Showers and Eyebaths

Strategic locations shall be identified through a separate evaluation considering the chemicals handled and spillage that may occur. The following list is considering typical areas and is not to be interpreted as a complete list replacing the need for the evaluation. -The following areas should be equipped with both Safety Showers and eyebaths -methanol pump and injection area -chemical injection pump and injection area -production lab -tote tank area -process utility area -The following areas should be provided with eyebaths -workshops -cementer room, shale shaker room, sack storage room -drill floor -mudpit area -battery room, paint store, and mud lab The following areas should be provided with safety showers: -process areas -drilling areas C.7 Safety Stations and First aid kits

Safety Station Cabinets An adequate number of cabinets shall be provided. They should contain: - 4 vacuum wrapped blankets - one scoop type stretcher - one basket type stretcher - one first aid kit The cabinets shall be painted Green (RAL 6002). First aid kits An adequate number of first aid kits shall be provided at suitable locations, e.g. galley, workshops, drill floor and other areas where cut injuries are likely to occur. C.8 Lifebuoys

Life buoys shall be located at regular intervals along the periphery of the lower levels of the installation. C.9 Safety Equipment Data Sheets

Safety Equipment Data Sheets are included in NORSOK S-011.

NORSOK standard

Page 41 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX D - LAYOUT (NORMATIVE)

The following aspects to be checked and evaluated as a part of the layout design D.1 Area classification

"Catastrophic" events such as pipe rupture or vessel burst, which may be a result of material weakness, design error, falling loads, collision or sabotage, shall not be regarded as giving rise to a higher classification. This as the area classification reflects normal conditions onboard. "Catastrophic" events shall be reflected in the risk analysis, and may impose stricter requirements to arrangements and equipment than defined by the area classification alone. The area classification is an important part of the basis for layout, as it gives requirements to: Location of ventilation air inlets and outlets. Ventilation system requirements. Location of combustion air inlets and exhaust outlets for internal combustion engines and fired units. Location and use of ignition sources. Location of emergency equipment. Location of vent points. Location and design of doors and other connections between areas. Operational- and maintenance procedures in hazardous areas. Selection of equipment. Drainage connections between areas D.2 Escape routes

The dimension of escape routes shall be minimum 1m width (0.9 m for doors) and 2.3 m in height (2050 mm for doors). Escape routes intended for use by more than 50 persons shall be extended to 1.5 m (1.2 m for doors) in width. Required width of escape routes shall emphasise easy transport of injured personnel on stretcher in addition to the no. off persons onboard during hook-up /installation and commissioning activities offshore. Other general principles are listed below. There shall be at least two exits to escape routes from permanently or intermittently manned area outside quarters and offices, leading in different escape directions. The escape route network shall lead to safe areas and facilities as follows: Living quarters. Temporary refuge. Lifeboats and life rafts-stations. Boat landings (not normally manned installations) Helicopter deck. Flotel or other installations linked by bridge/walk way. The installation shall be equipped with at least one escape route running from far end and into living quarter. The quality of this route shall be such that: Personnel shall be able to use this route for a period of time sufficiently long to perform a NORSOK standard Page 42 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

complete evacuation of the installation plus a safety margin of 50%. Personnel shall be able to use this route without being subject neither to toxic fumes, smoke, excessive hot air nor unacceptable heat flux. When personnel is moving along this route the possibility of being hit by falling objects or hot liquids shall be well within the acceptable. Escape routes shall be part of the daily used transport- and passageways. Where appropriate, main escape routes should be provided on the outside along the periphery of the installation. Doors should normally open in the escape direction, but shall not block the outside escape route. Opening of doors should not require electric, hydraulic or pneumatic power. If such power is required the power supply should be local. Any dining room, recreation room in L.Q. etc., where more than 15 persons may be assembled should have at least 2 exit doors. Internal room arrangement should be evaluated for possible blocking of exits following an accident as well as external blockage. For all areas where there is a risk of congestion and panic, the doors shall be provided with panic bars. Escape routes leading to a higher or lower level should be provided by stairways. The number of these stairways shall be assessed based on the platform size, configuration of areas and equipment layout. Vertical ladders can be used in areas where the work is of such a nature that only a few persons (max. 3) are in the area on short time basis. It shall be possible to escape from a drilling area without running through a well head area. A dead end corridor of more than 5 m length is not acceptable. Stairways included in escape routes shall be designed to allow for transport of injured personnel on stretcher. Lifts shall not be considered as a part of escape ways. However, it shall be possible to escape from the lift and the hoist way with the lift at any elevation. Escape from legs/shafts/columns of an installation shall be considered separately. If use of lift is necessary to ensure adequate and effective escape, the lift system shall satisfy special requirements, e.g. concerning transport of injured personnel on stretchers, protection, ventilation, power supply. Escape routes and emergency stations shall be illuminated. Escape routes shall be provided with adequate emergency lighting. Emergency stations shall have minimum 15 Lux., escape routes minimum 5 Lux. Escape routes in all areas outside the living quarter shall be marked by yellow painting (RAL 1021). The escape routes within the living quarter should be provided with low level directional lighting, showing correct escape direction. Other enclosed and regularly manned utility and process areas should be considered separately. Escape routes shall be arranged from the drill floor to adjacent modules and also down the substructure. Protection of these escape routes from radiation heat should be considered.

NORSOK standard

Page 43 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX E - PRESSURE RELIEF (NORMATIVE)

E.1 General

Installations for production of hydrocarbons will normally require a gas release system. If inflammable and toxic gases can be conducted away from the installation safely without the use of gas release system, such system may be omitted. Examples of such installations may be wellhead platforms with small quantities of gas and subsea installations. Inflammable, toxic or corrosive gases should preferably be burned in a flare to prevent the causing damage or injury to people, the environment or to assets and financial interests. A cold vent system may be permitted in cases when this cannot cause damage or injury to people, the environment or to assets and financial interests. Based on risk evaluations, a choice may be made between a centralised or local vent. The discharge location must not represent any unacceptable risk. When necessary, the discharge point should be fitted with a flame control device. The design of the gas release system shall take into account low temperatures, vibrations and noise that may occur as a result of gas expansion. E.2 Depressurisation

Fast depressurisation shall be the mean of protection which should be utilised to its full potential for the installation concept. Active and passive fire protection is to be considered to function as supplement to depressurisation, if necessary to prevent any resulting unacceptable events (rupture or explosion of pressure vessels/piping). All pressure vessels and piping segments, which during shut down contains more than 1.0 ton of produced hydrocarbons (liquid and/or gaseous) or unprocessed crude, should be equipped with a depressurising system. For gas segments, the maximum containment should be set lower than 1.0 ton. Location of segment (enclosed or open area), risk of segment being exposed to a fire, consequence of rupture, etc. should be considered. Depressurisation systems are required in addition to pressure relief facilities because of the loss of material strength during a fire. Depressurisation systems may also be required for systems which are unable to contain flammable or toxic materials by passive means alone. Loss of the active method of containment will require depressurisation to prevent escape of the material concerned (e.g. centrifugal compressor's dependence on seal oil systems). The material properties at actual temperatures and pressures during depressurisation, steel thickness, active or passive protective measures shall together ensure that a pressure vessel/piping segment does not rupture at a stage where this may escalate the fire scenario beyond the control of the protective systems and arrangement. This may call for a detailed study of each ESD segment in particular. The design procedure is outlined in Annex G The depressurising, manually or automatic, shall be applied the following way: NORSOK standard Page 44 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Manual field depressurisation sequence is considered initiated after 3 minutes from detection of initial fire or gas. Automatic depressurisation sequence is considered initiated immediately after detection of initial fire or gas. API RP 521 should be used as guidance in the design of depressurisation systems. E.3 Relief and venting

The release of hydrocarbons from relief and depressurisation systems shall be routed through a closed system terminating at a liquid's disengagement vessel and with the liquid free gas being safely flared. Vents which are not suitable for routing to flare (e.g. due to backpressure) should be terminated outside the platform perimeter in such a way that accumulation of gases due to "dead pockets" etc. is avoided. Local venting of hazardous gases shall not be permitted unless it can be done without hazard to the personnel or the platform, e.g. for small and normally not manned installations local venting may be found acceptable. Flare K.O. drums shall be sized for two criteria: Disengagement of entrained liquid droplets. Containment of liquid carryover. The criteria for droplet removal will depend on the flare concept. The objective is to avoid condensate dropping from flare. The particle size should be less than 400 microns. In case of vertical flare tower using subsonic flare burner the droplet size should be less than 300 microns. The K.O. drum liquid containment capacity should be based on the largest foreseeable liquid condensation rate for a period of at least 20 minutes. This period should provide realistic time to identify a problem and allow for operator intervention. Longer periods may be required, e.g. for sub sea flow lines and inter field pipelines. This should be evaluated for each case. In addition the knockout drum should provide capacity for 90 seconds of liquid carry over from the largest source (assuming overfilled vessel). Progressive release of inventories from process piping and pressure vessels that can cause significant escalation of a fire shall be avoided. As a minimum, the piping system and the pressure vessels shall maintain their integrity during depressurisation. The depressurising system itself (blow down valves, branch piping and headers and K.O. drums) is of particular importance. The ability to maintain integrity when exposed to the fire loads depends on selection of material, wall thickness, pressure rating and applied fire protection.

E.4

Flaring

The need for flaring should be minimised from an environment point of view. Ref. NORSOK S-003, Environmental care. Calculations shall be performed to determine the levels of radiation on all areas of the platform for critical flare conditions.

NORSOK standard

Page 45 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Flare radiation calculations should account for variations in flaring quantities and wind conditions. Maximum heat loads from flares on open areas where personnel may be present and on locations where structures and equipment are exposed should be as follows: Permissible radiation levels to personnel should follow radiation levels as given in API RP 521. The heat loads from planned continuous flaring conditions on areas where personnel are supposed to perform work tasks lasting for two hours or more the working environment requirements for exposed areas should be considered and ample protection provided as required. For long periods of flaring (continuous flaring), consideration should also be given to the radiation level on the helicopter deck, i.e. the radiation/temperatures on the helicopter deck shall not become intolerable to personnel or limit the necessary helicopter operations. Unless otherwise accepted by 2 the responsible for helicopter operations, max. 1.9 kW/m is allowed on helicopter deck. Max. heat loads from flare on structures and equipment not designed for high heat loads should be limited to meet the requirements below. Higher exposure for short times, e.g. during emergency flaring conditions, that will not harm the structure or equipment can be accepted. Such deviations shall be documented. Protection of exposed areas may be necessary to meet these requirements. Heat loads on steel- or aluminium structures shall not give temperatures that results in loss of structural integrity. Heat loads on wires or limit switches in drill tower and cranes should be limited depending on type of lubrication and inspection- /replacement frequency. Flare radiation shall not cause temperatures in areas classified as hazardous above 200oC or above the ignition temperature of the actual gas, whichever is the lowest. Heat loads on Ex-rated electrical equipment and instrumentation should not give temperatures exceeding 40oC. Based on a case to case evaluation of protective clothing, provision of local radiation shields, etc., the limits for acceptable heat loads can be adjusted as applicable. Such deviations shall be documented. E.5 Cold Flare

In systems were the relieved gas during normal operation is routed back to the processing system, the following principles should be adhered to: The diversion of relieved gas under emergency conditions, e.g. depressurization shall not depend upon instrumentation and control valves. A rupture disk should be installed in parallel with control valves. The loop including control valves should have rapid response. A 2/3 voting system may be considered. It should be possible to test the entire control loop for both response time and set point calibration without routing the gas to flare or isolate the rupture disk function. A reliable system for detection of gas to flare should be provided. CCR should be alarmed. A pilot should be arranged. A robust and reliable system with back-up capacity should be provided for flare ignition. Radiation levels shall be calculated. For permissible radiation levels, see E4.

NORSOK standard

Page 46 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

E.6

Cold vent

The design of cold vents shall be based on dispersion calculations to prove that the foreseen gas rates can be released without creating explosive air/gas mixtures on the installation or in its vicinity. Further, the possibility of an unintended ignition shall be taken into account in the design and dimensioning of the cold vent, i.e. ignition of foreseen gas rates should not give unacceptable heat loads or other consequences on the installation. For permissible radiation levels, see E4 The need for extinguishing ignited cold vent should be considered. E.7 Drainage systems

The platform should be equipped with the following drainage systems: One closed drainage system. One open drainage system from non-hazardous areas. One open drainage system from hazardous areas. Where applicable, a separate mud drainage system should be provided covering the drill floor and mud treatment areas. Open drainage systems from areas where there is no pollution, e.g. rain water drain from roofs and helicopter deck could be routed directly to the sea. The drainage system form helicopter deck shall be capable of draining helicopter fuel from a crashed helicopter and AFFF from the fire fighting system and two monitors. The drainage system together with the deck itself should be provided with de-icing facilities. Reference to ISO 13702 clause 8.

NORSOK standard

Page 47 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX F - FIRE AND GAS DETECTION (NORMATIVE)

Only essential information shall be shown on the mimic, i.e. fire area status, except for areas or equipment where more detailed alarm identification is appropriate, e.g.: In or at ventilation inlets/outlets. Inside critical equipment enclosures. F.1 Gas detector layout and alarm initiation

The following principles shall apply concerning detector layout and alarm initiation: Location, type and number of gas detectors shall take into account: - Leakage sources within the area. - Borders between non-hazardous and hazardous areas. - Gas density relative to air. Detection principles. Voting, if applied. - Ventilation air flow patterns. - Wind-direction and velocity. - Critical reaction time/detector response time. - Size of the area. Criticality of the area with regard to safety. Cloud size of the minimal leakage to be detected HVAC - HVAC intakes or ducts shall be monitored by an adequate number of gas detectors. The size of the intake, air flow patterns, voting philosophy, etc. should be evaluated when deciding number of detectors. The use of line detectors is regarded as equal to the use of IR point detectors. - Gas detectors in HVAC supply should be located at the air intake, alternatively in the duct as close to the duct opening as possible. Detectors in ducts should be positioned as near as practical to the centre of the duct where the air velocity is greatest and where the response time to gas ingress is consequently most rapid. At large intakes, the flow patterns around the opening should be determined to achieve an optimum position of the detectors, ensuring fast response under various wind directions/orientations as well as for possible leak positions. The total response time from gas at intake to shutdown of the intake shall be determined by the transport time of gas from intake to location of shutoff dampers and HVAC units. - If gas is detected at ventilation air inlets, the ventilation fan in question shall be stopped, all intake dampers shall be closed and the heating element shut off. The surface temperature of the heating element shall not exceed the auto. ignition temperature of any gas present in the area. - On installations where the sources of leakage of flammable or toxic gases are concentrated in a small area, e.g. on mobile installations, gas detection at air inlets of mechanically ventilated areas may be omitted. In such cases it is however required that the ventilation systems are shut down automatically in the event of gas detection, and that there are gas detectors located in all areas classified as Zone 1 or Zone 2. - Gas detectors should be located at HVAC outlets from hazardous areas.

NORSOK standard

Page 48 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

One of the following two philosophies should be chosen: Voting philosophy: - Confirmed gas is activation of alarm from two detectors - Low alarm is activation of alarm from one detector - Initiation of automatic alarm is activated by alarm from one detector. - With voting philosophy applied, a "2-out-of-n, n>2" logic shall be applied. - One alarm level shall be used. - Confirmed gas is activation of high alarm from one detector. - Low alarm is activation of low alarm from one detector. - Initiation of automatic alarm is activated by low alarm from one detector - Two alarm levels shall be used, low alarm and high alarm.

Single philosophy:

Each project shall define alarm set point(s). Definition should be based upon whether a voting philosophy has been applied, ventilation conditions within the area and the events to be detected (minor or middle sized leakage or catastrophic events). In any case, high alarm level shall not be set to values above 30% LEL. For outdoor areas an alarm level of 20% LEL is recommended. For detection of internal leakage within gas turbine hoods an alarm level of 5% LEL is recommended. Alarm on gas detection - Alarms should be automatically initiated upon confirmed low level alarm according to Table F.1. Table F.1 Automatic hydrocarbon gas alarm in area. Automatic alarm in area Living Non-haz. Process Quarter utility area area

CCR Confirmed gas detected at: HVAC intake LQ Non-hazardous utility area HVAC/air intakes Process area incl. HVAC outlets Drilling area incl. HVAC Any single detector low alarm level

Drilling area

Drill control cabin/office

X X X X X

X X

X X X X

X X X X

X X X X

X X X X X detector in drilling area

Any gas alarm shall be presented in CCR. For alarms from detectors located in drilling areas the information presented in CCR shall be mirrored in drilling contr. office and in drillers cabin.

NORSOK standard

Page 49 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Line gas detectors - Line detectors are preferred where the layout enables good coverage by such detectors. Line detectors could be used in combination with point detectors for limiting the total number of detectors. - Line detectors should be easily accessible via ladders and/or access platforms for maintenance, adjustment and cleaning. - It must be ensured that the control centre receives warning well in advance of the concentration reaching dangerous levels. As a minimum, the line detector set point should be adjustable from 0.5 to 8 LEL meter. Recommended set point is between 1.0 and 2.0 LEL meter. Hydrogen sulphide gas - Detectors should operate in the range of 0-50 PPM. - An alarm (light and sound signal) should be activated both in CCR and locally in the event of a concentration of hydrogen sulphide of 6 PPM. F.2 Fire detector layout and alarm initiation

Fire detector type: The selection of fire detectors shall be based upon an evaluation of the nature of the fire to be detected and the operational conditions that may exist. Fire detection in Living Quarters and office areas shall be based on addressable optical smoke detectors with alarm to CCR. Care should be taken when locating detectors to avoid interference by for instance steam generated in bathrooms. Early warning smoke detection systems, sensitive to small concentration of combustion products, shall be considered in rooms containing live electrical equipment subject to manual intervention and fire fighting. Such rooms will typically be: - Central control room. - Instrument room. - Switch board and electrical rooms. Early warning smoke detectors should be used together with optical smoke detectors of standard sensitivity setting. Location of all smoke detectors shall be verified by smoke tests. For smaller areas typical location should be at HVAC extract. Early warning smoke detectors should have a sensitivity of approx. 0,4 0,8 % obscuration per meter. For electrical rooms where all fire extinguishing is based on manual intervention, facilities for total electrical isolation of any of these rooms shall be provided either outside the room and / or in CCR. As a minimum multi IR or dual IR/UV flame detectors should be used for fire detection in process areas. For areas containing alcoholic substances, flame detectors shall be able to detect alcohol fires in addition to hydrocarbon fires. NORSOK standard Page 50 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Heat detectors should be used in enclosed areas where a significant and rapid temperature rise can be expected, e.g. in combination with smoke detectors. Manual detection: Manual fire alarm buttons shall be provided at strategic locations, e.g. exits from process areas, escape routes, fire stations. Automatic start of fire pumps upon manual fire alarm may be considered. These buttons may be used for other accidents or situations where the attention of CCR is required in accordance with established operational procedures. In this case automatic start of fire pumps may not be implemented. Manual fire alarm buttons should be mounted at a height of 1.4 meter above floor level and there should not be more than 30 meter walking distance to a manual fire alarm button from any point on the installation.

One of the following two philosophies should be chosen: Voting philosophy: - Confirmed fire is alarm from two detectors of same type within an area. - With voting philosophy " 2-out-of-n n>2 logic shall be used. - Confirmed fire is alarm from one detector within the area.

Single philosophy:

Alarm on fire detection: Alarms should be automatically initiated upon confirmed fire according to Table F.2. Alarms in other areas to be manually initiated from CCR. Table F.2 Automatic alarms upon fire detection.

Automatic alarm upon confirmed fire detection CCR Living Non-haz. Process Drilling Quarter utility area area area Confirmed fire detected at: LQ Non-hazardous utility area Well head area Single loop Confirmed Wellhead or Process area Confirmed drilling area Any single Detector

Drill control cabin/office

X X X X

X X X X X X X X X X X X X

X X

X X detector in drilling area

Any fire alarm shall be presented in CCR. For alarms from detectors located in drilling areas the information presented in CCR should be mirrored in drilling contr. office and in drillers cabin. NORSOK standard Page 51 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Table F.3 below presents normative examples of fire and gas detection in the various areas on installations. Alarms are described in the text above, and are not repeated in the table. The solutions presented in the table can be deviated upon an evaluation of the specific risks in an area. Reference is also made to figure 9.1 regarding the emergency shutdown philosophy, and clause 10.6 regarding active fire fighting. Table F.3 Fire and gas detection/shut down actions.

Area/room Well head area

Manifold area Nat. vent./ outdoor H.C. process area Mech. vent. process area (separation/gas compression) Water injection treatment area

Fire and gas detection / shut down actions Automatic fire Shutdown Automatic gas Shutdown Comments detection action detection action Flame or heat ESD II Area ESD II *) Not normally (fusible plugs*) manned installations Flame ESD II Area ESD II Flame ESD II Area ESD II

Flame

ESD II

Area + HVAC extr. Duct

ESD II

Flame or smoke*

ESD II

HVAC intake* None**

ESD I*

Area assumed non-hazardous *) Mech. Vent. Area **) Nat.vent/ outdoor area

Gas compression area Drill floor Drillers cabin Degasser room

Flame None Smoke Flame

ESD II Manual Manual Manual Drillers cabin Manual Drillers cabin Manual Drillers cabin None

Area Area HVAC intake HVAC extract

ESD II Manual* Manual* Manual* Drillers cabin Manual Drillers cabin** Manual* Drillers cabin ESD II *) See 9.3.6 *) See 9.3.4 *) See 9.3.4

Shale shaker room

Flame

Area, H2S*

*)If sour service **) See 9.3.4 *) See 9.3.4

Active mud tank room Sack/bulk storage area

Flame

Area + HVAC extract HVAC intake* None**

Heat

*) Mech. Vent non-haz. Area **) Nat. vent. Partly open area Page 52 of 66

NORSOK standard

Technical Safety

S-001 Rev. 3, Jan. 2000 Fire and gas detection / shut down actions Automatic fire Shutdown Automatic gas Shutdown detection action detection action Smoke None HVAC intake ESD II

Area/room Mud lab

Comments Assumes no piped connection to mud system See 9.3.4

Cementing unit room

Flame

None

HVAC intake

Central control room (CCR) Instrument room adjacent to CCR Central tele eq. Room Local equipment room (LER)

Smoke in cabinets* and/ or at roof level Smoke*

Manual

HVAC intake

Manual from Drillers Cabin ESD I

Manual

HVAC intake

ESD I

Smoke*

Manual

HVAC intake

ESD I

Smoke*

Manual

HVAC intake

ESD II**

Turbine hall

Flame * Smoke ** Flame and heat*

Manual

HVAC intake

ESD I

Turbine hood

Unit shutdown upon area fire detection

Area (hood)

Unit** shutdown upon area gas detection ESD I ESD I

*Fire detection Early warning system *) See F.2 Early warning system *) See F.2 Early warning system *) See F.2 **) Shut down of internal equipment to be evaluated * Fuel system **Electric equipm. *) Supplier to confirm. **) Continue ventilation. Block and bleed fuel gas system

Turbine Switch board and electrical room Smoke*

Combust. air intake El.** power HVAC intake switch off

Battery room (lead acid)

Smoke*

HVAC intake H2 detector at extract

ESD I Shutdown boost charge

*) See F.2 Early warning system **Manual or automatic with timer to be decided *) See F.2 Early warning system

NORSOK standard

Page 53 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000 Fire and gas detection / shut down actions Automatic fire Shutdown Automatic gas Shutdown Comments detection action detection action Flame Manual HVAC intake ESD I, *) Running fire Close fire- pump will be damper* shutdown only on overspeed Smoke or heat Manual Air intake ESD I* *) Incl. unit shutdown Smoke or heat Manual HVAC intake ESD I Separate welding HVAC extract Smoke or heat Manual HVAC intake ESD I HVAC intake HVAC shut Air intake down Manual * ESD I ESD I

Area/room Fire pump room and emergency generator room with diesel engine Air compressor Mechanical workshop Instrument workshop Paint storage HVAC intake common for LQ.

Heat or flame Smoke at intake and in HVAC room LQ, cabins/rooms/ Smoke Areas

*) Covered by gas detector in HVAC intake (see above line)

Vent extract from galley General galley area Crane engine room

Heat Heat Heat or smoke*

Manual Manual Manual Combustion air intake** ESD** *) Smoke for Unit s.d. electrically timer delay driven cranes. 30sec **) Depend on crane location

Helicopter deck Hangar Chain locker Turret area Pump room in column

None Smoke and flame None Flame Smoke, heat

ESD II

None None None Area HVAC intake

ESD II ESD I

NORSOK standard

Page 54 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX G - PROTECTION OF PRESSURE VESSELS AND PROCESS PIPING AGAINST FIRE (NORMATIVE)
The design procedure includes the following principal step: Step 1. Identification of fire types and duration. The initial step is to decide on the characteristics of fire the pressure vessel/piping can be exposed to including the duration of the fire. Fuel composition, mass, mass rate and duration as applicable and ventilation conditions should be determined: Types of fire: Pool fires in open or enclosed areas, fuel controlled. Pool fires in enclosed areas, ventilation controlled. Jet fires. Step 2. Effect of firewater. Water applied for controlling the fire and cooling of pressure vessels and piping is very effective when evenly distributed over the exposed areas. The following should be considered for achieving the efficiency of firewater: Spray of deluge water from nozzles from below, from both sides and from above. Spray nozzle location ensuring that water spray projection covers all surfaces of the protected equipment/piping. Supply of deluge water to a module arranged so that accidents can not damage the supply. Coverage of fire detectors that ensures immediate detection of small fires in all parts of the fire area. Operational procedures ensuring high availability of these systems. Step 3. Heat flux values for the next step are then selected from the following table: Table G.1 Type of fire Pool fire (crude) open or enclosed area fuel controlled Note 1 Pool fire enclosed area ventilation controlled Note 1 Jet fire Heat flux values. Initial heat flux density Average load 100 kW/m2

Initial heat flux density Max. point loads 150 kW/m2

200 kW/m2 250 kW/m2

130 kW/m2

Note 1. In areas with unprocessed crude or crude in the first or second stage of separation, the heat flux loads should be considered comparable to jet fire loads. Special considerations should be done for heavy crude fields.

NORSOK standard

Page 55 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Alternatively, heat loads could be based on a detailed evaluation/simulation of the credible fire scenarios. Application of qualified predicting tools for calculation of heat loads may be an integral part of the evaluation. The average heat flux density shall be applied where the global load over an area is dimensioning, e.g. for boil off in pressure vessels. The max. point loads shall be applied in cases where local damage is critical, e.g. for the integrity of a pressure vessel shell or of critical structural elements. Step 4. Depressurising / rupture calculations. Perform depressurising calculations for each major pressure vessel and piping segment, establishing internal pressure fluctuation, wall material temperature and residual strength, as a function of time. Determine whether rupture will occur during depressurising, and identify time to rupture if this will occur. The effect of manual versus automatic initiation is specified in Annex E, clause E.2. Step 5. Evaluation of failure mode. If a rupture of pressure vessels and piping occurs as a result of a combination of excessive heat load and internal pressure, an acceptance of the situation will have to be judged based on the risk analyses. Residual quantities, escalation potentials both within the area and towards adjacent areas shall be taken into account. Simplified evaluations can be made when the pressures are considered low (< 4.5 barg) or the potential leakage of hydrocarbon is low (less than 1 ton) in the pressure vessels and piping when the rupture occurs. Where rupture can not be accepted, i.e. the risk acceptance criteria are not met, the provision of additional protective systems and arrangements shall be implemented. This can be: Change from manual to automatic depressurising. Modifications to depressurising system (increase its capacity) Application of passive protection that will reduce the heat loads to the exposed pressure vessels/piping. Modifications to pressure vessel /piping design (material, wall thickness etc.). Modifications to the general arrangements that have an impact on the time to rupture. The procedure will then have to be repeated from step 1, 2 or 3 as applicable.

NORSOK standard

Page 56 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX H - FIRE FIGHTING SYSTEM (NORMATIVE)

H.1 Fire Water Drivers and Pumps Diesel Engines and generators Diesel engines providing power to more than 100% of the design firewater capacity shall not be located within the same room. It shall be possible to start the fire water system even if no other systems on the platform are operational. A manual isolation switch/valve between the starter motor and the start battery/air bank shall be provided per starter motor. Each engine shall have two independent starting systems The start batteries for the fire water diesels and the batteries for the diesel control system shall be located within the same room as the diesels. Stopping the fire water diesel engines shall only be possible local to the engines. In case of gas in air intake to the fire water engine room, the room shall be automatically closed and the cooling air shall be taken from the engine room itself. Cooling of the engine room shall be by an air/fire water-cooling unit powered directly from the diesel engine. The fire water diesel start batteries shall be charged by the fire diesel generator while running in addition to the main power. Fire resistant cables shall be used between firewater generator and motor. Each diesel engine shall have its own dedicated day tank sufficient for 18 hours continuous full power operation. Fire Water and Jockey Pumps The fire water pumps and up- and downstream piping shall be completely filled with water at all times. The fire water system shall be pressurised in the standby mode. The pressure source shall have the capacity of flow through frost protection bleed lines plus two hydrants.

Fire Water Pump Control Each fire water pump shall be fitted with a minimum flow control valve. A test valve for the fire water pumps shall be installed to enable checking of the fire pump curve up to 150% of design flow rate. The valve shall be able to regulate from zero flow up to 150% capacity and shall be of low noise design. Possible water hammer effects shall be considered.

NORSOK standard

Page 57 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

H.2 Fire Water Piping, Valves and Nozzles General It shall be possible to start the fire water pump system without delay and without causing unacceptable pressure surges. A pressure surge study shall be performed. Means that may be considered for eliminating pressure surge problems are pressure vacuum valves, soft closing minimum flow valves, pressurised overhead tanks, etc. The deluge and monitor skid cabinets shall have doors with sufficient stopper arrangements to prevent a personnel risk associated with the cabinet doors in strong winds. The skids shall withstand the applicable explosion loads. The deluge system shall comply with NFPA 16, Deluge Foam - Water System. The sprinkler system shall comply with NFPA 13, Sprinkler Systems. Deluge, monitor and sprinkler valves shall fail in last position upon loss of signal from F&G logic. The system design shall allow for complete system flushing in commissioning and operation. Fire Water Piping For general piping requirements, reference is made to NORSOK P-001, clause 8 and L-002 clause 4.7. There shall be a minimum of two pressure transmitters in the Fire Water Ring main providing the low-pressure start signal to the firewater pump diesels. The FireWater Ring main shall be equipped with two points (min 6) for connection to external water supply for commissioning. (SOLAS international shore couplings should be used.) The fire water piping system shall be fitted with sufficient number of high point vents to achieve the following: Efficient frost protection at all locations. Efficient removal of all entrained air pockets in the water. All low points in piping downstream deluge and monitor skids shall be equipped with 3 mm weep wholes to prevent pockets of water to be entrained. The weep holes shall be considered in the firewater demand calculations. Sprinkler systems shall have a test and flush connection in the far end of the piping system and at the sprinkler valve(s). The connections shall be easy accessible from deck level and have one drain box located below the connection. Adequate venting facilities with valves shall be provided for wet pipe sprinklers. Valves Sprinkler valves shall be provided with full capacity manual by-pass The arrangement of the isolation valves shall be such that not more than 50% of the fire water to water hoses and hydrants for one area, is effected if one segment of the fire water ring main is taken out of service. All valves (> 1") shall be painted red and provided with a car-sealing system. Control valves for sprinkler and deluge systems shall be located outside the area they protect. Deluge control valves shall be automatically activated by the F&G logic. All deluge valves, monitors and sprinklers shall be fitted with a test line with 100 % capacity. For manned installations resetting of deluge, monitor and sprinkler control valves shall only be possible local to the valves.

NORSOK standard

Page 58 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Activation of deluge, monitor and sprinkler systems shall trigger alarm in CCR. Pressure transducers downstream deluge, monitor and sprinkler valves shall be fitted to provide confirmed flow signal to CCR. Quick operating isolation valves shall be provided for each hydrant.

Nozzles and sprinklers. When arranging deluge nozzles, the vertical distance between nozzle and floor shall be considered to ensure adequate cooling effect. All deluge and sprinkler nozzles shall have Factory Mutual approval. Nozzles for area coverage on fully open process and drilling areas shall only be the high velocity types. The sprinkler heads should be of the frangible bulb type, set to burst at 68oC, in general areas. However, a higher temperature limit should be selected for areas where high ambient temperatures might be expected. The sprinkler heads should be located in positions which ensures an application rate of not less than 6 l/min/m2 at all times over the nominal areas protected by the sprinklers. Due consideration to overlap, obstructions, etc. should be given when positioning the sprinkler heads. H.3 Monitors

Automatic drain facilities shall be provided for each fire water monitor. All monitors shall be adjustable through 3600 in the horizontal plane and + 600, - 400 in the vertical and it shall be possible to manually lock them in any position. Fixed firewater monitors with the possibility of foam mixing at predetermined ratio should in general be used for areas with a high fire potential and which are not protected by fixed deluge systems Water monitors shall be sized to discharge at least 120 m3/h at a nozzle pressure of 7 barg. The monitor nozzles shall be of the constant flow type, i.e. same flow at fog and at jet spray. The spray angle shall be easily adjusted when in operation and return to maximum spray angle after use. When monitor valves are opened manually and local to the monitor, a signal shall automatically be given to the F&G logic and to the starter logic for the fire water pumps. The fire water monitors are flanged directly on the feed pipe. A considerable reaction force from the monitors will normally require a pipe support immediately below the flange.

H.4 Hydrants and Hose Reels General Hydrants and hose cabinets shall comply with NFPA 14, Standpipe and Hose System. The maximum reaction force on the hose nozzle where only one person is supposed to operate the hose shall not be more than 25 KP. It shall be possible to reach any area where a fire may occur on the installation with at least two water jets from monitors or hoses.

NORSOK standard

Page 59 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Hydrants and Hose Reels One cabinet shall be provided per hydrant. The cabinet incorporated in each hydrant shall consist of: 4 off 1 1/2 inch fire hoses of an approved fire-resistant type, 15 meter in length with instantaneous connection joints to hydrants and nozzles. Two auto to fog nozzles with pistol grip. Capacity minimum 20 m3/hr with 2 hoses and a nozzle hooked up. Two sets of connecting key. All hydrants shall have two outlets fitted with 1" quick connections of a standard approved type throughout all areas (NOR No. 1). The hydrants shall be located in weather resistant cabinets fitted with heating units where required. The cabinets shall be designed for bolting to the deck. Non collapsible hose reels shall have: Within living quarter 25 meters of 1 bore hose with auto-to-fog nozzle, capacity approx. 8 m3/hr. 1 within all other areas 25 meters of 1 /4" bore hose with auto-to-fog nozzle, capacity approximately 15 m3/h

H.5 Foam System General Foam supply shall be provided for all areas where hydrocarbon or alcohol pool fires are likely to occur. The foam system shall comply with NFPA 11, Foam Extinguishing System. Filling of foam to the supply tanks shall be performed from tote tanks in the lay down area. Foam Pumps For centralised foam systems there shall be 2x100% foam pumps. The pumps shall be powered from the fire water diesel generators, but it shall also be possible to run the pumps from main power through the emergency switchboard in order to run/test pump without starting the fire water diesel generator. Both foam pumps shall be in stand-by mode and start simultaneously with the fire water diesel drivers. In a centralised foam system a jockey pump shall be provided and powered from emergency power Each of the foam pumps shall be connected to one foam supply tank, each having a capacity for 30 minutes supply to the largest fire area, alternatively to one tank with capacity for 60 minutes. The foam pumps shall be equipped with minimum flow control and pump testing facilities. For the foam pumps all scenarios from minimum to maximum flow, is to be considered as normal duty for the pumps.

NORSOK standard

Page 60 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Foam Control and Piping If a centralised foam system is selected, the foam ring main shall be provided with isolation valves. For a centralised foam system a balanced foam proportioners shall be used. When in operation the foam supply shall have an operation pressure of at least 2 bar above the firewater pressure to prevent reverse flow. Foam shall be injected downstream deluge and monitor control valves to prevent ingress of foam into the fire water system. Monitors and hydrants on helicopter deck shall be equipped with foam for > 10 minutes continuous service. Foam capacity shall correspond to 10 minutes operation at full monitor design capacity. The pressure in the foam ring main shall be presented in CCR, To avoid foaming and contamination, draining of the foam concentrate tanks shall not be made to the open deck drain.

NORSOK standard

Page 61 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX I - LIVING QUARTERS (NORMATIVE)

The living quarters shall be designed and protected so that: a) each floor is separated by decks that meet the requirements of Class A-60. The main structures supporting/stabilising the decks shall have a fire resistance of 60 minutes according to a standard fire test or approved calculation. Joints between the deck and the outer wall shall have a minimum fire resistance of 60 minutes; b) all staircases meet the requirements of Class A-60. For stairs connecting two floors only, it is sufficient that the walls of the staircase at one of the floors meet the requirements of Class A-60; c) all shafts interconnecting floors are built to Class A-60; d) kitchen and dining room are separated from the rest of the living quarters by Class A-60 fire divisions; e) work spaces, laboratories, rooms for electrical equipment such as major distribution panels, transformers etc. and rooms for water heating are separated, individually or in sections, from the rest of the living quarters by fire divisions of at least Class A-0; f) all walls and doors where Class A fire division are not required meet the requirements of Class B15; g) walls in corridors extend from deck to deck and meet the requirements of Class B-30. If a suspended ceiling design is continuous between Class A division and meets the requirements of Class B-15, walls in corridors may be terminated at the ceiling; h) suspended ceilings meet the requirements of Class B-0; i) draught stoppers are installed above suspended ceilings, which meet the requirements to Class B-0. The distance between draught stoppers should not exceed 14 meters; j) there are no windows in walls facing processing area etc; k) fire doors are installed in corridors to the extent necessary. l) additional principles and requirements relating to Living Quarters are included in NORSOK C001/002

NORSOK standard

Page 62 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX J - FIRE PROTECTION DATA SHEET (INFORMATIVE)

SDS-001 Fire protection data sheet

NORSOK S-001 Rev. 3, April 1999

Package no. Doc. no.

FIRE PROTECTION DATA SHEET / AREA SAFETY CHART

SDS-001 Rev. 3, April 1999 Page 1 of 1 Rev.

AREA CLASSIFICATIONS ZONE 1 ZONE 2 NON-HAZARDOUS BY LOCAT. NON-HAZARDOUS BY VENT.

VENTILATION NATURAL MECHANICAL OVERPRESSURE UNDERPRESSURE

OCCUPANCY PERMANENT INTERMITTENT NORMALY NONE NONE

WALLS / FLOOR / CEILING NONE: WIND SHIELD: HEAT SHIELD: STEEL WALLS: FIRE PARTITIONS: EXPL. PANELS: SUSPENDED: FALSE:

FLOOR

CEILING

HAZARDS
CRUDE OIL CONDENSATE LIQUID LIGHTER HYDROCARBON GAS HEAVIER HYDROCARBON GAS TOXIC GAS H2S, CO2 CHEMICALS METHANOL GLYCOL FUEL OIL / DIESEL LUBRICANTS ELECTRICAL OTHER COMBUSTIBLES RADIOACTIVE EXPLOSIVES HYDROGEN GAS

FIRE AND GAS DETECTION

HC GAS IN AREA - POINT OR BEAM HC GAS IN HVAC INTAKE HC GAS IN COMBUSTION INTAKE HC GAS IN COMB./VENT. INTAKE HC GAS AT BOUNDARY - POINT OR BEAM TOXIC GAS IN AREA SMOKE IN AREA SMOKE IN HVAC INTAKE EARLY SMOKE HEAT IN AREA FLAME IN AREA MANUAL CALL POINT (MCP) MANUAL CO 2 RELEASE MANUAL RELEASE WATER (MRW) AREA RESET ESD PUSHBUTTON MANUAL ELECTRICAL ISOLATION (MEI)

FIRE & BLAST PROTECTION

AREA DELUGE EQUIPMENT DELUGE AFFF SPRINKLER WATERMIST MONITORS HYDRANT CO2 HOSE REEL (HIGH CAP.) HOSE REEL (LOW CAP.) DUAL AGENT HOSE REEL (DAHR) WHEELED PORTABLE EXTINGUISHER CO2 PORTABLE POWDER PORTABLE WATER PORTABLE GASEOUS EXT.

RATE
10 l/min/m2 20 l/min/m2 1 0/0

54 m3/hr 2 x 20 m3/hr 13 m3/hr 8 m3/hr

BC CO2

NOTES:

O U T P U T S I G N A L S

INPUT SIGNALS

FIRE ZONE: AREA:

AREA SAFETY CHARTS FOR: DESCRIPTION:

NORSOK standard

Page 63 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

ANNEX K - NORMALLY NOT MANNED INSTALLATIONS (INFORMATIVE)

K.1 General requirements

This Annex outlines detailed recommendations to a simple NNMI, which is manned only during daylight and under weather conditions that allow safe access and departure by boat or helicopter. No facilities are provided for overnight stay. For more complex installations, or where personnel will stay onboard for shorter periods, additional recommendations should be considered to achieve an adequate level of safety. A simple NNMI considered in this annex will typically be arranged with means of access from the sea, an access deck for the christmas trees and a helicopter deck. The process equipment typically includes christmas trees, production manifold and a removable spool for pigging. The main power source should be a battery pack with recharging by a small diesel generator or by a power cable from the service installation. When manned, manual shutdown of the installation should be possible locally as well as from remote control point. K.2 K.2.1 Production systems Well head system

The well head system should be designed to withstand the highest load combination of pressure and temperature occurring during operation, shutdown and maintenance of the wells. In addition to local operation, wing control valves may be controlled from the remote control centre, allowing remote shutdown and restart of the production. Blocking of remote start-up of production should be possible while the installation is manned. K.2.2 Piping systems and pressure vessels Piping systems and pressure vessels should be designed to minimise the instrumentation and control equipment. Piping systems designed to withstand the highest load combination of pressure and temperature, to which the systems are expected to be exposed, need not be provided with full flow pressure relief valves.

NORSOK standard

Page 64 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

K.2.3

Drain and vent systems

Manual depressurisation of all pressurised systems should be possible from the platform when it is manned. Vent pipes from systems containing hydrocarbons should be terminated at a minimum of 3 m above or outside decks. The location of vent pipe termination should take into account helicopter operations. The consequences of ignited vent pipes should be considered. Vents on atmospheric vessels, which are not dimensioned to withstand a full inside explosion pressure, should be provided with adequate flame arrestors. K.2.4 Risers Production and lift gas risers should be equipped with a riser emergency shutdown valve. On risers for stable fluids, which may be depressurised from the main installation, omission of riser emergency shutdown valves may be considered. K.2.5 K.3 K.3.1 Auxiliary systems Safety systems Escape routes/Shelter Engines should be avoided, but if required, be certified for operation in hazardous areas. Primary protection of personnel should be quick and effective evacuation. Escape routes to the shelter should be established. The shelter should provide for protection of personnel until evacuation can be performed. If the platform is provided with a boat landing for personnel transfer a secondary escape route to the landing should be established if it makes a contribution to the evacuation options in an emergency situation. K.3.2 Life-saving appliances Adequate life saving appliances for the crew that comes on board should be available. (Ref EERS) Installation of at least one free fall lifeboat is recommended, but other arrangements such as a combination of MOB /lifeboat may be used. This is to be decided based on the emergency preparedness analyses. An evacuations chute with rafts should be considered to achieve the required redundancy of the evacuation means. K.3.3 Emergency shut-down Provisions should be made for emergency shutdown and operational shutdown of the installation to be made both locally at the installation and at the remote control centre. Reset of the ESD valves should be made at the valve itself, but may be done from the remote CCR when the NNMI is unmanned if adequate means to evaluate the situation onboard from the CCR is provided. The emergency shutdown signal from the remote control centre should be by a fail-safe signal (e.g. by means of a radio link) which on disconnection shuts down the normally not manned installation. A possible time delay in shutdown due to a link failure should not exceed 10 min. NORSOK standard Page 65 of 66

Technical Safety

S-001 Rev. 3, Jan. 2000

Emergency shutdown of the remote control centre or plant should result in operational shutdown of the not normally manned installation. It should not be possible to inhibit a local emergency shutdown system from the remote control centre. The emergency shutdown system should be in operation when the installation is unmanned. The emergency shut down system should be separate from PSD and PCDA. K.3.4 Communication Voice communication between the installation and the remote control centre and directly between the installation and standby vessel should be possible when the installation is manned. If voice communication is based on portable radios, a minimum of two radios should be available on the satellite installation. The reliability of the communication links for the emergency and control systems between the CCR on the main installation and the NNMI should be documented. K.3.5 Fire and gas detection Fire detection should be provided and automatic shutdown initiated upon confirmed signal. Gas detectors with shut down functions should be in operation when personnel is onboard the installation. If portable detectors with built-in alarm functions are used, the crew should place these in fixtures on approved locations when ascending the installation. K.3.6 Alarm systems Upon gas detection an audible alarm should be activated. Portable gas detectors may provide the alarm. When the installation is manned, an APS signal should be operable, which can be perceived by all on board. K.3.7 K.3.8 Emergency power Helicopter deck An emergency power supply should be provided with a capacity of minimum four hours. The helicopter deck should as a minimum be equipped with a dual agent extinguisher system based on 250-kg dry powder and 250 l premixed foam. On regularly operated decks (this means when shuttling have to be done for temporary periods.) a built in fire fighting system is recommended.

NORSOK standard

Page 66 of 66