EXPLOSION MITIGATION

(1)

fireandblast.com

UKOOA / HSE

Fire and explosion guidance

Part 2: Avoidance and mitigation of fires

FINAL DRAFT

Main comment review completed

Document number 152-RP-48

Revision Date Reason for Issue

A 1 Mar 05 Initial build

B 21 Jun. 05 All received material to date

0 3 July 05 Issued for comment to sponsors, authors and peer review 1 02 Feb 06 Issued following review of main comments

(2)

Foreword

This document has been prepared by fireandblast.com limited by compiling contributions from a selection of industry experts in various aspects of fires on offshore installations.

This document has been prepared by fireandblast.com limited under a joint industry project sponsored by UKOOA and the UK HSE. The production of the initial text was undertaken by a number of organizations and individuals, principally:

David Galbraith and Ed Terry fireandblast.com

Steve Walker MSL Engineering

Barbara Lowesmith Loughborough University

Terry Roberts, Stefan Ledin and Stuart Jagger Health and Safety Laboratory

Bassam Burgan Steel Construction Institute

John Gregory Risk Management Decisions

Theresa Roper Aker Kværner

Bob Brewerton Natabelle Technology

Graham Dalzell TBS cubed

Denis Krahn Mustang Associates

This document is part of a series being produced by UKOOA and HSE on fires and explosions, the full series being:

Part 0 Hazard management (formerly FEHM) Part 1 Avoidance and mitigation of explosions Part 2 Avoidance and mitigation of fires

(3)

1. Introduction

1.1 History

Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire Engineering for Topsides Structures (Phase 1)’ was carried out between May 1990 and July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1.1] and 26 background reports [1.2 to 1.27] written by the participants and published by the Steel Construction Institute (SCI) in November 1991. These background reports are available as free downloads from the HSE web site [1.28].

The development of the Interim Guidance Notes was a major step forward which consolidated the then existing knowledge of fire and explosion hazards. At about this time the Fire and Blast Information Group (FABIG) was set up and has subsequently issued a number of Technical notes on specific aspects of fire and explosion engineering [1.29 to 1.36], of the eight published Technical Notes, five deal with fire hazard issues.

The hazards, characteristics and physical properties of hydrocarbon jet fires were appraised in the Phase 1 reports of the Joint Industry Project on ‘Blast and Fire Engineering of Topside Structures’ (OTI 92 596/597/598) [1.37]. The main source of detailed information on the characteristics of jet fires covered in the reports on the programme of jet-fire research was co-funded by the European Community. This programme studied single fuel natural gas and propane jet fires (Bennett et al, 1990) [1.38]. A further project funded by the CEC, looked at the hazardous consequences of Jet Fire Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet flame impingement trials are reported in OTO 2000 051 [1.39].

Phase I of the JIP (OTI 92 596/597/598) [1.40, 1.41, 1.42] also included a review of open hydrocarbon pool fire models. Three types of model (current at the time) were evaluated, semi-empirical proprietary models, field models (e.g. CFD models) and integral models (falling between semi-empirical and field models). Compartment fire modelling looked at two types of code, zone models and field models. At that time, the zone models (typically used for modelling fires within buildings) encountered severe limitations in the modelling of large offshore compartment fires. Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994 to 2001, Phase 2 [1.43], Phase 3a and Phase 3b [1.44] consisted mainly of experiments to define and determine explosion overpressure load characteristics under a range of conditions and to provide a basis against which load simulation software may be validated. However, Phase 2 did produce notable gains in knowledge in the area of unconfined crude oil jet fires and confined jet fires (compartment fires). Two other separate but widely supported JIPs were also conducted around this period which focussed on offshore fire hazards. One studied the effectiveness of water deluge on jet and pool fires and the second JIP studied jet fires involving ‘live’ crude containing dissolved gas and water.

The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and mixtures of stabilised light crude oil with natural gas and the main findings are listed below.

• The free flame releases, of crude oil only, were not able to sustain a stable flame and one of the mixed fuel releases was also unstable.

(6)

• The incident total heat fluxes (radiative and convective) measured on the pipe target were significantly higher for the mixed fuel tests than for the crude oil only tests, by a factor of two in many cases. Typical values were in the range 50 kWm-2_to 400 kWm-2.

Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire scenarios, but no pool-fire scenarios. However it did generate high quality data that were considered suitable for future pool fire model evaluation.

Other valuable work, mostly executed in Norway and following the probabilistic approach, has resulted in the NORSOK guidance documents [1.45, 1.46]. Both references were among the source documents for Part 1 of this Guidance, it can be seen that the guidelines for risk and emergency preparedness will support emergency response for fire hazards as well.

1.2 Objectives

The primary objective of this document is to offer guidance on practices and methodologies which can lead to a reduction in risk to life, the environment and the integrity of offshore facilities exposed to fire hazards.

Risk is defined as the likelihood of a specified undesired event occurring within a specified period or resulting from specified circumstances.

Preventative measures are the most effective means of minimising the probability of an event and its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are central to the approach described in this document both for modifications of existing structures and new designs. This document consolidates the R&D effort from 1988 to the present day, integrates fire type and scenario definition, fire loading and response development and provides a rational design approach to be used as a basis for design of new facilities and the assessment of existing installations.

This Guidance is intended to assist designers and duty holders during the design of, and in making operational modifications to, offshore installations in order to optimise and prioritise expenditure where it has most safety benefit.

An additional intent of this Guidance is to move the decision-making processes within the fire and explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’ as defined in UKOOA’s document on decision-making, the key figure of which is illustrated in Figure 1-1 below [1.47]. Due to the nature in which fire and explosion hazards are closely linked, reference should be made to Part 1 of this guidance when developing concepts and solutions to a “Type A” decision.

(7)

Figure 1-1 The UKOOA decision making framework

The framework in Figure 1-1 defines the weight given to various factors within the decision making process, ranging from those decisions that are dominated by purely engineering matters to those where company and societal values predominate.

A substantial number of installations will lie in Areas A or B of the chart resulting in an approach which involves codes and guidance based on experience and ‘best practice’ (as described in this document) and supplemented by risk based arguments where required.

This Guidance will look to build past experience of the development of fire scenarios and the prediction of design fire load cases and their timelines as part of the “Type A” approach.

1.3 Fire and explosion hazard management

A thorough understanding of all hazards and hazardous events, including fires and explosions, is at the heart of the Safety Management System (SMS) and it should be proactive to reduce risks. A commonly adopted overall process is outlined in the OGP “Guidelines for the Development and Application of Health Safety and Environment Management Systems”. This Guidance adds more detail to this process and applies it to fires and explosions. For these hazardous events the management process is given below:

• identification of the hazardous events (coarse assessment);

• analysis and assessment of the hazardous events (type, areas affected, magnitude of the consequences, duration, likelihood, etc.);

(8)

• specification of the measures adopted; • communication and implementation; • verification;

• documentation.

The hazard management process should be employed in a timely manner and in accordance with the type, severity and likelihood of each hazardous event, that is, it should be a risk-based process. Therefore, in order to obtain most benefit, the hazard management process should start in the feasibility study phase It is essential that all parties who can contribute to the reduction of hazards particularly design engineering disciplines and those who will have to operate and maintain the plant, understand the hazards and are involved during the appropriate stages of the lifecycle.

The lifecycle approach shows how to prepare and implement a strategy for the management of fire and explosion on an offshore installation throughout its life, i.e. from design through commissioning and operations to decommissioning. This is developed firstly by inherently safer design (elimination of hazards), followed by prevention of identified fire and explosion hazardous events and then by the selection of detection, control and mitigation measures. The fire and explosion assessment process is used in the lifecycle to provide information on which to base decisions and the design of systems. Thereafter, it is used to assess these arrangements to make sure that the high level performance standards have been achieved.

The FEHM process can be applied to new or existing installations.

• For new installations it should start during feasibility studies and be fully developed during detail design. The results should then be communicated to personnel operating the installation to ensure that they know the purpose and capability of all the systems, can operate them properly and that adequate maintenance schemes are in place;

• For an existing installation the process should be applied to current arrangements and modifications. These should be assessed to determine if the high level performance standards are achieved and that risks are as low as is reasonably practicable.

The management of hazards to reduce the risks involves many interests which may often appear to conflict with each other. The process is a multi-disciplinary activity, involving all levels of personnel from senior management to junior staff from a number of different organisations. It is important that the input and activities of these personnel are fully coordinated and managed. The SMS of each organisation should identify the relevant roles and responsibilities.

A more comprehensive and homogeneous view of the role of fire and explosion hazard management within the overall Hazard Management System (HMS) can be found in Part 0 of this Guidance, “Part 0 Fire and explosion hazard management”.

More information on specifically the philosophy of fire hazard management can also be found in Section 2 of this Part 2 of the Guidance.

1.4 Overview of the guidance

Generally, the Guidance has been developed to consolidate current best practice in the industry and research community and sets out to present this information in a coherent manner of use to industry practitioners. The collation of existing information and the endeavour to relate the information into the form of “Type A” decisions (see Section 1.2), is intended to assist practitioners by providing a set of “Rules of Thumb” by which to carry out work effectively and quickly.

(9)

Section 2, ‘Fire hazard management philosophy’, describes the steps to be taken and the base information to be considered in understanding fire hazards and outlining some of the key considerations in managing them. This section sets out the principles, the process and the implementation steps required when deciding what has to be done in any particular context and the factors that have to be taken into account. The principles of ‘Inherent Safety’ are presented.

Section 3, ‘Fires on offshore installations' discusses the various scenarios that can occur in hydrocarbon installations and provides assistance on the prevention, control and mitigation measures available to combat them. The appropriate methods of analysis dependent on the expected risk level are introduced. The tasks identified are linked with the relevant phase of a design project or the stage in the life of the installation. This section also gives .particular considerations for particular installations and parts of installations

Section 4, ‘Interaction with explosion hazard management’, identifies situations where fires may precede or follow an explosion and deals with common areas of fire and explosion management, potential conflict between the management of these hazardous events and potential areas of combined analyses.

Section 5, ‘Derivation of fire loadings and heat transfer’ describes how appropriate design thermal and smoke loads are derived. The section discusses eight fire types and the impacts of the associated heat transfer and considers the manner in which loadings are estimated for the purposes of use within a QRA.

Section 6, ‘Response to fires’ discusses the effects of fire and the manner in which structures fail and links these concepts to definitions of acceptance criteria from national and international standards. The section also reviews potential failure definitions and failure modes of process equipment and impact effects on personnel.

Section 7, ‘Detailed design guidance for fire resistance’, brings together the approaches identified in the other sections and incorporates additional design and operations experience to provide guidance on methods of detailed design. The guidance is presented in the context of best practice and identifies other industry initiatives which have generated detailed design and operating practice guidance. The subject area will be revisited in more detail in Part 3 of the guidance.

(10)

2. Fire hazard management philosophy

2.1 Overview

2.1.1 General

In general terms a release of hydrocarbon with immediate ignition will result in a fire; release of an inflammable vapour or gaseous mixture followed by later ignition (i.e. when the cloud of vapour or gas is adequately large) may result in an explosion. Consequently some of the probabilities, causes, methods of prevention and control of releases are identical for both the fire and explosion hazard. Indeed, many of the hazard management principles and practices apply to both hazards. This aspect is explored more in Section 4.

2.1.2 Hazard

philosophy

In this, the second part of the Guidance, goals which should be achieved in designing for and managing the fire hazard are identified. The legislative basis is reviewed and some high level performance standards are given.

The features of an effective Safety Management System (SMS) are identified and the choice and management of detection, control and mitigation systems is discussed. The main characteristics of the fire hazard are also identified. The techniques of inherently safer design described in Section 2.6 are fundamental to the most effective approach to eliminate, prevent and mitigate the fire hazard particularly for new designs.

The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel.

In order to focus effort where it is most needed, a risk screening method is described in Section 2.7.4 which classifies installations and compartments according to the level of their fire risk. The measures for frequency and consequence severity are based on process complexity and the exposure potential for people on board. These measures are combined in a risk matrix to give low, medium and high risk categories. The risk level is an indication of the level of sophistication to be used in the fire assessment process.

Nominal loads for jet and pool fires have been available since the publication of the Interim Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions. A number of alternative values have since been published including nominal fire loads for confined and ventilation controlled fires [2.2, 2.3]. Updated guidance on the selection of fire loads is given in Section 5.4 with recommendations on the limits of applicability.

The overriding requirements for hazard management philosophy are to: • protect personnel in the TR;

• minimise injuries and fatalities from the initial event;

(11)

The philosophy should ensure that:

• the hazard scenarios are addressed;

• suitable accidental loads are developed (either risk based and/or prescriptive);

• plant and equipment minimises escalation, personnel within the TR do not continue to be threatened by the incident, until such time as the hazard has dissipated to a safe level via shutdown, blow down, or other means;

• personnel are able to escape to a safe location away from the hazard.

The identification of key SCE’s and corresponding Performance Standards provide the demonstration that such a philosophy has been met.

2.1.3 Prescriptive vs. Performance based design

Prescriptive design against the fire hazard can be a valid alternative, for example for low risk installations. This method is based on standardized guidance or requirements, without recognition of site-specific factors. The size of the facility, hazards posed or specific water demand is not considered. Prescriptive approaches to fire design generally are a result of compliance with regulations, insurance requirements, industry practices, or company procedures. These are generalized approaches largely based on past incidents.

Performance or scenario based design adopts an objective based approach to provide a desired level of fire and explosion performance. The performance based approach presents a more specific prediction of potential fire hazards for a given system or process. This approach provides solutions based on performance measured against established goals or performance standards rather than on prescriptive requirements with implied goals. Solutions are supported by a Fire Hazard Analysis (FHA) or, in some cases, a fire risk assessment.

2.1.4 Hazard

management

A fire risk assessment takes account of more than just the consequences, and includes the likelihood or frequency of the fire and explosion scenarios occurring. A performance based approach looks at determining the need for fire and explosion design on a holistic basis.

Performance objectives and measures allow the designer of fire systems more flexibility in meeting requirements and can result in significant cost-savings as compared with the prescriptive approach. Conversely, for small projects, the cost of performance based design may not be cost-effective.

In a scenario or performance based approach release scenarios are postulated and their consequences and probabilities of occurrence determined. For existing installations, reliable estimates of fire loads, extents and durations may be available from previous assessments.

The most severe fires from the point of view of initial rate of release may be less frequent and less durable than fires of lesser severity and hence may present a smaller risk. Although the initial extent of the engulfed region may be greater, the lower duration may result in lower quantities of heat being delivered to those equipment items and structural members within the affected region. However, it is important to account for apparently small fires that on initial evaluation do not appear

(12)

• severe, but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities

• small long duration scenarios which still have sufficient size to cause local escalation. • intermediate scenarios which have the greatest potential for escalation or platform impact

whilst lasting long enough to realise this potential.

Design or Dimensioning fire scenarios are selected on the basis of the risk they present and should be accommodated by the safety critical elements (SCEs) of the installation which will include parts of the structure, piping and equipment.

It will be necessary to consider the effect of non-availability of mitigation measures such as shut down, blow down, venting, deluge or barriers in the construction of design scenarios. Some scenarios may also assume a prior explosion has occurred with fire being an escalation event. The identification of the common-cause failure modes that may defeat several mitigation measures should needs to be carried out in a rigorous manner. Multiple or coincidental failures can lead to events moving from Minor or Controllable to Extreme (see Section 2.2.2); for example, fires that disrupt the UPS or auxiliary power supplies or common Installation air supplies.

It is suggested in this guidance, that the number of SCEs which need to be considered in detail is reduced by classification into criticality categories with respect to the fire hazard.

The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage of access ways by radiation or the development of a hot gas layer, smoke and fume generation, structural weakening and possible collapse. Further escalation through subsequent release of inventory may occur.

The consequence measures of relevance to fires are: • intensity, that is heat flux and temperature;

• extent, that is the area or volume occupied by flame, affected by radiation or by combustion products;

• duration;

• frequency, that is the probability of occurrence depending on the probability of immediate or delayed ignition;

• mitigation effectiveness will depend on detection, inventory isolation and deluge activation together with the probabilities that these measures will be initiated;

• radiation thresholds for personnel safety and escape, the integrity of equipment and supporting structure.

Reducing risks to ALARP must be demonstrated in all cases, both through the justification of the choice of design scenarios and from a determination of the impairment frequency of the SCEs under the fire loads.

An acceptable level of risk can be identified within the ALARP framework, which identifies the acceptable frequency of exceedance of the severity of the design or dimensioning scenarios. Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the risk to people on board, the impact on the SCEs and the overall individual risk including that from other hazards.

Following NORSOK [2.4], ISO [2.5] uses a threshold probability of exceedance level (10-4_{per year)} below which individual contributing scenarios may be eliminated from further consideration if the

(13)

impact on personnel is low enough (i.e. numbers of personnel affected). Events with probabilities above this level are considered to be ‘dimensioning’, and require further analysis to determine the size and extent of the resulting loading and subsequent effects.

The UKOOA Part 1 document [2.6] proposes a similar approach, albeit couched in different terms. An (explosion) event will be considered depending on whether the event impinges directly on the Temporary Refuge with probability of exceedance > 10-5_{per year. Events directly affecting other} regions where a barrier may be present to prevent impingement on the TR are considered if the probability of exceedance is greater than 10-4_{per year.}

2.2 Understanding the fire hazard

2.2.1 General

Understanding the risks from fire hazards is the key to their minimisation. This applies at all levels of an organisation from the directors to those designing and operating the facilities. This knowledge should be used to inform people making critical decisions both in design and operation. It should not be acquired after these decisions have been made in order to retrospectively justify them. In other words, the knowledge should be used proactively to reduce risk. The type of understanding differs according to the level of people in the organisation and the responsibilities that they hold.

• Senior Management: They need to know the overall level of risk for the facilities to decide if the design is viable or if existing operations may continue.

• Project or Facilities Management: They need to know the pattern of risk by facility and the proportion of that risk which comes from different hazards such as fire. This will allow them to decide how the facilities are to be designed and operated. It will also allow them to provide sufficient resources.

• Discipline Engineering and the Supervision of Operations: They need an overall understanding of all the hazards for which they have responsibility. The understanding of the causes, severity and consequences will allow them to decide how each of the hazards will be managed and the measures needed to do so.

• Designers, Operators and Technicians: They need to understand the hazard characteristics so that they may design, operate and maintain critical elements to suit the needs of the hazards.

It is essential that the information gained from hazard and risk studies is distilled, documented and communicated so that every level and person is kept informed. It must also be kept up to date. It is a living picture which becomes progressively more detailed and accurate as the design progresses. It also changes throughout the life of the facilities as different activities take place and the fields mature.

2.2.2 Classification

of fire hazards

It may be helpful to classify fire hazards according to their potential for harm. This may be done by assessing what is in place either in a design or an existing facility and determining the classification. It is preferable to actively manage the fire hazards such that steps are taken to actively lower their classification by reducing the severity of the effects. This may be done by following the principles for inherently safer design (see Section 2.6) or by applying or optimising

(14)

• Catastrophic: As the name suggests, these events would overwhelm an installation and it would be impractical to counteract the effects such that the lives of those on board could be saved. This type of event should be designed out or very high integrity preventative measures provided such that the likelihood is minimised.

• Evacuation/Extreme: This type of event would have a major impact upon a large part of the installation such that the effects upon people, both physical and psychological, would be such that evacuation would be necessary. It would also apply to those events where the potential for escalation is widespread including structural, process, safety systems or the impairment of muster and escape routes. Typically these events are those which would give prolonged effects beyond the source module, in particular external flaming and dense smoke effects. In some cases it may be possible to suppress the widespread effects of these fires reducing the categorisation to the lower, controllable, level. If not, the effects must be fully understood and premature catastrophic escalation delayed, and personnel protected from smoke and heat until evacuation has been completed. By their nature these are inherently low frequency events, requiring a significant sized release from a major inventory and/or its combination with safety system failures such as ESD.

• Controllable: These events have the potential for local fatalities and may also be capable of escalation to a scale requiring evacuation. However, the moderate scale of the effects should allow these events to be controlled such that further escalation is prevented and evacuation is not essential to preserve life. Typically, the prolonged effects of these events will be limited to one module or process area and will be of finite duration. They would be associated with smaller releases from moderate inventories. In these cases effective control of the source inventory and the prevention of escalation will be critical. It may be practical to extinguish some of these events but in other cases, this may not be possible or may be dangerous in which case, they should burn out under controlled conditions.

• Minor: These events are of a very small scale. They may cause local injuries but would not have either the scale or duration to cause critical escalation. They may lead to damage to plant causing financial loss but not major loss of life. These events can be managed by limiting the size of the event and allowing it to burn out. Protection would only be needed for asset protection.

2.2.3 Causes and likelihood of hydrocarbon releases

The causes of hydrocarbon releases are numerous and it is essential that a full causation is carried out so that effective preventative measures can be put in place. These causes can generally be broken down into three categories:

• human or procedural error; • plant or equipment failure;

• systemic failure; i.e. inherent weaknesses in the business processes and infrastructure supporting design and operation.

Lack of maintenance, particularly over long periods may distort the understanding of the underlying causes of failures. Effective maintenance regimes are essential to determining the likelihood of plant failures.

The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of the fluids, the number of times containment is deliberately breached or the number of weak points such as flanges or tappings. It is also a function of the understanding of those causes and the effectiveness of measures which are put in place to manage them. Statistical data is a good start point from which to list causes and to determine likelihood. This should then be augmented with the knowledge of engineers, technicians and operators to give a more accurate picture for each

(15)

facility. HAZOP procedures will give a rigorous identification of process causes but the overall examination should be sufficiently broad to address external and human effects. This examination should be fully documented so that there can be assurances that preventative measures are suitable and sufficient.

For statistical data, the most frequent sources of the hazard as given by the history of releases experienced to date are documented as follows.

The HSE document OTO 2001 055 [2.7 states that for the UK sector of the North Sea: 61 % of all releases are from pipework systems

11 % of all releases are from small bore piping 15 % of all releases are from flanges

14 % of all releases are from seals and packing Of the causes;

11 % are due to incorrect installation

26 % from degradation of materials (excluding corrosion and erosion) 11 % of all releases are due to vibration/fatigue

19 % of all releases are due to corrosion and erosion

It is considered that 40 % of equipment related releases are attributable to poor design and 38 % to inadequate inspection and condition monitoring.

Avoidance of potential leak sources in design therefore needs to consider these above issues in particular. The importance of operational aspects is also shown in proportion of leaks attributable to poor inspection and monitoring.

Sources of release data include WOAD [2.8], OREDA [2.9] release statistics published annually by the HSE [2.10] and the HSE/UKOOA publication on the subject [2.11]. The Minerals Management Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico [2.12]

2.2.4 Ignition causes and probability

The probability of ignition will depend upon the following factors.

• The rate and duration of the release and the size of the consequent gas cloud • The location of the release

• The type of fuel and the proportion of gas or volatile vapours which is generated in the short term

• The nature of the release; whether high or lower pressure. The turbulence caused by high pressure gas releases will cause effective mixing with the air to give a well defined

(16)

• The flammability characteristics of the gases and vapours. Each different gas or vapour has a specific flammability range, from a lower flammability limit; through stoichiometric and rising to a higher limit above which ignition should not occur. Very large releases may have a non flammable rich core but will be surrounded by a flammable region which may engulf ignition sources as it spreads away from the point of release. Each gas or vapour will also have a specific auto ignition temperature ranging from 200 – 550 °C. such that contact with hot surfaces such as an exhaust turbocharger would cause ignition

• The dispersion characteristics; whether there are heavy vapours which will descend or lighter gases which should rise.

• The confinement of the escaping vapours and gases by floors, ceilings or walls. These may also cause flammable gases to be directed towards areas without flameproof equipment • The ventilation characteristics in the areas, whether forced or natural and the variation of

those characteristics with wind strength and direction

• The characteristics of the fluid and its release, where this might build up static

• The presence of sulphurous impurities in the fluids which might lead to the formation of pyrophoric scale

• The number of fixed ignition sources and the standard of their maintenance, if designed for use in flammable atmospheres, including the presence or not of Ex equipment.

• The proximity of the release to areas which are classified as “safe” and therefore are not fitted with flameproof equipment.

• The gas detection philosophy and the local and wider shutdown of ignition sources upon detection

• The detection of gas ingress at the air intakes to enclosures such as accommodation or equipment rooms and the closure of dampers.

• The hot work philosophy on the facility, the number of these activities and the effectiveness of their control.

• The possibility of ignition being caused by the action of personnel carrying out emergency response actions such as plant shutdown causing sparks at electrical breakers.

Ignition probabilities have been widely studied and this work is summarised in recent work for UKOOA studying ignition probabilities [2.13]. The probability of ignition should be determined using that guidance together with an assessment of the characteristics listed above. As with the likelihood of release, it is possible to influence the probability of ignition by design, good maintenance and operational controls.

2.2.5 Fire hazards: Understanding the source

2.2.5.1 General

It is essential that the source of the hydrocarbons is examined and fully understood in order to examine the fire hazard effects resulting from a release.

Key parameters would include the range of release rates and characteristics which can originate from any part of the plant. Each parameter would be associated with a failure causing a specific hole size. The release rate would then vary with time depending upon the source conditions of fluid, pressure, inventory, location within the hydrocarbon system and the functional characteristics

(17)

(or the failure) of control systems such as ESD, depressurisation, and drainage. A detailed picture of the source terms from each inventory will allow the identification of the cases requiring analysis of the fire characteristics. If hazards are being classified as described above, it will give an initial indication which hazards fall into each category. It would show for example the process events which simply do not have sufficient inventory to realistically cause escalation, those which should be controllable and the events which require evacuation. For individual hazardous inventories, it would show the approximate conditions of hole size and control system operation which would determine whether it was controllable or require evacuation.

2.2.5.2 Reservoir hazards

Direct releases from the reservoir may occur due to well intervention such as drilling or workover. In these cases the releases are likely to occur within the drilling facilities; typically at the bell nipple. These are likely to be of indefinite duration if the primary well control and blowout prevention systems have failed. Such releases may also contain drilling fluids, cuttings and other debris. In the case of blowouts from an oil reservoir with delayed ignition, the oil may build up over much of the top deck leading to a particularly hazardous and unpredictable situation when it ignites. Reservoir and drilling engineers should be consulted to identify the fluid composition and calculate the realistic flow rates. In most cases, the releases should be near the top of the platform with the flames rising above it. This will lead to rapid collapse of the derrick and severe radiation onto the top deck. It the release is below the drilling rig structure, this may collapse onto the wells leading to progressive escalation. A shallow gas blowout is another case in which a pocket of shallow gas is controlled by venting through a diverter. Diverters can fail due to erosion giving a large gas release of prolonged but finite duration within or below the drilling facilities with possible escalation as described above. Again drilling and reservoir engineers should be consulted to determine the possible flowrates and their likelihood.

Large continuous releases from the Christmas Trees are much less likely due to the multiple valve isolation. They may occur during wire lining but only if there are multiple failures of the barriers. A more realistic scenario is a release from the lubricator via leakage through the valves and wireline BOP. In gas-lifted wells, it is possible that the gas within the annulus could backflow into the wellbay with typical inventories and pressures of up to 10 tonnes and up to 130 bar. The potential for escalation to other wells should be examined but is unlikely if they are fitted with effective downhole isolation or have a heavy-duty integrated Christmas Tree valve assembly. Flowline releases are considered to be part of the process hazards as they are downstream of the well isolation valves.

Completion failures may result in leakage from the reservoir into the well annuli or around the cement such that oil or gas may surface round the outside of the well at the seabed. This may arise during the initial completion of the well. It may also arise in later life due to seismic action or the deterioration of the well bore, for example by corrosion. Well completion engineers should be consulted about the possibility of this occurrence, the potential flow rates and the locations at which hydrocarbons may be released. The effects of fires on or under the sea are discussed in Sections 5.2.5 and 5.2.6

2.2.5.3 Process hazards

The process plant can have up to 40 sections which are segregated by ESD valves. Each of these is a source with individual characteristics of the fluids, pressures and volumes. Typically, the processing will include;

(18)

• Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the wells via the flowlines, mix the fluids and direct them to the appropriate separators. They contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and other materials such as sand. The inventory will be based on the combined volumes of these pipes. It will range from less than 500 kg in a mature, low pressure gas field up to 5 tonnes of oil for a new field. In oil facilities running at low pressures or using gas lift, the fluid can be three phase with a relatively low density. It may also have a high water cut giving small inventories which may not have the potential for escalation if rapidly isolated. The process conditions, aggressive nature of the fluids and the complexity of the piping give a relatively high probability of a release, particularly large bore flowline failures which may be caused by corrosion or erosion. Potential process backflows of gas and 2-phase fluids from the gas lift inventories into topside blowdown systems also needs to be addressed when analysing topside hazards.

• Water, gas and oil/condensate separation: This takes place in large vessels, generally over 2 – 3 stages. The liquids have a 3 – 10 minute residence time. Typically, these vessels have total volumes up to 100 m3 and operate at pressures from 70 down to 3 bar. The flammable liquid inventories can be up to 30 tonnes but this may be divided in half by weirs which can reduce the amount which can realistically be released by half. There are relatively few release points providing that there is effective isolation at the outlet. Typically these are tappings for instruments and the possibility of corrosion in the body or welds of the separator vessel. These liquid inventories have the potential to overwhelm a moderate sized platform with a large fire lasting long enough to cause major escalation, particularly if the separators are located lower down in the topsides. They may have less of an impact if located on an open deck such as an F(P)SO as the smoke and flames can freely rise above the rest of the facility. The potential for harm is governed by the release pressure; see below under liquid fires. If these vessels are depressurised, the fires become much more controllable and the time to depressurise is critical. If they can brought below this pressure before escalation can occur or evacuation is required, this may reduce the classification of these hazards to the controllable level, at least for moderate sized holes. The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a very high pressure vessel with high molecular weight gas. Typically it will be in the 1000 – 2000 kg range. However this may be doubled by additional gas released from the liquids as the vessel depressurises. This inventory has the potential to cause local escalation but is unlikely to overwhelm a medium sized facility. Its potential for harm may be minimised by depressurisation.

• Stabilisation and final dewatering: Some oil production platforms have a final stage of stabilisation or dewatering. These require large vessels which are filled with virtually stable oil plus a small quantity of water in the bottom. They operate at 2 – 6 bar and can contain up to 200 tonnes of oil. These lower pressures would result in a pool fire which would only be a threat to the platform if there were no arrangements to bund the release, minimising the size of the fire and further arrangements dispose of the oil and firewater.

• Oil/condensate pressurisation for export: Export pump arrangements may use one or two pumps in series. These pumps are usually duplicated with manifold arrangements. These complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with large throughput. The most likely releases are at the pumps themselves but the study of available inventory should carefully examine how much could realistically be released, taking into account the operating philosophy standby arrangements for off line pumps and the provision of valves and check valves. The pump pressures will range from 40 – 120 bar depending upon the pressures within the pipeline infrastructures. Transfer pumps to export tankers will run at much lower pressures. These pressures will drop to the vapour pressure of the oil on shutdown, giving a continuous rate of release until the available inventory is exhausted. The pump seals and the complex jointed piping leak to a high likelihood of a release. The inherent design of the plant requires the pumps to be located close to the lowest level of the platform, often beneath the separators. This will lead to a low level

(19)

source with the potential for low level external flaming, smoke affecting most of the topsides and escalation to the inventories above. Shutdown of the pumps and careful management of the inventory which can be released will help to reduce the impact but it may still require evacuation in some cases.

• Gas compression including gas liquids condensing and knockout. Gas from the various stages of separation is progressively compressed and cooled allowing liquids such as ethane, propane, butane and water to be condensed and returned to the liquids system. Typically several compressors will be required with the final discharge pressures of 50 – 60 bar. It is likely that the compressor sections and their associated condensers and knockout pots will be sectionalised with ESD valves. This reduces the gas inventories to 1000 – 2000 kg. As with separation, this has limited potential for local escalation and this can be minimised with depressurisation. The major risk is that to personnel in the immediate area from flash fires or from explosions if the area is congested. There is a moderately high possibility of a gas leak arising from the compressors and associated vibration.

The liquids which are condensed and collected in the gas knockout pots may be either liquefied gases or water. The gas-liquid inventories should be less than 2 tonnes and in many cases, just a few hundred kg. Only the larger inventories will have the potential for escalation. However, there is a major exposure to flash fires or explosions as these liquids are very reactive, will have a high release rate and the vapours may not disperse easily. The likelihood of release should be low as there are few release points in the liquid sections of these process plants.

• Gas drying: This will use either glycol units or molecular sieves and can operate at up to 60 bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this has a limited potential for local escalation and can be minimised using depressurisation. • High pressure export, gas lift and reinjection compression: A typical pressure for these

systems is 150 bar. However it can be as high as 400 bar for some reinjection requirements. Again, the inventories will be moderate; typically 1 – 3 tonnes with the potential for local escalation. However, the high pressures can give high release rates from moderate hole sizes, increasing the risks from flash fires and explosions.

• Oil and gas metering: Metering is generally carried out using inline flowmeters. From a hazard’s point of view, they are equivalent to piping with additional potential release sites at the instruments. The hazards are similar to the export pumping and compression respectively and may be part of the same inventory.

Identification of the inventory of each process section should be carried out to determine the conditions and inventory during operation and immediately after shutdown. The behaviour of each section should be modelled using simple calculations to determine the gas and liquid release characteristics from a range of hole sizes. The intent is to build up a picture of the types of events that can occur in each part of the platform. These scenarios and associated hole sizes should reflect the failures which have been identified during the causation analysis. They should be sufficiently varied to cover the following; those large but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities; those small long duration cases which still have sufficient size to cause local escalation; and those intermediate cases which have the greatest potential for escalation or platform impact whilst still lasting long enough to realise these effects – typically a 10 minute duration.

(20)

• Immediately under the platform;

• Closer to sea level where they may be exposed to ship damage or chafing and corrosion; • Sub sea or at the sea bed where it may be subject to internal corrosion.

The location will affect the release characteristics and the ignition probability. Release rates from these pipelines may initially be modelled using simple calculations [2.14], the Sintef and Scandpower fire calculations for the process industry or using more sophisticated methods. They should be based upon the hole sizes which could realistically occur as identified in the causation analysis. The modelling should cover cases with and without the operation of subsea isolation valves or confirm where these are fitted or considered. They should take into account time delays in the operation of ESD valves and their operability with a high differential pressure following a major riser failure. Data such as valve closure times and internal leak rates should be derived from platform specific datasets. Information from incoming ESD valve trips, routine tests and maintenance will give a more accurate picture of equipment performance than generic information from generally available databases. ESD valves would not respond quickly enough to prevent the immediate fatalities rising from a major gas riser failure unless there was delayed ignition. The characteristics of pipeline releases from two phase fluids or liquids with dissolved gases should take into account the variation in release characteristics caused by; gas and liquids separation, slug flow, the elevation of the release point relative to the main inventory on the sea bed, and effervescence as gas separates carrying with it liquids in aerosol form. In some cases such as subsea releases, the fires may burn on the sea surface, see Section 5.2.6.

2.2.6 Types of fire hazard: - Liquids

Liquid fires generally have a greater potential for harm than gas fires for the following reasons: • They have greater isolated process inventories arising from the higher densities of between

600 and 850 kg/m3. Typically these can be up to 20-30 tonnes in separators.

• The release rates will be much greater than gases for the same hole sizes and pressures. • The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids,

particularly with dissolved gas can give the same or greater radiative heat flux.

• A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and this has the potential to completely engulf a medium sized process module and cause some external flaming. A 20 tonne inventory would sustain this fire for 30 minutes assuming a constant release rate.

• This confinement with a roof and/or walls will also cause high radiative heat fluxes, even with pool fires.

• Liquid fires can also be the source of overwhelming quantities of smoke.

• Liquids tend to be located at the lower levels of a platform which causes the fire source to have a greater impact on the facility, engulfing the levels above and to the sides in flames and smoke and also leading to the exposure of structures, people and plant above it. • Liquid releases can be difficult to detect if there is only a small gas content and this can

lead to a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This can exacerbate the effects by increasing the total fuel quantity, the initial fire size and its spread into more vulnerable locations.

(21)

• The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards should be considered carefully to avoid over-conservatism in the fire risk analysis. For example, some researchers consider that water cuts above 60% make the oil very difficult to ignite.

These potential effects can give liquids the potential to overwhelm a platform giving many cases which could be classified as evacuation/extreme, even with moderate pressures and hole sizes on a poorly laid out facility.

The fire characteristics will vary according to the release pressures and the fuel type. Most oil is only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also be pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised gases above the liquid as in separators; or through pumping. The pressure will determine the release rate and the management of that pressure after the fire is detected is a key component of managing these hazards. This may be achieved by isolating the pumps or by depressurisation. The release rate is proportional to the square root of the pressure and will reduce as these actions come into effect. Equations for calculating release rates are given in the Handbook for Fire Calculations and risk assessment in the process industry, by Sintef and Scandpower [2.16], reference should also be made to the Phase 2 Blast and Fire Engineering for Topside Structures [2.17]. The pressure will also determine how the liquid will burn, for example, as a spray or a pool. The heat fluxes will drop with the pressures and this allows deluge systems to become more effective both in protecting exposed plant and in suppressing the fire itself. This is discussed in Section 7. Lighter liquids such as condensate will have lower transition pressure. Gas liquids; ethane, propane and butane will be pressurised and it is unlikely that their operating temperatures will ever be low enough to allow them to burn as a pool. They are only likely to be found in moderate quantities of 1 – 2 tonnes within the gas compression and drying facilities. An additional issue to be considered is the potential escalating effect of flaming “rain out”; this can occur at ambient temperatures, especially with butane (also propane) and especially for the scenario of jet flame impingement on an obstruction, Section .2.2.7 discusses further detail of jet fires.

2.2.7 Types of fire hazard: Gas jet fires

Gases will give rise to an intense jet flame with high localised convective and radiative heat fluxes. The radiative content will increase both with the molecular weight and as the jet encounters obstructions. They are generally not large enough or sustained by a sufficiently large inventory to be significantly affected by confinement within a roofed module except where they directly impact the ceilings or walls. This makes their potential for escalation highly directional and this is likely only to affect a small number of critical items such as a single structural member, part of a vessel or some piping. Only very large inventories would have the potential for more widespread simultaneous failure. These large inventories require both high pressures and large volumes within the process plant or an isolation failure to a primary source such as a riser or well. Gas jets have moderate release rates unless there are very large hole sizes and/or high pressures. A 20 mm hole at 20 barg would give a methane jet of approximately 10 – 12 m and a flame volume of 100 m3_. With a source of 40 m3_{in volume, typical of the gas content in a separator, this would reduce to a} jet of 7-8m and a flame volume of 25 m3_{within 10 minutes of the ESD operating. If the separator} was depressurised, this would decay even faster but this may be offset by the disassociation of dissolved gas in the oil.

2.2.8 Types of fire hazard: Confinement and ventilation control

(22)

gas build-up and explosion overpressures respectively. The air input rate through a single opening in a wall is calculated using the formula M_a = ½A √H where M_a is the air input rate in kg/sec, A is the area of the opening in m2_{and H is the height of the opening in m. With openings in the floors} and ceilings or multiple openings in the walls of different heights, this becomes a complex calculation. Typically the fuel burn rate that can be sustained by a module with one open wall of 30m by 8m is 21kg s-1_{. It is unlikely that severe ventilation limitation will occur unless there is a} very high release rate and this is sustained for several minutes. If it does occur it is likely to involve a major liquid inventory rather than gas fires. If the ventilation is severely limited, then the combustion characteristics within the modules will be affected with reduction in heat fluxes, reduced liquid vaporisation rates, combustion instability, very dense smoke with high concentrations of carbon monoxide. Unburnt vapours may also burn as they leave the module giving the external flaming described below. It can take a few minutes before the fire becomes ventilation controlled as the air inside is used up.

It is more likely that a large fire will not be ventilation controlled but that its size will simply exceed that of the module. Once the flame volume reaches 1/₃ of the free volume in a module (i.e. that volume up to the top of the highest opening and excluding the volume in between the ceiling beams), then the flames will spread across the ceiling and begin to extend beyond the module. In the initial stages of these fires, the flames build up across the ceilings with a hot flame layer slowly descending across the whole module. This is the neutral plane at which air entering the module mixes with the vapours. This can descend to 2_/

3 of the way down the openings in the walls with significant flame velocities as they travel towards the openings. These areas will have high radiative and moderately high convective heat fluxes. These will be highest near to or above the source of the fire but will provide a relatively uniform heating of all structures, piping and upper parts of vessels above the neutral plane. This is likely to lead to multiple failure of this equipment. These high fluxes will occur both with pool and spray fires but gas jets are less likely to develop this module engulfment for the reasons described above. The area between the ceiling beams becomes stagnant with high radiative but lower convective heat fluxes.

It either the fire is ventilation controlled or the fire size reaches that described above, then external flaming will occur. With large external flame volumes the width of the base of the flame can be much wider than the opening. If it originates from the lower modules, it can engulf the whole side of the platform with wind causing it to tilt, possibly towards the accommodation or TR. This effect is graphically illustrated in Ref Piper Alpha Inquiry Report part 2 plates14b through to 18a [2.18]. This will have a major impact upon the whole installation and it is likely to require evacuation if it is sustained for more than a few minutes. There is only limited understanding of this external flaming and there are few if any predictive tools to quantify it accurately. Its characteristics may be similar to a large pool fire, with the flames subject to tilt in high winds [2.16].

2.2.9 Fires on the sea

Fires on the sea will be affected by a number of factors; the fuel, release characteristics, release rate, the sea and weather conditions. It requires a fairly large release and benign sea and weather conditions before the fire has a major impact on the facility. This could lead to structural or riser failure, smoke engulfment of the topsides or the impairment of evacuation. All of the contributing factors must be examined to determine the risk of failures and benign conditions occurring simultaneously. This may be very low in the North Sea but not in other parts of the world.

Some development information was prepared in 1992 for the HSE and amongst the treatment of other fire types; a review of pool fires on liquid was undertaken [2.19].

2.2.10 Consequences

This guidance will generally consider both consequences and impacts, where;

Consequences are the outcome of an accident expressed in physical phenomena such as gas concentration, thermal radiation level, explosion overpressure, and impacts are the effect of

(23)

accidents on people, structures and equipment. They are undoubtedly linked and the terms may be occasionally interchangeable.

Fires may result in any of the following consequences and impacts:

• Direct injury or loss of life to personnel exposed to the immediate effects of fire, particularly flash fire effects;

• The impairment of the ability of people to make rational decisions and to preserve their own lives, either through the effects of smoke or the psychological effects of the incident;

• Impairment of escape routes and entrapment of personnel so that they cannot return to a refuge;

• Impairment of the accommodation or temporary refuge; • Impairment of critical control and communication centres;

• Impairment of evacuation routes and means of evacuation or escape from the platform; • Further escalation through the failure of process plant, well containment or risers;

• Catastrophic rupture of pressure vessels or containers, both containing flammable and non flammable fluids;

• The release of toxic materials and the generation of toxic fumes through their combustion; • The loss of critical safety and communication systems;

• Weakening of the primary structure leading to progressive structural collapse;

• Weakening of secondary structures leading to any of the hardware failures listed above; The probability and timing of these failures is dependent upon the following:

• The intensity of the exposure. Greater heat fluxes or more dense smoke concentrations will lead to more rapid failures;

• The degree of exposure: Localised exposure rather than complete engulfment will reduce the probability and increase the time to failure. The time dependent size of fires such as decaying gas jets should be taken into account when making this assessment;

• The duration of the exposure;

• The inherent mass, strength and stresses on exposed plant;

• The presence of any protection or insulation which could realistically reduce the rate of heat transfer;

(24)

based on platform specific parameters not generic fire scenarios with particular attention paid to the uncertainty surrounding two-phase releases.

The events chosen for analysis should reflect the installation’s design features as much as possible and encompass the following cases

• Those with the greatest potential for escalation; i.e. the largest events with sufficient duration to cause failure

• Those events which could realistically occur; i.e. those with clearly identified causes giving failures of an identified maximum size; e.g. the largest tapping size or the dimensions of typical corrosion failures

• Those events of a critical duration such as the time to cause evacuation

• The characteristics of the events whenever critical control systems such as ESD fail to operate

The examination of these hazards should be used to build up a complete picture of all of the hazards; their causes and probability, the range of sizes, location and duration, the possible rates and timings to escalation and the effects when such escalation does occur. This should be documented so that everyone with a part to play in their management can see the whole picture. Once it is in place, the effectiveness of systems to counteract the effects can be assessed and the future management of these hazards can be planned as described in Section 2.4.3. The analysis is a living process and should be capable of future use to examine different cases or the optimisation of control systems such as depressurisation both during design and operation.

2.3 Hazard management principles

• Management responsibilities need to be accurately defined and clear boundaries for roles and responsibilities set out.

• All fire hazards shall be identified, analysed and understood by everyone with a part to play in their management.

• Every opportunity to minimise fire risks at source shall be identified, considered and where practicable, implemented. This shall cover minimising the likelihood, severity and the exposure of people and plant.

• A practical strategy to manage each of the hazards shall be identified, documented and implemented.

• An appropriate combination of prevention, detection, control and mitigation measures shall be put in place to implement the chosen strategies.

• A strategy should take account of sensitivity of the installation’s overall risk profile to fire hazards and should weight the mitigation and control measures accordingly.

• All of these measures, including people, processes and plant shall be documented, have clear ownership and shall have minimum performance standards

• All causes shall be identified, understood and sufficient effective prevention measures shall be implemented. Where the effects of failure could require evacuation of overwhelm the installation, these measures shall be specifically identified and shall be of high integrity.

(25)

• The operating limits for the whole facility shall be identified and clear instructions as to the continued operation of the facility or use of additional controls whenever they are exceeded.

• The systems provided to detect fires shall be suitable for the hazard types and the environmental conditions. They shall provide sufficient information to warn personnel and to allow an assessment of the hazards to be undertaken without hazardous personnel exposure.

• There shall be effective isolation of all major external sources of hydrocarbons including pipelines and the reservoir. This isolation shall be designed to survive all reasonably foreseeable fire hazards on the facility.

• The characteristics of those hazards which may require evacuation shall be carefully studied so that the severity and potential for escalation may be reduced, thereby minimising the need to evacuate.

• Personnel shall be located so that their exposure to fire hazards is minimised

• The systems provided to protect personnel, plant, structures and safety system shall be suitable for the fire hazard effects.

• Areas required to shelter personnel from fire effects and their supports shall remain viable until either the incidents have been brought under control or full controlled evacuation has taken place.

• A minimum provision of routes, systems and arrangements to allow evacuation shall remain viable under the effects of every incident which may require them

• All reasonably practical steps to reduce the risks from fires shall be taken, concentrating first on prevention and thereafter in descending order on control, the prevention of escalation and evacuation.

2.4 Hazard management systems

2.4.1 General

A structured approach to the management of fire hazards shall be put in place by all organisations responsible for the design or operation of offshore facilities. This shall ensure that the principles outlined in Section 2.3. are implemented throughout the lifecycle. It shall fit within the overall safety management system for that company and shall show the company safety policy is to be implemented.

The management of fire hazards is a complex process: It requires contributions from a very wide range of people, plant and processes. These may be required to prevent, detect control, protect or evacuate. It is not acceptable simply to manage each one in isolation to default standards and to presume that this will give an effective hazard management system. It in necessary to have a fully integrated process that ensures that all hazards have the necessary components in place and that they all work together effectively.