Fire Safety Journal 58 (2013) 160–169

Contents lists available at SciVerse ScienceDirect

Fire Safety Journal

journal homepage: www.elsevier.com/locate/firesaf

A risk-based method for determining passive fire protection adequacy

Arshad Ahmad n, Siti Ayesah Hassan, Adnan Ripin, Mohamad W. Ali, Saharudin Haron
Institute of Hydrogen Economy, Faculty of Chemical Engineering, Universiti Teknologi Malaysia, 81310 Johor Bahru, Malaysia

a r t i c l e i n f o a b s t r a c t

Article history: A risk-based approach to determine the adequacy of designed safety barriers in process plants is
Received 11 May 2012 proposed and implemented to an offshore gas production platform. The scheme employs quantitative
Received in revised form risk assessment method to assess the impact of selected process hazards and the adequateness of safety
18 October 2012
barriers based on a selected ALARP threshold value. The results obtained are further verified using
Accepted 20 January 2013
emergency evacuation response analysis. Evaluations carried out on the designed fire/blastwalls for the
selected case study confirmed the suitability of the proposed method.
Keywords: & 2013 Elsevier Ltd. All rights reserved.
Risk-based design
Passive fire protection
QRA
Emergency evacuation time
Offshore platform

1. Introduction
Firewall and blastwall are examples of important layers of
protection in offshore facilities that must be made adequate to
satisfy the robust design requirement. This is important because
hydrocarbon fires can elevate the temperature of unprotected
loaded steel structures to 1100 1C within minutes, leading to
structural collapse due to loss of strength. In addition to direct
damages such as injuries, fatalities and asset losses, accidents
escalation into severe scenarios can have more detrimental effects
[1,2]. Typically, fire resistance can be established by adding fire/
blastwall with suitable insulation materials or coatings on struc-
ture surfaces to reduce the rate of heat transfer to steel surfaces
and minimize flame propagation [3].
As part of the safety best practices, API RP 14J recommended
that a firewall or adequate space should be considered to separate
living quarters from areas containing hydrocarbon sources and if
high risk process spaces are confined, blast protection should be
considered. However due to limitations such as availability of
materials according to the desired specifications as well as time
and budget constraints, direct application of the worst case
scenario requirement is often found to be impracticable to the
overall cost benefit, and some forms of risk assessment are
required. Owing to this need, various risk assessment methodol-
ogies have been used throughout the planning and design period
[4,5] assisted by commercial software [6].
While a full blown QRA provides all the necessary insights
required to guide the design, the level of details needed for a QRA is
often not available until the project is well into the detailed design
phase. This entailed simplified and less complex methods so that
safety concerns can be identified earlier and embedded inherently
throughout the project phases. Krueger and Smith [7] proposed a
simplified scenario-based methodology for fire risk analysis that
can be applied early in the design cycle, but their analysis is only
useful for preliminary purposes. Shetty et al. [8] described a
scheme that integrates the structural reliability analysis with
QRA. In this work, models and tools on fire and blast loading are
presented and method for estimation of failure frequencies of
components and systems for which historical data are not available
is proposed. More detailed analyses using finite elements for
structural analysis [9], and CFD to study impact of fire and
explosions [10–12] on offshore facilities have also been reported,
but the approach is far too demanding for smaller projects.
More recently, a seven step risk-based method to allow a more
detailed identification of the reference accident scenarios considered
for the identification of fire protection zones has been proposed [13].
However, while their conclusion was positive for on-shore facilities,
the application to offshore structures with limited space availability
is still uncertain. The aim of this paper is to provide a methodology
for making a quick judgment required especially for fast track
projects. The approach of Dey [14] is adopted with modifications
to accommodate the needs of offshore facility as opposed to the
nuclear industry. The methodology is demonstrated using a case
study involving an offshore gas platform.
2. Framework of coarse risk-based method

n
Corresponding author. Tel.: þ607 5535610; fax: þ607 5588166. The proposed framework applies QRA concept to provide
E-mail address: arshad@cheme.utm.my (A. Ahmad). analysis-matching-the-needs requirement for fast-track projects.

0379-7112/$ - see front matter & 2013 Elsevier Ltd. All rights reserved.
http://dx.doi.org/10.1016/j.firesaf.2013.01.020
 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169
Fig. 1. Study methodology (Reproduced from [15]).
The method demonstrates the use of ALARP region as one of the
design decision tools in evaluating the safety layer proposed. The
framework is as summarized in Fig. 1. The steps include [15]:
 System definition with regards to fire and explosion credible
hazards on the installation that may be capable of threatening
life or platform integrity;
 Identification of areas and isolatable segments of hydro-
carbon inventory in process piping and equipments, i.e. iso-
lated inventories between the Emergency Shutdown Valves
(ESDVs);
 Release or discharge calculation according to probable leak
sizes (categorized into ‘Small’, ‘Medium’ and ‘Large’);
 Frequency assessment to estimate the initial frequency (i.e.,
hydrocarbon leak/release frequency), which will be used as
key inputs to Event Tree Analysis (ETA);
 Consequence modeling to analyze fire and explosion impacts
on topsides and riser/pipeline;
 Carry out fire and explosion probabilistic analysis and Event
Tree Analysis (ETA);
 Carry out probabilistic impairment assessment against fire
and blast rating (i.e. J15, H60 and 0.4 barg) using second level
of Event Tree Analysis (ETA); and
 Results and recommendations of the analysis suggesting
alternative approach of analysis.
The results of the analyses are further verified using the Escape
and Evacuation Response (EER) methodology. The indicator, the
EER time is defined as the required travel time from the working
area to a ‘safe place’ during major accident event.
3. Case study: offshore gas platform
The objective of the case study is to demonstrate the use of the
proposed framework in a real case situation. As an example, the
adequacy of a proposed fire/blastwall in an offshore gas produc-
tion platform is investigated. The platform is located in a gas field
with 60 m water depth, and is meant to export gas and con-
densate to an onshore reception facility located more than
100 km away. The platform is equipped with living quarters and
161
fitted with process facilities and utilities system. The processing
units include:
 Separation system;
 Gas compression system;
 Fiscal metering facility for sales gas and condensate;
 Pig launcher;
 Condensate export pumps;
 Fuel gas treatment system;
 Seal gas system;
 Flare system; and
 Diesel storage and distribution system.
3.1. Basis of fire/blastwall impairment criteria
The following impairment criteria of fire/blast are laid for the
analyses:
 Fire wall (J15 and H60 rated)
1) Criterion ‘‘FW1’’: The wall is impinged by jet fire for
continuous 15 min; or the wall is exposed to pool fire
continuously for 60 min;
2) Criterion ‘‘FW2’’: The impairment frequency of the firewall
(i.e. the total escalation frequencies of the fire events that
can impinge onto the firewall) is not exceeding 1  10  4
per year [16].
 Fire/blast wall (J15, H60 and 0.4 barg explosion rated)
1) Criterion ‘‘FBW1’’: The wall is impinged by jet fire for
continuous 15 min; and the wall is exposed to pool fire
for continuous 60 min; and the wall is exposed to an
explosion overpressure of more than 0.4 barg;
2) Criterion ‘‘FBW2’’: The impairment frequency of the
fire and blastwall (i.e. the total escalation frequencies of
the fire and explosion events that can impinge or expose
onto the fire and blastwall) is not exceeding 1  10  4 per
year [16].
162 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169
Table 1
Release hole sizes.
Release type Hole sizes (mm) Representative hole sizes (mm)
Process equipment
Small 3–10 10
Medium 10–50 30
Large 50–150 100
Riser/pipelines
Small 0–20 10
Medium 20–80 50
Large 480 350
The acceptance criterion of the fire wall and blast wall is either
Criterion 1 or Criterion 2 is met, which in turn, concludes the fire
rating and blast rating on the fire wall and blast wall as adequate.
3.2. Accidental event process releases
The statistic report published by UK HSE [17] gives distribu-
tion for 7 hole size groups (i.e. o10 mm, 10 o25 mm,
25o50 mm, 50 o75 mm, 75o100 mm, Z100 mm and ‘‘Not
Applicable’’), while CMPT [15] suggests that the typical hole sizes
are approximately 5 mm, 25 mm and 100 mm for small, medium
and large releases respectively. For the analysis to be conserva-
tive, calculation for process accidental releases is performed using
the representative hole sizes listed in Table 1. In determining the
volume and duration of hydrocarbon releases from isolatable
segments, Emergency Shut Down Valve (ESDV) closure time is
incorporated.
3.2.1. Release duration
During an accidental release of a leak scenario, pressure inside
the vessel or segment is anticipated to reduce with time. Hence,
the release of hydrocarbons is modeled as a time-varying dis-
charge taking into consideration pressure drops and the effect of
blowdown. In order to accurately calculate the release duration
that can give significant impact to personnel, releases below
2 barg are neglected. The limit of 2 barg is selected in line with
relief valve back-pressure nominal setting based on API RP 520.
3.2.2. ESDV closure time
It is assumed that the ESDV’s in process lines will close (i.e.
isolation successful) and isolate the hydrocarbon event inventory
on confirmed fire or gas detection. The time required for any
safety device to affect component or platform shutdown should
not exceed 45 sec. Whenever, ESDV is activated, process inputs
are shut-off at the primary source (wells, pump, compressor, etc).
This would be repeated for each component back through the
process until the primary source is shut in, i.e. via a cascading
flow [18]. In practise, actual timings are expected to be quicker.
3.2.3. Release calculations
Most of potential jet fire releases in the category of ‘Small’
leaks could result in hydrocarbon discharge at t ¼15 min, while
the ‘Large’ releases at t ¼15 min only lead to ‘Flare’ and ‘Riser’
segments. For the liquid segment, the discharge pressure of the
aerosol is according to pumping pressure until the last drop of
liquid, as such, there would be no difference in discharge condi-
tions at 15 or 60 min.
The size of explosion corresponds to the congestion varies to
the leak module. The volume discharge is taken to be instanta-
neous at ‘delayed’ scenarios. This is defined as ‘Used of Flammable
Mass’, i.e. mass the will be burned out between UFL and LFL.
3.3. Consequence assessment
3.3.1. Assumptions
The potential accidental scenarios included in the assessment
are jet fire, pool fire and vapor cloud explosion. Since Closed/Open
Drain System has minimal hydrocarbon inventories compared to
large vessels such as separators and fuel gas scrubbers during
normal operations, it is not assessed in this study. The flare
system is included since it is normally filled up with large amount
of hydrocarbon in the event of upset or emergency depressuriza-
tion condition, but is limited to the section from the flare KO
drum to the flare tip. All drain and vent piping from the process
areas are also excluded as they have significantly lower inventory
compared to the KO drum. For the Diesel Storage & Distribution
System, since it is a stand-alone system, used for crane operation
only consequences from the diesel storage tank are assessed to
provide late pool fire consequence to firewall (H60 rating).
The hydrocarbon fire and explosion outcomes (i.e. flame durations
and blast effects) are assumed equivalent to the rating of fire proofing
materials established by Underwriter Laboratory (UL), which is an
independent certification body accredited by the US Occupational
Safety & Health Administration (OSHA), the American National
Standards Institute (ANSI), and the Standards Council of Canada
(SCC). Exceptional to J class division (i.e. jet fire outcome), fire test
is performed based on UK HSE established document (OTI 95634) as
this test is more appropriate for intense severe hydrocarbon fires.
The following conditions are used in all analyses:
 Isolation and/or blowdown is successful.
 Leaks from both the gas and two-phase segments (e.g. well
fluids) are treated as vapor releases as the lighter hydrocarbon
has a higher molar volume.
 Jet fire at immediate ignition. If the jet impinges on a
sufficiently large object, e.g. a solid deck/equipment, the
momentum in the jet will be wholly or partially lost and a
diffusive fire will occur. If delayed ignition occurs and the gas
release is allowed to accumulate, there is a potential for a flash
fire or explosion. However, no flash fire has been specifically
modeled as the effects of explosion would be more dominant
in term of consequences due to higher degree of confinement
between the decks.
 Late pool fires at delayed ignition, in which a bigger pool is
formed. The pool fire center is assumed to be located at the
rainout point.
 Multi-Energy explosion at delayed ignition, in which considers
degree on confinement.
3.3.2. Results
The well fluid produced at the facility contains 0.99 gaseous
fractions of mixture Methane and Ethane components at approx.
22 1C and 92 barg. All the deck floors are plated except at the
lowest level reaching Splash Zone area. The potential fire and
explosion scenarios takes into account the well fluid composition
and equipment arrangement on the platform. The results of the
consequence analyses are summarized as follows:
 Large hydrocarbon leak from the topside riser produces the
longest jet flame on the facilities;
 Due to the relatively low inventory within the segment
(exceptional to Riser events), the fire only lasts for less than
5 min for medium and large releases;
 Most of the medium and large jet fires can lead to 37.5 kW/m2
heat radiation level during initial release. However, it should
 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 163

be noted that these events are located within the process area,
where there is a firewall and/or fire/blastwall that separates
the living quarter, enclosure area and process area. Although
there may be escalation within the local area, escalation to the
area behind the firewall and fire/blastwall is not anticipated to
occur immediately;
 The hazard range for 15 min of jet fires from the gas segments
drops significantly due to the effect of blowdown, therefore
most of these releases do not lead to 37.5 kW/m2 heat
radiation level at 15 min;
 Condensate releases from the bottom of Production Separator
and condensate piping are modeled as jet fires due to large
pressure difference between the pressure inside vessel and
atmospheric pressure, which leads to the flashing of condensate
into vapor form and subsequently turn into jet fire when ignited;
 Pool fire is only anticipated when there is an ignition of diesel
near to the diesel storage tank;
 Immediate ignition due to the rupture of riser or during
blowouts can result in fireballs, which give significant hazard
range and impact to the facilities;
 Explosion due to delayed ignition of large gas releases are
possible. Rupture of the riser at the topside gives the worst
overpressure hazard range on the process facility due to the
higher degree of confinement on topsides, and its large
hydrocarbon inventory.
3.4. Frequency analysis
Fire and explosion barriers considered in constructing event
trees for quantifying fire and explosion frequencies are as follows:
i. Ignition probability. The probability of ignition is taken from
the Ignition Probability Review, Model Development and
Look-Up Correlations, IP Research Report [19]. This report
evaluates the UK offshore industry OIR12 data, as a basis to
develop an improved ignition model for use in QRA.
ii. Early detection. It is assumed that all medium and large
releases are successfully detected. The probabilities assumed
for medium and large releases are based on a target Safety
Integrity Level (SIL) of 2 for the detector system, which is the
minimum requirement as according to IEC 61511. SIL 2 implies
an on-demand failure probability between 0.001 and 0.01. To
be conservative, a probability of 0.01 has been assumed,
which is appropriate as it is possible that the release may
occur at a location where it is not in the line-of-sight to the
gas detection, leading in failure to detect the leak.
iii. Explosion overpressure. The explosion probability given a
delayed ignition is calculated by using NOBRA (NOrsok
BRAnch probabilities). NOBRA is a spreadsheet tool that is
used to provide estimates of exceeding an explosion over-
pressure given delayed ignition in offshore installations. The
effect of key parameters such as release rate, module volume,
degree of confinement and degree of congestion are included.
iv. Isolation/blowdown failure. Should a leak be detected, the
main process unit will be isolated by closing ESDVs in order to
limit the release of inventories. The ESDVs are normally fail-
close; hence it is assumed that if the ESD control system fails for
some reasons, the valve will close automatically. For this reason,
no common mode failure is assumed whereby all the ESDV fails
close. However, there is still a possibility having individual ESDV
to fail-to-close on demand. The on-demand failure probability of
ESDV used in this analysis is based on OREDA [20], i.e. 0.02 for all
sizes. The same reasoning applies to the on-demand failure
probability of blowdown valves for all sizes.
3.4.1. Leak frequencies
The leak frequencies are calculated for each isolatable segment
components lined-up according to the number and size of valves,
flanges, instrument connections, vessel and piping together with
dimensions, pressure and phase of the hydrocarbon inventory.
The data used for process equipment are based on the UK HSE
Hydrocarbon Release Database [17], but for riser/pipeline the data
are based on PARLOC 2001 data source. The outcomes leak

Table 2
Fire and explosion frequencies.

Process events Event location—Segments Fire frequencies (per year) Explosion frequencies (per year)

S M L S M L

MDP/GMET/G Cellar Deck—Production Manifold 1.37E-06 5.83E-07 4.33E-08 – – 6.56E-09

MDP/INPROD/W Main Deck—Production Manifold 1.99E-07 7.55E-08 1.65E-08 – – 2.90E-09
MDP/PRODSEP/W Main Deck—Production Separator 5.89E-07 3.14E-07 1.87E-08 – – 3.07E-07
MDP/PRODSEP/G Main Deck—Production Separator 8.96E-06 4.56E-06 7.88E-07 – – 1.29E-07
MDP/PRODSEP/O Main Deck—Production Separator 5.85E-07 3.07E-07 - – – –
MDP/GCOMP1/G Main Deck—Gas Compression Train 1 9.21E-06 4.28E-06 4.74E-07 – – 7.37E-08
TD/GCOMP1/G Top Deck—Gas Compression Train 1 2.15E-06 9.94E-07 1.96E-07 – – –
TD/GMET/G Top Deck—Gas Metering Skid 2.49E-06 1.09E-06 1.74E-07 – – –
MDP/GMET/G Main Deck—Gas Metering Skid 1.37E-06 7.97E-07 2.04E-08 – – 2.83E-09
CDP/GMET/G Cellar Deck—Gas Metering Skid 9.62E-07 4.17E-07 7.29E-08 – – 7.89E-09
CDP/EXPORT/G Cellar Deck—Export pipelines 8.60E-06 4.68E-06 6.92E-07 – – 7.78E-08
SCD/EXPORT/G Sub Cellar Deck—Export pipelines 1.83E-06 9.90E-07 3.53E-08 – – 5.03E-10
MDP/COND/O Main Deck—Condensate lines 1.56E-06 8.21E-07 - – – –
CDP/COND/O Cellar Deck—Condensate lines 8.90E-06 5.83E-06 – – – –
MDP/FUELG/G Main Deck—Fuel Gas Skid 1.12E-05 6.37E-06 1.19E-06 – – –
MDP/SEALG/G Main Deck—Seal Gas Scrubber, Filter 1.18E-05 7.61E-06 – – – –
CDP/FLARE/G Cellar Deck—Flare Header, KO Drum 4.16E-06 2.53E-06 – – – –
SCD/GRISER/G Sub-Cellar Deck—Gas Export Riser 1.62E-06 2.37E-07 1.62E-07 – – 1.52E-09
SZ/GRISER/G Splash Zone—Gas Export Riser 3.88E-07 7.42E-08 1.24E-06 – – 8.60E-09
Total frequencies 7.77E-05 4.26E-05 5.12E-06 – – 6.18E-07

Note:
‘‘S’’, ‘‘M’’ and ‘‘L’’ denote ‘‘Small’’, ‘‘Medium’’ and ‘‘Large’’ accidental leak sizes.
‘‘–’’ is denoted for explosion scenario which are not anticipated in some event scenarios due to open nature and limited equipment available on platform’’.
Explosion scenarios are not anticipated in some of event scenarios due to the open nature and limited equipment available on the platform.
164 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169

frequencies serve as an input to First Level of Event Tree, which is
used for quantification of fire and explosion frequencies.
3.4.2. Fire and explosion frequencies
The fire and explosion frequencies are estimated using ETA
and presented in Table 2. For each event, the fire and explosion
frequencies are the summation of frequencies resulting from
Isolation Successful (denotes ‘IO’) and Blowdown Successful
(denotes ‘BO’). For example as displayed in Fig. 2, the (Event
CDP/INPROD/W Small release) has a fire frequency of 1.08E-06
per year. The results show that ‘Small’ leak size are dominating
the total leak frequencies, and the cumulative leak frequencies
estimated for process/topsides and riser/pipeline events are
6.72E-02, 4.02E-02 and 4.56E-03 per year for Small, Medium
and Large leaks respectively.
In this study, the ETA conducted at this stage is referred to as
First Level ETA. Summing up all events, the total fire frequencies
estimated for the platform are 7.77E-05, 4.26E-06 and 5.12E-06

Description

Frequency
Immediate

Blowdown
Explosion
Frequency

Detection

Outcome
Isolation
Ignition

Delayed

Possible ?

Failure
Early
Leak

Ignition

Failure
8.79E-09 Jet Fires Intermediate 8.79E-09
Y 0.02
4.40E-07
Y 0.1
4.31E-07 Jet Fires Intermediate 4.31E-07
N 0.98
4.40E-06
Y 1.00E-03
7.91E-08 Jet Fires Intermediate 7.91E-08
Y 0.02
3.96E-06
N 0.9
3.88E-06 Jet Fires Intermediate 3.88E-06
N 0.98

4.40E-03 4.35E-03 4.35E-03 Unignited Release 4.35E-03

Y 0.99

2.81E-07 2.81E-07 Explosion Delayed 2.81E-07

Y 0.2675

1.54E-09 Jet/Flash Fires Delayed 1.54E-09

4.39E-03 1.05E-06 Y 0.02
N 9.99E-01 Y 0.0239 7.69E-08
Y 0.1
7.53E-08 Jet/Flash Fires Delayed 7.53E-08
N 0.98
7.69E-07
N 0.7325
1.38E-08 Jet/Flash Fires Delayed
1.38E-08
4.39E-05 Y 0.02
N 0.01 6.92E-07
N 0.9
6.78E-07 Jet/Flash Fires Delayed
6.78E-07
N 0.98

4.29E-05 4.29E-05 Unignited Release 4.29E-05

N 0.9761
Fig. 2. Fire and explosion frequencies (Sample for Event CDP/INPROD/W Small Release).
 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 165

Fig. 3. Second level firewall event tree (Sample for Event MDP/GMET/G Small Release).

Table 3
Impact assessment results.

‘Target’ Summation of fire Summation of blast Criterion ‘‘FW1’’ Criterion ‘‘FW2’’ Fire/blast rating adequate?
impairment frequencies impairment frequencies (See Section 3.1) (See Section 3.1)

Firewall at living quarter and main deck 1.2E-07 0.0E þ00 N N Y

‘Target’ Summation of fire Summation of blast Criterion ‘‘FBW1’’ Criterion ‘‘FBW2’’ Fire/blast rating adequate?
impairment frequencies impairment frequencies (See Section 3.1) (See Section 3.1)
Fire/blastwall at main deck 1.4E-07 1.4E-08 Y N Y
Fire/blastwall at cellar deck 6.1E-07 1.4E-08 Y N Y

Fig. 4. Location of points (A)–(D).

166 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169
for Small, Medium and Large leaks respectively. This is higher
than the expected total explosion frequency, which is in the
magnitude of 10  7 per year.
3.5. Impairment assessment
The impairment assessment only takes into account events
with resulting consequences that exceed the acceptance criteria,
i.e. leak duration beyond 15 min and 60 min for jet fire and pool
fire events respectively, and event resulting in explosion over-
pressure of more than or equal to 0.4 barg. At this step, ETA is
used again (referred to as Second Level ETA) to screen events that
meet the criteria. An example of a Second Level ETA showing the
event (MDP/GMET/G Small Release) is depicted in Fig. 3. It is
developed based on information derived from flame length or
pool diameter or explosion radii reaching the ‘target’, obstruction
of other equipment or decks floor and flame width or diameter
according to 3601 radius direction of impingement.
Fig. 5. Sequence of evacuation (Reproduced from [21]).
Fig. 6. Top deck (Evacuation flow No. 1, 2, 3).
For the blast wall, the Second Level ETA is generated by
integrating an overpressure level of 3 barg where deck flooring
and pipe works/supports are considered blown-off, thus creating
missile effects. The purpose is to estimate the likelihood of
impairment for the firewall and blastwall and whether or not it
meets the impact assessment criteria laid in Section 3.1. The
results are presented in Table 3, and based on these values, the
fire and blast ratings on fire/blastwall are deemed adequate.
3.6. EER analysis
The proposed simplified QRA based method presented in the
above has proved that the PFP ratings are in line with ALARP
requirements. In this section, the PFP ratings are compared with an
alternative assessment known as the EER Analysis. The key vari-
able, i.e., EER time is defined as the time required to execute safe
evacuation operation during emergency. It is the time required to
get to a ‘safe place’ from the working area. Depending on the
location of the event, the ‘safe place’ can be either (see Fig. 4):
 Point (A)—Firewall segment at Frame 2B
 Point (B)—Fire/blastwall segment at Frame 2A
 Point (C)—Firewall segment at Frame 1B
 Point (D)—which is at the survival craft muster area (primary
evacuation)
The EER time is computed from the furthest point of manning
area in each deck (i.e. from Helideck, above Air Cooler Top Deck,
Crane Cabin, Gas Turbine Package Main Deck, Pigging Area Cellar
Deck and Drain Area Sub Cellar Deck) to reach primary muster
area within the area of survival craft, identified as (D) in Fig. 4.
The EER analysis is simulated according to the flow as depicted in
Fig. 5 and the EER time is computed according to site specific
basis of emergency system activation, procedural response plan
and offshore worker movement speed, based on real-time drill
exercises. In all cases, conservative estimates that consider
possible congestions during evacuations are used. Note that in
mapping the activities to the classification of evacuation phases
as defined in Fig. 5, some of the steps required may involve more
 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169
Fig. 7. Main deck (Evacuation Flow no. 4) and Continuation of Flow no. 1, 2, 3, 5 and 6.
than one phase, For example, the time required to make the work
area safe involves tA (Awareness Phase) and tEv (Evaluation
Phase). The estimations are as follows:
 0.5 min to sound alarm (i.e. t1);
 3.0 min to make work area safe, i.e. tA and tEv;
 1.0 m/s on level walkways or corridors, i.e. tEv and tEg;
 0.8 m/s on changing decks using stairs, i.e. tEv and tEg;
 0.3 m/s on ladders (allows for the time taken on and off the
ladder), i.e. tEv and tEg;
 10.0 min for decision making, roll-call and don lifejackets (only
applicable during mustering) i.e. tEv;
 3.0 min to board the life raft or survival craft and confirm
whether everybody is on-board, i.e. tR; and
 10.0 min to launch the life raft or survival craft, which includes
time release break, lower and release, falls, and move away
from the platform, i.e. tR.
The procedural evacuation flow for EER time simulations
using primary escape routes are strategized on simplified decks
diagram shown below:
i. Top Deck (see Fig. 6)
 Flow no. 1 (from Helideck)—Personnel located helideck
walking down via stairs located southern part of the
platform to reach Main Deck and finally proceed to primary
muster area (D).
 Flow no. 2 (from above Air Cooler Top Deck)—For person-
nel who are performing maintenance or inspection above
Air Cooler Top Deck, they may proceed to escape route at
the southern part of the platform, walking down stairs to
Main Deck and proceed to primary muster area (D).
 Flow no. 3 (from Crane Cabin)—Crane operator escaping
down via ladder connected to pedestal tower to reach Top
167
Deck, and proceed to the escape routes at the north part of
platform area to the stairs reaching Main Deck, and finally
to primary master area (D)
ii. Main Deck (see Fig. 7)
 Flow no. 4 (from Gas Turbine Package)—Personnel located
at Gas Turbine Package may progress to the escape route at
eastern part of the platform, and followed the escape route
at the southern along the perimeter to the primary muster
area (D) located at the west part of platform area.
 Flow no. 1, 2 and 3—Continuation of evacuation process
for personnel located at Top Deck, to primary muster
area (D).
 Flow no. 5—Continuation of evacuation process for per-
sonnel located at Cellar Deck, to primary muster area (D).
 Flow no. 6—Continuation of evacuation process for per-
sonnel located at Sub-Cellar Deck, to primary muster
area (D).
iii. Cellar Deck (see Fig. 8)
 Flow no. 5 (from Pigging Area)—Personnel located at
Pigging Area within the eastern platform area may proceed
to the southern part of platform area, walking up to Main
Deck via stairs and finally to the primary muster area (D) at
the western part of platform area.
iv. Sub-Cellar Deck (see Fig. 9)
 Flow no. 6 (from Drain Area)—Personnel located here may
proceed toward southern part of the platform area, to the
ladder in the midst of the escape path. Then, they may
proceed to upper level decks (i.e. Cellar Deck and Main
Deck). From Main Deck, they may just follow the escape
route perimeter to the western part of platform area
(primary muster area (D)).
168 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169

Fig. 8. Cellar deck (Evacuation Flow no. 5).

Table 4
Time to safety from furthest working area at each deck.

No. Work area Total time (min)

Work Work Work Work area-

area-A area- area-A- A-B-C-D
A-B B-C

1 Helideck 0.0 0.0 0.0 5.2

2 Top of air cooler 4.2 4.2 4.4 5.5
(Top Deck)
3 Crane cabin 4.2 4.2 4.5 5.5
4 Gas turbine 4.2 4.2 4.4 4.8
package (Main
Deck)
5 Pigging area (Cellar 3.7 4.2 4.4 5.0
Deck)
6 Drain area (Sub- 4.4 4.8 4.9 5.5
cellar Deck)

Fig. 9. Sub cellar deck (Evacuation Flow no. 6).

of platform abandonment is needed. Therefore, an additional time

Based on the procedural evacuation flows as shown in Figs. 6–9,
the simulated EER time are computed and shown in Table 4. On
average, 3.7–5.5 min are allowed for the first level firewall failure
(i.e. at locations (A) and (B)). This is the maximum duration that the
firewall is able to maintain its integrity as a barrier to the generated
fire event in 15 min jet fire and 60 min pool fire.
This EER analysis also assumed that no escalation from failures
of deck floors and other structural components, safety equipment
and hydrocarbon vessels, i.e. no double jeopardies. Credit is taken
as if the deck floors and other structural components, safety
equipment and hydrocarbon vessels managed to fully maintain its
integrity at minimum of 15/60 min, which is at the firewall
exposure rating time due to jet/pool fire.
In order to complete an evacuation process to a place of safety
from the survival craft muster area, an amount of additional time
of 23 min (from the maximum 6 min resulted in Table 4) is
assumed needed to complete an evacuation process. This gives a
cumulative of 28.5 min needed for the complete recovery process.
With redundancy of another firewall protecting living quarters,
additional amount of survival time can be considered. Complete
evacuation is therefore successful, assuming no double jeopardy
event and the platform structural integrity is retained.
4. Conclusions
The proposed method is an important tool for design
verification to justify the adequacy of safety barriers used in
offshore platforms as well as other similar process facilities.
While not involving high degree of complexities, the method
 A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169
incorporates important items that influence the safety of the
proposed installation. This has been illustrated by the case
study presented here and can be conveniently adopted for
other cases.
The case study presented here shows that the fire rating J15
and H60 firewalls located in the facility is deemed adequate based
on EER time of worker to be able to muster at survival craft area at
Main Deck assuming no double jeopardy events, i.e. escalation
events due to failure of deck floors and other structural compo-
nents, safety equipments and hydrocarbon vessels. This result is
also consistent with ALARP principal applied as an input to
design. The results also proved the adequacy of the proposed
course risk-based methodology in determining PFP (fire/blast-
wall) adequacy.
References
[1] F.I. Khan, S.A. Abbasi, An assessment of the likelihood of occurrence, and the
damage potential of domino effect (chain of accidents) in a typical cluster of
industries, J. Loss Prev. Process Ind. 14 (2001) 283–306.
[2] V. Cozzani, A. Tugnoli, E. Salzano, Prevention of domino effect: from active
and passive strategies to inherently safer design, J. Hazardous Mater. 139
(2006) 209–219.
[3] T.A. Roberts, L.C. Shirvill, K. Waterton, I. Buckland, Fire resistance of passive
fire protection coatings after long-term weathering, Process Saf. Environ.
Prot. 88 (2010) 1–19.
[4] A. Brandsæter, Risk assessment in the offshore industry, Saf. Sci. 40 (2002)
231–269.
[5] A. Falck, E. Skramstad, M. Berg, Use of QRA for decision support in the design
of an offshore oil production installation, J. Hazardous Mater. 71 (1–3) (2000)
179–192.
[6] S. Lewis, An Overview of Leading Software Tools for QRA, in: Proceedings of
the 7th Professional Development Conference and Exhibition. March 18–22,
2005, Kingdom of Bahrain.
169
[7] J. Krueger, K.J. Smith, A practical approach to fire hazard analysis for offshore
structures, J. Hazardous Mater. 104 (1-3) (2003) 107–122.
[8] N.K. Shetty, C.G. Soares, P. Thoft-Christensen, F.M. Jensen, Fire safety assess-
ment and optimal design of passive fire protection for offshore structures,
Reliab. Eng. Syst. Saf. 61 (1–2) (1998) 139–149.
[9] J.W. Boh, L.A. Louca, Y.S. Choo, Numerical assessment of explosion resistant
profiled barrier, Mar. Struct. 17 (2) (2004) 139–160.
[10] J.K. Paik, J. Czujko, B.J. Kim, J.K. Seo, S.R. Han, C.H. Yeon, P. Janiszewski,
P. Musial, Quantitative assessment of hydrocarbon explosion and fire risks in
offshore installations, Mar. Struct. 24 (2011) 73–96.
[11] B.J. Kim, J.K. Seo, J.H. Park, J.S. Jeong, B.K. Oh, S.H. Kim, C.H. Park, J.K. Paik,
Load characteristics of steel and concrete tubular members under jet fire: an
experimental and numerical study, Ocean Eng. 37 (13) (2010) 1159–1168.
[12] J.K. Paik, B.J. Kim, J.S. Jeong, S.H. Kim, Y.S. Jang, G.S. Kim, CFD simulations of
gas explosion and fire actions, Ships Offshore Struct. 5 (2010) 3–12.
[13] A.D. Padova, A. Tugnoli, V. Cozzani, T. Barbaresi, F. Tallone, Identification of
fireproofing zones in oil and gas facilities by a risk-based procedure, J.
Hazardous Mater. 191 (2011) 83–93.
[14] M.K. Dey, An evaluation of risk methods for prioritizing fire protection
features: a procedure for fire barrier penetration seals, Nucl. Eng. Des. 232
(2004) 165–171.
[15] J. Spounge, A guide to quantitative risk assessment of offshore installations,
CMPT, 1999.
[16] UKOOA, Fire and Explosion Guidance Part 2: Avoidance and Mitigation of
Fires. Revision 2, 2006.
[17] UK HSE. Offshore Hydrocarbon Releases Statistics and Analysis, UK HSE,
2002.
[18] API, Recommended Practice for Analysis, Design, Installation, and Testing of
Basic Surface Safety Systems for Offshore Production Platforms, API RP 14C,
7th Edition, 2001.
[19] UKOOA, Ignition Probability Review and Model Development—Phase 2 Look-
Up Correlation Report Look-up Correlations, 2004.
[20] DNV, Offshore Reliability Data Handbook (OREDA), DNV, 2002.
[21] D.G. DiMattia, F.I. Khan, P.R. Amyotte, Determination of human error
probabilities for offshore platform musters, Journal of Loss Prevention in
the Process Industries 18 (2005) 488–501.