In-depth studies into coincidental flaring offshore have found a less than one in 100 year design case which if not handled would risk loss of the ability to flare in an emergency, with potentially severe consequences. With bridge-linked installations on the increase, Pöyry's Conor Crowley believes this is a risk the industry cannot afford to ignore.
Flaring of hydrocarbon gas has long been used in the industry as a mitigating measure to reduce the consequence of incidents. Pressure safety valves (PSV) relieve potential vessel overpressure and ensure that piping and equipment do not catastrophically fail, either by exceeding vessel design pressure or losing mechanical strength in a fire. Blowdown valves reduce the pressure in process equipment during an emergency and form a key part of risk reduction for major leak scenarios. Inventory is removed from areas where it could form part of an escalation path and hydrocarbon is vented, and often burned, at a safe location. In addition, it is often necessary to route some gas to flare during start-up while compression and processing equipment is brought on line.
As time proceeds, a facility may not be using all of its processing capacity as the arrival rates of oil, gas and water change. The demand on flare system capacity is not necessarily similarly affected, as it is more influenced by design temperatures, pressures and the sizes of installed devices than by how much production is entering a facility. Ullage is generally only created by decommissioning equipment, rather than as a consequence of changing production.
North Sea operators are now seeking to extend the life of production facilities through additional process equipment, bridge-linked platforms and even an entire new processing facility. The impact of this on flaring requirements needs to be addressed.
For current greenfield developments, the design approach is to estimate the maximum credible load and design a system to meet that load. This is generally taken to include: l emergency blowdown of the process assuming fire; plus l single worst coincident load The single coincident load is typically a PSV for a single process facility.
The design of flare systems is an evolving process and depending on company and national standards, the emergency blowdown can be estimated using a variety of methods.
The industry approach, as expressed in API RP521, is to use a standard API fire load to estimate the peak blowdown rate. Subsequent analysis in the UK and Norway has suggested that this heat input may be an underestimate of that from high pressure flames, and proposes heat input up to four times higher than the API approach, leading to greater demand on the system. The approach of having two coincident loads to set the maximum design point is also not included in the standards.
While PSV loads are generally based on real scenarios, and calculated according to the fundamentals of the required flow, the generally accepted blowdown target is to achieve 50% of the starting pressure or 100psi within 15 minutes. It sets a specific trajectory for pressure reduction, and gives surrounding steelwork and equipment a fighting chance to survive an incident, either by providing appropriate fire protection, or indeed removing the inventory at the same time to reduce the risk of escalation.
Problem – a bridge too far
The challenges and complexities of flaring for individual installations are widely understood and engineers should be able to effectively develop designs for new facilities. But, when it comes to expanding an existing platform, greater consideration needs to be given to flare system design. Operators cannot treat the facilities as if they were separate, and design each facility to operate within the overall flare capacity on their own. Too often it is assumed that an incident on one side of a bridge will not escalate to the other. And coincident scenarios are dismissed as unlikely.
Unfortunately, these may be unlikely, but not unlikely enough. A simple calculation using standard data suggests that if a pipeline is linked to a separator with two shutdown valves in-line, for a fire and gas shutdown of say one in three years, this could result in continued production approximately one in 100 years. This implies that it is a realistic design point, and intuitively supports the current approach to use blowdown plus single source as the maximum design point. However, this could mean that the flare system is compromised once in every 100 years.
Following the principles of inherent safety, you prevent before control before mitigate before escape. The logical approach would be to assess the maximum load, including all blowdown loads, coincident with the maximum single load, and assess that against the existing capacity.
Unless the existing facility has been overdesigned, or had a lot of its equipment removed, the above thinking would lead to installation of a new flare system for the new equipment. Relative to the cost of a new facility, it is not likely to be a massive expense. Not a zero investment either, so the temptation is not to do it. Intuitively, engineers think there must be capacity to be used because they believe you cannot get a fire on both sides of the bridge. The separation distance has been chosen specifically to achieve this.
Just because the system may be designed so that blowdown on one side of the bridge only results in shutdown on the other side, there are potential single cause events which could cause complete blowdown on both sides. UPS failure, or loss of instrument air, for example.
Coincident events are not impossible either. Perhaps a blocked outlet causing a relief valve to lift during a start-up, where flow is being routed to flare until the plant is up and running properly. An operator may open a valve to flare to remove inventory quickly while a blowdown is happening.
Production may fail to be shut down on one side of the bridge, while the other side is blowing down. For a single facility, this would not necessarily be an issue, as the inlet separator would already be blowing down, and therefore not increasing the blowdown load. However, with separated facilities, especially if they happen to be producing from subsea pipelines, a relatively small number of failures can result in continued production postshutdown. And with the plant shut down, the only place production can go is into the flare.
Solution – the route to ALARP
Having worked with a number of clients examining this issue, Pöyry has come up with a structured methodology to achieve a design where the risks are ALARP (as low as reasonably possible). It is based on a systematic review of the coincident flaring cases as illustrated in Figure 1. The approach is to identify coincident flaring cases above the flare capacity and handle them in one of four ways:
If the above case cannot be disregarded, then the risk needs to be demonstrably ALARP. If the frequency of the event is very low, then it may be possible to dismiss it. Otherwise it is down to considering the consequences of exceeding the flare capacity, which may impact personnel, the environment, or production, and determining the risk. Comparing this to the cost of any potential modification should allow an ALARP design.
This is not something that should be approached with any complacency. The BLP designs we have assisted have all required design amendments, in some case significant changes, to achieve ALARP. It does not take that much engineering work, design change or enhanced assessment to make the decision not to prevent the problem in the first place look like a poor choice. Especially when it requires engineers to look at conceptual issues when they should be concentrating on detail design.
Conclusion It may be difficult to sort out a flare capacity at concept selection stage. The detail of the final flare loadings is two project phases down the line. But not dealing with the problem is just storing it up for when it will be a lot harder to deal with. A systematic ALARP review may get you there in the end, but not without a lot of engineering and risk reduction work along the way.
Applying our approach uses the creative thinking required at the concept selection phase, where the uncertainty in flare data is no different to the other uncertainties being handled at that stage. This will allow the client to knowingly head to the ALARP solution. And that is what our engineering efforts are all about. OE
About the Author
Conor Crowley, consultancy director of Pöyry Energy Aberdeen, has 20 years' experience in the energy sector and an extensive track record in engineering. A chartered engineer and fellow of the Institution of Chemical Engineers, he began his career in safety engineering for a major operator before moving into consultancy. Crowley has been with Pöyry for over 15 years and currently his scope covers FEED, software development, environmental services, risk management and safety support.