Bård Helland Bø 2023-09-08T02:47:44-07:00 Microsoft Word 29.11.16 2026-04-17T11:16:00+02:00 29.11.16 application/pdf Bård Helland Bø 29.11.16 2023-09-08T02:47:44-07:00 Microsoft Word 2026-03-09T09:50:43+01:00 2026-04-17T11:16+02:00 uuid:fa060469-500e-4910-92ed-924d9e95ed20 uuid:6334a6b9-cd08-457a-9761-0e5e52f28b73 tetml={filename={D:\drim\repository\projects\drim_78_0\metadata\5\7\5778f7b64268590ece60ea084c61facd\5778f7b64268590ece60ea084c61facd.tet.xml} elements={annotations=false bookmarks=false destinations=false fields=false javascripts = false} } granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations C256-EQ-S-FD-00003 Classification: Internal Status: Final Expiry date: 1 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Title: Safety strategy for offshore substations Document no: Contract no.: C256-EQ-S-FD-00003 Classification: Distribution: Internal Expiry date: Status Final Classification: Internal Status: Final Expiry date: Project: Distribution date: Rev. no.: Copy no.: 08/09/2023 02 Author(s)/Source(s): Subjects: Context, Hazards, Safety in design, Barrier functions, Performance standards, safety strategies Remarks: Valid from: Updated: 08/09/2023 Responsible publisher: Authority to approve deviations: Techn. responsible (Organisation unit / Name): Date/Signature: 28.08.2023 Responsible (Organisation unit/ Name): Date/Signature: Recommended (Organisation unit/ Name): Approved by (Organisation unit/ Name): 28.08.2023 Date/Signature: 28.08.2023 28.08.2023 08.09.2023 Date/Signature: 29.08.2023 07.09.2023 2 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Contents Rev. no. 02 Valid from: 1 Objective and Target group..................................................................................................................... 5 1.1 Objective ................................................................................................................................................... 5 1.2 Scope ........................................................................................................................................................ 6 1.3 Target group .............................................................................................................................................. 6 1.4 Important information about current revision ............................................................................................... 6 2 Context ..................................................................................................................................................... 6 2.1 wind project ............................................................................................................. 6 2.2 Facility description offshore substation ....................................................................................................... 7 2.3 Metocean data ........................................................................................................................................... 8 2.3.1 Wind.......................................................................................................................................................... 9 2.3.2 Waves ..................................................................................................................................................... 10 2.3.3 Current .................................................................................................................................................... 11 2.4 Snow and icing ........................................................................................................................................ 12 2.5 Sea ice .................................................................................................................................................... 12 2.6 Third party activities nearby the development ........................................................................................... 12 2.7 Applicable rules and regulations .............................................................................................................. 12 3 Risk management .................................................................................................................................. 12 3.1 Safety in design principles ....................................................................................................................... 12 3.2 Risk tolerance criteria .............................................................................................................................. 13 3.3 Barrier functions ...................................................................................................................................... 16 4 Hazard identification ............................................................................................................................. 18 5 Risk and consequence description ...................................................................................................... 18 5.1 Ship collision and vessel loss of position .................................................................................................. 19 5.2 Explosion hazards ................................................................................................................................... 19 5.3 Fire hazards ............................................................................................................................................ 19 5.4 Insulation gas (SF6) hazards ................................................................................................................... 20 5.5 Other hazards.......................................................................................................................................... 20 6 Offshore substation - Safety strategies ................................................................................................ 23 6.1 Containment (PS 1) ................................................................................................................................. 23 6.2 Natural ventilation and HVAC (PS 2) ........................................................................................................ 24 6.3 Leak detection (PS 3) .............................................................................................................................. 26 6.4 Emergency Shutdown system (PS 4) ....................................................................................................... 27 6.5 Open Drain system (PS 5) ....................................................................................................................... 30 6.6 Ignition source control (PS 6) ................................................................................................................... 32 6.7 Fire detection (PS 7) ................................................................................................................................ 33 6.8 Active Fire Protection (PS 9) .................................................................................................................... 39 6.9 Passive Fire Protection (PS 10) ............................................................................................................... 41 6.10 Emergency Power and Lightning (PS 11) ................................................................................................. 42 6.11 Process Safety (PS 12)............................................................................................................................ 45 Classification: Internal Status: Final Expiry date: 3 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: 6.12 Alarm and Communication System for use in Emergency Situations (PS 13) ............................................ 46 6.13 Escape, Evacuation and Rescue; EER (PS 14) ........................................................................................ 48 6.14 Layout Design Principles and Explosion Barriers (PS 15) ......................................................................... 55 6.15 Offshore cranes (PS 16A) ........................................................................................................................ 57 6.16 Avoidance of vessel collisions (PS 19) ..................................................................................................... 59 6.17 Structural integrity (PS 20) ....................................................................................................................... 61 6.18 Human Machine Interface and Alarm Management (PS 22) ..................................................................... 63 6.19 Safety & automation system security (PS 23) ........................................................................................... 65 7 Additional information ........................................................................................................................... 66 7.1 Abbreviations and definitions ................................................................................................................... 66 7.2 Definitions ............................................................................................................................................... 67 7.3 Changes from previous version ................................................................................................................ 67 8 References ............................................................................................................................................. 68 9 Appendices ............................................................................................................................................ 69 9.1 Appendix A - Specification for active fire protection systems ..................................................................... 69 9.2 Appendix B - Emergency shutdown philosophy and shutdown hierarchy .................................................. 71 9.2.1 Introduction ............................................................................................................................................. 71 9.2.2 Control and protection system.................................................................................................................. 71 9.2.3 Safety functions for emergency events ..................................................................................................... 71 9.2.4 Shutdown principles................................................................................................................................. 72 9.3 Appendix C – Assessment of emergency power and UPS ........................................................................ 77 Classification: Internal Status: Final Expiry date: 4 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 1 Objective and Target group 1.1 Objective Rev. no. 02 Valid from: This document describes the safety strategy for the offshore substation. The safety strategy is input to the development of the substation and shall be further detailed during the engineering phase to document conclusions on safety aspects relevant for the development of the offshore substation and interface with the wind farm. The safety strategy describes how risks are to be managed based on the outcome of a systematic identification and evaluation of the hazards and effects which may arise on the specific installation. The aim of developing the specific safety strategy is to identify installation specific philosophies, strategies and requirements. This information shall outline the design principles for layout, configuration, arrangement, the selection and role of safety barriers to manage risk on the installation. Further the safety strategy shall define initial performance requirements and design requirements. In general, requirements in DNV-ST-0145 Offshore Substations shall apply, but this Safety Strategy provides supplementary requirements and clarification of safety barrier strategies applicable to the Wind project. In case of conflicting requirements, the requirements in this safety strategy shall prevail. The document shall be used as specification for safety related aspects including detection and mitigation hazardous situations and events. This document shall however not restrict designers in developing the most optimized design. The safety strategy shall be updated by Company during the engineering phases. Contractors who perform design of the OSS shall contribute with input to the strategy document, addressing specifics related to their proposed concept. If solutions chosen / proposed by Contractor conflicts with this document, Company shall be consulted. The safety strategy is structured according to the Company defined barrier systems, with the objective to: • Describe the need for and role of barriers that are established to manage risk related to major accidents. • Visualize the connection between risk and hazard evaluations specific to the offshore substation and the wind farm hazards • Establish adequate understanding of the barriers in order to make correct decisions and understand their role. • Form a basis which can be used as a management tool to keep the integrity of the barriers intact during operation and modifications. The safety strategy is a lifecycle document and shall follow the installations into the operation as documentation of the safety barriers and for follow-up of the safety barriers. This safety strategy is established for the project phase intended to suite engineering and construction work. This document describes Company minimum requirements. However, if national authority requirements are stricter these shall prevail. Classification: Internal Status: Final Expiry date: 5 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 1.2 Scope Rev. no. 02 Valid from: This safety strategy covers the offshore substation (structures, equipment and control of the OSS) and subsea installations within the scour protection area around the jacket. 1.3 Target group Target group for this document is the Company project organization, Company operations organization and project engineering, design Contractors and authorities. Furthermore, the document can be used as supporting documentation to Authority submissions. 1.4 Important information about current revision FEED documents with document number type C274-RA-x-xx-nnnnn added as reference document in section 6 represent the status of the FEED phase and shall be considered as guidance only. The solutions presented in the referred FEED documentation shall not prevent Contractors from further improvements and development of the proposed design. 2 Context 2.1 wind project The areas of interest are in the southwestern Baltic Sea within Polish waters with water depths ranging from 20m to 45m. The total area of is 122 km 2 and the total area of is 117 km 2 . are located 55 and 60 km respectively from the windfarm boundary to the landfall location near Ustka, and a further 10 km from the landfall point to the Onshore Sub Station (ONS) at Slupsk (distances calculated along the export cable corridor). Closest straight-line distance to shore is 36 km from the perimeter of and 22 km for . Both project´s cable arrays shall have a dedicated Offshore Sub Station (OSS), centrally located in each park, directing export cables through a single route to shore. Potential future wind farms are being developed around and between the area of as shown in Figure 1. Classification: Internal Status: Final Expiry date: 6 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Baltex-2 MEP EAST; 10 15 20 SHARCO II Figure 1 - Neighbouring future offshore wind farms Rev. no. 02 Valid from: The scope of the wind farm development encompasses wind turbines (WTGs), their foundations, inter-array cabling, one offshore substation per wind farm, an export cable system, a landfall, two separate substations in one common area and the connection to a transmission grid substation where the electricity will be exported to the Polish power grid. The two projects have according to the Polish regulatory requirements a combined maximum capacity of 1440 MW, 720 MW per wind farm. A schematic visualization of the project scope is shown in Figure 2. Wind turbines Lie. Appl Inter-array cables 66 kV cables Figure 2 - project schematic visualization 2.2 Facility description offshore substation The offshore substation (OSS) will be normally unmanned and visited for inspection and maintenance activities. The control of the substation and the wind farm will be from a permanently manned control room within the maintenance base located onshore. Emergency offshore shelter at OSS shall be designed for 12 persons onboard (PoB) during normal operation. During offshore hook-up and commissioning and planned maintenance operations it should be possible to temporarily support up to 36 PoB when based on the vessel spread used to support the installation and commissioning The OSS will be supported by a jacket structure and is envisaged to be comprised of a cellar/cable deck (lower level), main deck, utility deck and a roof level. Baltic Sea Area 8 ■EW Baltii Area 5 Area 4 Area 1 Baltics 2 C-WInd Baltyk II Area 6 Baltics 3 Area 7 Baltic Power A-Wmd 2 x offshore substations 66 -> 220 kV MH Biiwsi s::sgr Wisi Classification: Internal Status: Final Expiry date: Rowy Export cables (4) 220 kV cables NEPTUN Baltyk III O&M Base and vessels Wady Battyku Leba Onshore substation 220 kV ->400kV Legend Area 3 B-Wind Offshore Wind Law, Phase 1 Areas Wind Farms, other possible future areas Bird Migration Corridors Protection Areas (Natura 2000) Transmission substation 400 kV TSO 7 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: The power production from the WTG’s is split into two separate power production trains, A and B train. The two trains are physical segregated from each other to avoid accidents in one train to influence the other train. The offshore substation will typically contain: • Two operational trains • Auxiliary LV rooms • HV and MV GIS switchgear rooms, • Transformer and cooler area • Auxiliary generator • Fire suppression, HVAC, and battery rooms • Locker area/toilet room • Cranes for material handling • Roof with possibility for Heli hoist (medevac or special lifts) • Control, automation, and telecom rooms • Public room • Workshop and storage container Base case for access to the OSS is by CTV during the operations phase via access ladders from sea level. In addition, landing areas for use of service offshore vessel (SOV) and walk to work bridge shall be installed. The SOV size can be up to 6000 tons displacement. The SOV or the CTV will not stay connected when personnel are onboard but located in the field at a distance outside the safety zone. The OSS will be visited approximately once a year for routine inspection and maintenance activities and every three years for a planned outage maintenance campaign. 2.3 Metocean data The below information is extracted from ref. • C274-EQ-Z-SP-00001_05 (MAD RE2019-006 rev 4) - Metocean Design Basis • C275-EQ-Z-SP-00001_05 (MAD RE2019-007 rev 4) - Metocean Design Basis. Classification: Internal Status: Final Expiry date: 8 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 2. 3.1 wind Rev. no. 02 Valid from: All-year wind rose 10 m above sea level are shown in Figure 3 for and figure 3 for Baltyk II - All year NORTH Figure 3 - All-year wind rose for for the period 1980-2018 NET Baltyk 111 - All year NORTH SOUTH 10% |fl I BIBIBBDDDEJDBBBB ? s i ssisK e its a B Figure 4 - All-year wind rose for for the period 1980-2018 Classification: Internal Status: Final Expiry date: 9 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 2.3.2 Waves All-year wave rose for are shown in Figure 5 and Figure 6 respectively. Rev. no. 02 Valid from: Figure 5 - All-year wave rose for for the period 1979-2018 WES' SOUTH NORTH' SOUTH. 20% Figure 6- All-year wave rose for for the period 1979-2018 Classification: Internal Status: Final Expiry date: 30% All year 30% Hs(m) . ■ >=5 EAST ■4.5-5 • ■ 4-4.5 □ 3.5 - 4 □ 3 - 3.5 □ 2.5 - 3 □ 2-2.5 □ 1.5-2 ■ 1-1.5 ■ 0.5 - 1 ■ 0-0.5 Hs (Hl) ■ >-f>S ■ EAST ■4.5-5 □ 4-4.5 □ 15-4 □ 3-3.5 02 5 -3 □ i-25 ■ 1.5-2 ■ 1*1.5 ■ 0.5-1 ■ 0-0.5 10 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 2.3.3 Current Rev. no. 02 Valid from: The current rose at surface for are shown in Figure 7 and Figure 8 respectively. WEST ■■PH - 0 m - Ali year NORTH- SOUTH Figure 7 - Current rose at surface at Figure 8 - Current rose at surface at "*iSJBg8fcig&!S5iail8SOs s i3~ 8o -5 Classification: Internal Status: Final Expiry date: 15% - 0 m - All year NORTH SOUTH 1S% 20% J $ S 2 o - 8 7 7 S 8 8 £ 8 S ? R £ © t M??8g£3SSRSsZ Q ■■■■□□□□□■■■« 11 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 2.4 Snow and icing Rev. no. 02 Valid from: Wet snow may accumulate on surfaces and vertical structures, e.g. communication mast. Atmospheric icing is possible. Estimated ice thickness (data for 50 yrs available) at 100 meters on cylinders and non-rotating structure elements is approx. 30 mm. Specific assessment atmospheric icing on OSS is not performed. Sea spray icing is caused by freezing sea spray. Sea spray icing can be expected up to 25 meters above sea level and with the thickest ice layer of up to 80 mm (100 yrs) between 5-10 meter. There will also be ice accumulation below 5 m but not during extreme storm when large waves will transport heat to the lower region of the structure and the ice is exposed to thermal and mechanical deterioration. These values are equal for . 2.5 Sea ice Sea ice can occur at and an average ice season is in range of 10-20 days while maximum duration is about 40 days. Expected annual probability of occurrence of ice is approximately 10 -1 . The sea ice thickness at 100 years return period is estimated in ref /C256-EQ-Z-CA-00001_05 / to be 0,38 m for and 0,39m for . 2.6 Third party activities nearby the development There are fishing activities within both wind farms and along the route for the export power cables. Within the wind farms the type of fishing gear used is bottom nets. There are also fishing vessels passing through the wind farms as there is an area for trawl fishing north of the wind farm areas. There are ship navigation routes both south of and north of the wind farms. AIS data show very low density of ship traffic in the vicinity of the wind farms as per today. When WTGs are present in the future and the sea maps are marked, the ship traffic is expected to be even lower. The OSS is located within the windfarm surrounded by the WTGs. 2.7 Applicable rules and regulations Reference is given to Appendix E of the Contract. 3 Risk management 3.1 Safety in design principles In general, systems that are easy to design, operate and maintain will be safer than more complex designs. This is also valid for design of safety systems. In priority it is recommended to develop our plant designs in the following order, ref Figure 9: Classification: Internal Status: Final Expiry date: 12 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 BEST 1. Inherent safe design Figure 9 - Safety in design principles 3.2 Risk tolerance criteria Rev. no. 02 Valid from: Personnel and asset risk shall meet the risk tolerance criteria provided by s risk matrix shown in Figure 10. The consequence categories are described in Table 1. The interpretation of colours is described in Table 2. Consequence category Safer 1-3 4 5 6 7 8 9 Probability category 1 2 3 4 5 6 7 8 <0.001% (<10 -5 /yr) Elimination of hazard - design it out Substitution - use something less hazardous 2. Systems as barriers Engineering controls - isolation and guarding Shutdown systems Fail safe principle 3. Manuel procedures Administrative controls - training and work scheduling Design for operation with low complexity 4. Personal Protective Equipment - last resort 0.001-0.01% (10 -5 -10 -4 /yr) 0.01-0.1% (10 -4 -10 -3 /yr) 0.1-1% (10 -3 -10 -2 /yr) Figure 10 - Risk Tolerance Criteria, 9x8 matrix for activities with major accident potential outcome (internal reference R-105890, RM100) Classification: Internal Status: Final Expiry date: 1-5% 5- 25% 25- 50% >50% 13 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Table 1 Description of consequence (impact) categories (Internal reference R-24383, RM100) Consequence Category People’s health and safety 1 – 3 / Minor Medical treatment, injury, event or work-related illness with need for treatment or with temporary health effect 4 / Moderate Injury, event or work- related illness that result in brief absence or restricted / substitute work or some functional impairment. Medically manageable 5 / Serious Serious injury, event or work-related illness with absence from work, restricted work or permanent health effects. High level of medical treatment, serious functional impairment 6 / Severe 1-3 fatalities or work- related illness / exposure with significant life shortening effects 7* / Major 4-20 fatalities or illness/ exposure cases with significant life shortening effects and/ or larger parts of installation/ plant/ office. 8* / Catastrophic 20-200 fatalities or illness/ exposure cases with significant life shortening effects and/ or main part of installation/ plant/ office. 9* / Extreme More than 200 fatalities illness/ exposure cases with significant life shortening effects and/or loss of installation/plant/office Environment * Consequence category 7, 8 and 9 are considered major accidents in Classification: Internal Status: Final Expiry date: Very limited impacts (restitution time < 1 month) on populations (local), ecosystems or environmentally sensitive areas of local importance. Local impact on individual organism level Short term impacts (restitution time <1 year) on populations (local), ecosystems or environmentally sensitive areas of local importance -Short term impacts (restitution time <1 year) on populations (national or regional), ecosystems or environmentally sensitive areas of national or regional importance -Medium term impacts (restitution time 1-3 years) on populations (local), ecosystems or environmentally sensitive areas of local importance -Medium term impacts (restitution time 1-3 years) on populations (national or regional), ecosystems or environmentally sensitive areas of national or regional importance -Long term impacts (restitution time 3-10 years) on populations (local), ecosystems or environmentally sensitive areas of national importance -Large oil spill in populated area -Long term impacts (restitution time 3-10 years) on populations (national or global), ecosystems or environmentally sensitive areas of global or national importance -Very long or permanent impacts (restitution time > 10 years) on populations (regional), ecosystems or environmentally sensitive areas of regional importance -Large oil spill in densely populated area -Very long or permanent impacts (restitution time >10 years) on populations (national or global), ecosystems or environmentally sensitive areas of global or national importance -Large and long-lasting oil spill close to densely populated shoreline. 14 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Table 2 Interpretation of colours in design phase (internal reference R-11452, RM100) Risk level RED ORANGE YELLOW GREEN Mitigation and sharing of risk Single red risk is generally intolerable and far beyond the Group's risk tolerance criteria. Mitigating actions must be implemented as soon as possible. Single orange risk is generally intolerable, and mitigating actions must be implemented. Mitigating actions shall be identified based on the ALARP (As Low As Reasonably Practicable)/ BAT (Best Available Technology) principle or other applicable principles subject to relevant jurisdiction(s). Risks in the green zone are generally tolerable and actions are normally not required. The following main safety functions are further defined for the OSS: • The main load carrying capacity (structure) shall be intact until the installation has been evacuated (in manned scenarios), which means that there must not be extensive deformation or collapse of the whole or considerable parts of the installation before evacuation. • Installation parts with functions that are vital to combat accidents and/or ensure safe shutdown shall be intact until the emergency activity has been completed or the facility has been evacuated. • Mustering areas, evacuation means, and other areas defined as “safe areas” shall be protected so that they remain intact until the facility has been evacuated. • At least one escape route for personnel in other areas than the area(s) exposed to the initial accidental event shall be intact until all personnel have escaped to safe area. The annual probability of loss of the main safety functions shall be lower than 1 x 10 -4 for each of the following accidental loads: • Heat loads (e.g. due to fires in combustible materials such as transformer oil, diesel etc.) • Smoke and toxic loads (e.g. due fires in combustible materials such as transformer oil, diesel etc.) • Explosion loads (e.g. related to transformer failure) • Impact loads (e.g. collision loads from vessels, dropped object loads from lifting operations, etc.) • Extreme environmental loads, such as o Wind, wave, current o Sea ice o Icing o Earthquake Based on a perceived well known and controllable risk picture, these quantitative criteria may be assumed complied with by using the following minimum design criteria: • Platform structural integrity and robust layout shall secure safe escape from all areas of the platform during an incident, maintaining the main safety functions • The fire protection design shall ensure that a fire or explosion in the equipment is contained and will not lead to escalation to other areas or parts of the electrical system. Segregation of transformers and other critical Classification: Internal Status: Final Expiry date: 15 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: equipment shall be ensured so that a fire or explosion in one transformer does not lead to complete loss of production • A fire- and explosion analysis is required to document the design and ALARP evaluations shall be made. o Transformer Fire: The dimensioning fire load for oil-filled transformers are determined by the pool fire subsequent to a transformer explosion scenario (an explosion will rupture the transformer resulting in loss of transformer oil to the surroundings). The size of the pool is determined by the size of the bunding, or containment area and a typical heat flux can be of the order of 150 kW/m2. The duration of the pool fire will be determined by the evaporation rate (typical 50 g/m2/s) and the drain capacity in the area. o Transformer Explosion: The dimensioning explosion load for oil-filled* transformers are determined by an internal electrical arc, leading to a transformer rupture resulting in an ignited gas cloud (containing both oil mist and pyrolysis reaction products). The energy involved (for gas cloud size) is determined by the circuit breaker time and the transformer rating. • Impact loads - vessels: The structure shall be designed to withstand a collision from SOV with displacement of 6000 t and vessel speed minimum 2 m/s as per requirements in DNV-ST-0145. • Extreme Weather: The installation is designed to as minimum withstand the 100-year return period storm conditions without experiencing any impairment of the safety functions or integrity of the installation. The installation is unmanned in extreme weather, but it shall as minimum be designed for a 1000-year return period ALS event. If the above points are adhered to, further quantification is deemed unnecessary. Otherwise, normal quantitative risk analysis shall be performed. 3.3 Barrier functions Barriers shall be in place to prevent a single event to developing into major accidents. A traditional barrier diagram illustrating the principle of barrier functions to prevent unwanted events and consequences are shown in Figure 11 Classification: Internal Status: Final Expiry date: 16 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 NORMAL OPERATION Reduce probability of fault, hazard and accident situations FAULT, HAZARD AND ACCIDENT SITUATIONS Identify conditions that can lead to fault, hazard and accident situations Rev. no. 02 Valid from: Reduce possibility of fault, hazard and accident situations developing into unwanted event Figure 11 - Barrier diagram indicating barrier functions (shown in red) to prevent unwanted events and consequences. Company has, based on systematic review of different hazard and accident scenarios, internal and external requirements, international standards and best practices, established company requirements to barriers for O&G facilities classified as performance requirements and sorted by performance standards (PS). The company performance standards for O&G offshore facilities are provided in TR1055. Relevant performance standard definitions are used in this safety strategy for the OSS in order to provide a comparable basis towards the standardized barrier definitions within the Company, see Table 3. The role and need for barriers according to this structure are provided in chapter 6. Table 3 Performance Standards (PS) for the offshore substation # Barriers # Barriers PS1 Containment PS13 Alarm and Communication System for use in Emergency Situations PS2 Natural ventilation and HVAC PS14 Escape, Evacuation and Rescue (EER) PS3 Leak detection PS15 Layout Design Principles and Explosion Barriers PS4 Emergency Shut Down (ESD) PS16A Offshore cranes PS5 Open drain PS16B N/A PS6 Ignition source control PS17A N/A PS7 Fire Detection PS17B N/A PS8 N/A PS18 N/A UNWANTED EVENT PS9 Active Fire Protection PS19 Avoidance of vessel collisions PS10 Passive Fire Protection PS20 Structural integrity PS11 Emergency Power and Lightning PS22 Human Machine Interface and Alarm Management PS12 Process Safety PS23 Safety & automation system security Classification: Internal Status: Final Expiry date: Limit possible consequence, damage CONSEQUENSES, LOSS, DAMAGE 17 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 4 Hazard identification Rev. no. 02 Valid from: The following hazards have been identified at current stage of the project, ref Table 4. The hazards are further detailed and evaluated in doc.ref. C274-RA-S-RA-01002 – FEED HAZID report. The hazards in the FEED report are referenced to as “FEED [n]” in table 4 hazard description. Table 4 Hazard identification ID Hazard PS 1 Ship collision with Service Operation Vessel (SOV), Crew Transfer Vessel (CTV), fishing vessel or passing merchant vessel - FEED [3, 48] 2 SOV loss position causing gangway impact to critical equipment/structures or personnel – FEED [25] 3 Explosion as result of internal arcing fault in oil filled transformers and rupture/release of explosive gas and oil mist – FEED [1, 10, 11, 12, 21, 22, 41] 4 Fire in or around oil filled transformers. Heat or toxic smoke exposure to personnel – FEED [1, 29, 30] 5 Fire in electrical systems (short circuit, overload, malfunction of equipment). Heat or toxic smoke exposure to personnel - FEED [7, 10, 11, 12, 22, 29, 30, 39, 40, 41] 6 Fire in hydrocarbon systems (Hydraulic Oils, diesel engine, etc.). Heat or toxic smoke exposure to personnel – FEED [17, 29, 30, 36] Classification: Internal Status: Final Expiry date: 19, 20 15, 19 15 5, 7, 10, 14, 15 7, 10, 12, 14,15 5, 7, 10, 12, 15 7 Explosion due to explosive atmosphere from battery hydrogen release – FEED [20] 2, 3, 6 8 Oxygen deprivation / asphyxia and greenhouse gas release due to leaks of SF6 from gas-insulated switchgear (GIS) and gas-insulated busbars (GIB), e.g. inert gas for fire suppression. – FEED [13] 9 Handling / exposure to SF6 decomposition products after internal arc fault. – FEED [13] 2 10 Dropped objects – FEED [4, 5, 6] 15, 16A 11 Man overboard – FEED [11] 14 12 Loss of containment / spills to environment – FEED [17, 37] 1, 3 13 Hurricane / adverse weather - FEED [49] 20 14 Accumulation of snow and ice – FEED [44, 49, 50] 2 15 Security incidents – FEED [27] 15, 23 16 Global structural failure 20 17 Personnel injury due to electric shock – FEED [7, 10, 11, 12, 27] 14 18 Personnel injury due to material handling - FEED [4, 5, 6] 15 19 Excessive buildup of bird guano – FEED [45] 14, 20 20 Helicopter winching incidents – FEED [26] 15 21 Loss of communication systems – FEED [31] 4, 22 22 Failure of alarm management – FEED [42] 22 5 Risk and consequence description This section provides a description of the risks and consequences related to the hazards identified in section 4. 2, 3 18 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 5.1 Ship collision and vessel loss of position Rev. no. 02 Valid from: Ship collision with Service Operation Vessel (SOV), Crew Transfer Vessel (CTV), fishing vessel or passing merchant vessel. Collision may happen during vessel approach to transfer people via walk to work bridge, boat landing or for cargo handling. Reason for collision may be operator failure, failure of dynamic position system, vessel steering system or propulsion system, e.g. black-out of machinery. Consequences may be damage to CTV/SOV which may affect stability and floatability of the CTV/SOV. Personnel injuries and personnel into water may be a result. CTV’s/SOV (minimum of 3 CTVs across the two sites) will usually be the only vessels from the operator on the field and assistance may be left to randomly passing vessels and national rescue organization(s). SOV loss of position causing gangway impact to critical equipment/structures or personnel Loss of position before the gangway is in position may cause hit of structure which may be damaged. It may be risk that the W2W bridge is impacted too. If vessel loss of position occurs when bridge is in position it can be risk to personnel using the bridge or entering the bridge. 5.2 Explosion hazards Explosion as result of internal arcing fault in oil filled transformers and rupture/release of explosive gas and oil mist Internal electrical fault creates a high heat spot decomposing mineral cooling oil into flammable gas products. The explosion pressure of ignited released gas and oil mist has the potential to influence the building structure surrounding the transformers. Liquid leaks from the transformer can be expected. Explosion due to explosive atmosphere from battery hydrogen release Charging of batteries can cause release of hydrogen. The potential for release is dependent on battery type. Ignition of hydrogen gas leads to explosion inside the battery room. Explosion due to faults in electrical equipment Faults in high-voltage equipment can be developing fast and cause an explosion damaging equipment and harm people. 5.3 Fire hazards Fire in or around oil filled transformers. Heat or toxic smoke exposure to personnel Fire may start in transformers cooling liquid (oil) as result of internal arcing fault. Transformer fires may be more rapid and develop quickly, mainly because of the high voltage and that the cooling liquid is involved. Fire in electrical systems (short circuit, overload, malfunction of equipment). Heat or toxic smoke exposure to personnel A fire may start due to development of high temperature in components, faults or short-circuit. Some fires may start slowly and take some time to develop. Faults in high-voltage equipment can be developing fast. The OSS is configured in a 2 x 50% configuration. If a fire is contained within one train the power export can continue with reduced capacity from the other power train which is not affected by the fire. Spread of a fire on the OSS will stop the power export from the OSS and from the whole wind farm. Classification: Internal Status: Final Expiry date: 19 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: The OSS’s are remotely operated from the onshore control centre by the SCADA system. The OSS may have accessibility limitations depending on weather conditions. This may cause delays in entering, inspecting and rectifying damages caused by even a small fire. Fire in hydrocarbon systems (Hydraulic Oils, diesel engine, etc.). Other causes of fire are fire in diesel equipment including emergency generators, fire in shelter area, storage rooms etc. Risk to personnel is heat or toxic smoke, and potential for loss of escape route when the OSS is manned. 5.4 Insulation gas (SF6) hazards Oxygen deprivation / asphyxia and greenhouse gas release due to leaks of SF6 from gas-insulated switchgear (GIS) and gas-insulated busbars (GIB) SF6 is used as an insulation gas in high voltage switchboards, breakers and to segregate electrical leads to allow for low spacing between electrical leads. The gas is not harmful to personnel except for the risk of asphyxiation in case of leaks in closed spaces, but SF6 is one of the most potent greenhouse gases with a high global warming potential (GWP=22.000 vs CO 2 =1). The density of SF6 gas is considerably higher than the density of air and will accumulate in the lower parts of an area. Handling / exposure to SF6 decomposition products after internal arc fault. SF6 decomposes into toxic products in the form of a fine dust if the SF6 is exposed to high voltage sparks. This can happen if there is a fault in the equipment protected by SF6 or in case of a short circuit in the equipment. The decomposed products should be contained inside the equipment enclosure and in such case the cleaning can be performed in a controlled manner. However, there is no guarantee that the equipment enclosure resists the overpressure caused by the high voltage short-circuit and the decomposed products can enter the room where the equipment is located, or it can be released to the environment if used in outdoor equipment. 5.5 Other hazards Dropped objects Material handling from CTV to OSS is performed by the davit crane on OSS. Dropped load may drop onto CTV. Material handling between deck levels on OSS will be by crane lifting between laydown areas mainly above sea. Main risk for dropped object on OSS is related to maintenance tasks when equipment is lifted internally on the OSS. Man overboard Personnel entering from CTV will use fall arrest system to prevent them from falling into sea from the ladder. Onboard OSS handrails will be installed at the perimeter of the installation protecting personnel from falling to sea. Gates for W2W access are installed in the handrail at the bridge landing area and secured. In case of accident with man overboard there is no man overboard boat (MOB) located on OSS to assist. The CTV is in the field and will act as a MOB vessel in a man overboard situation. When SOV is in the field the MOB vessel on SOV is used. Loss of containment / spills to environment Extreme weather event (storm, hurricane) threatening structural integrity and leading to potential material damage and spill to environment. Liquid spills can be transformer cooling oil and diesel. Gas spills can be leaks of gas used for electrical insulation, e.g. SF6 type gas. Hurricane / adverse weather Classification: Internal Status: Final Expiry date: 20 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: OSS is unmanned installation and personnel shall not be present if weather forecast predicts bad weather. During planned visits it is a possibility that weather may worsen and prevent CTV from collecting the personnel. In such case personnel is left on OSS until weather improves or picked up by other means. Accumulation of snow and ice There is the possibility of ice collecting on access ladders, jacket structure, communication tower etc. in cold climates (both atmospheric and sea spray icing). Potential consequences of ice collection and potential drop of ice include equipment damage, injuries to personnel/third parties who may be in the area, issues accessing OSS for maintenance etc. Security incidents OSS is accessible by the boat landing (ladder from sea level) up to and including the cellar deck. Intruder protection is installed at cellar deck to prevent access to other areas of the OSS. It should be assumed that people who intend to pass the intruder barrier are authorised as competent to pass it. Global structural failure Global structural failure is related to main load bearing structure for substructure and topside. Types of incidents which can cause failure are: 1. Structure is not strong enough either due to its size, shape, or choice of materials. Catastrophic failure can occur if stressed beyond its critical stress level. 2. Fatigue or corrosion caused by instability in the structure’s geometry, design or material properties. These failures usually begin when cracks form at stress points. 3. Manufacturing errors, including improper selection of materials, incorrect sizing, improper heat tracing (heat treatment), failure to adhere to design, or poor workmanship. Can occur at any time and is usually unpredictable. 4. Use of defective materials. Unpredictable since the material may have been improperly manufactured or damaged from prior use (Prior use not relevant when new manufactured materials are used?). 5. Lack of consideration of unexpected problems. E.g., sabotage, natural disasters. Can also occur if those who use and maintain the construction are not properly trained and overstress the structure. OSS is manned only during maintenance periods and inspections which reduce the exposure of personnel in an event of global structure failure. Personnel injury due to electric shock Procedures for work on electrical systems shall be in place to ensure systems are isolated and made voltage free before work is started. Still it can be inspection work or failure to follow procedures which cause personnel to accidentally be in contact with live equipment. The consequence to personnel is dependent on the voltage level and range from fatality, coma, heart attack, burns, tingling or prickling sensations. Personnel injury due to material handling: A material handling report is to be made up taking in account the human interface with handling of the materials. Were cranage is needed, the aid is to be provided for that area. Bird guano: Bird deterrent systems are to be provided reducing the risk of bird guano contamination. Bird guano build up can result in an unsafe area (slippery and/or contamination) and/or corrosion. Helicopter winching: Medical evacuation of injured personnel in emergency situations by the Coast Guard is infrequent operations and will take place from the roof deck. Roof deck may be used for storage of containers and there is located obstructions for helicopter operations like platform crane and telecom mast to be considered by helicopter pilots. Loss of communication system: There are two types of communication. The verbal communication between OSS personnel and personnel at onshore control center or on a vessel, and the second type of communication is the data communication between the onshore control center and the OSS control and safety system which is controlling the power transmission systems on OSS. The verbal communication is handled by various systems providing back-up possibilities if one system is out. The data Classification: Internal Status: Final Expiry date: 21 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: communication between offshore and onshore control and safety systems may fell out, meaning that onshore control center cannot monitor the parameters offshore or control them until the communication is restored. Classification: Internal Status: Final Expiry date: 22 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 6 Offshore substation - Safety strategies 6.1 Containment (PS 1) Rev. no. 02 Valid from: Role and Need for Barrier Reference The containment function shall prevent release of flammable fluids or harmful fluids Relevant hazards • Transformer oil leaks • Diesel leaks (machinery, storage, and bunkering system) • Hydraulic leaks (e.g. from crane and winch) • Insulation gas (SF6) used on gas insulated electrical equipment Requirements All piping, tanks, valves, connections, pumps, rotating machinery, instruments, and other components in systems handling flammable fluids and/or harmful fluids (chemicals, toxic gases, etc.) shall be designed, constructed, maintained, and operated with the aim to avoid leaks to occur. Piping and other components shall be tagged and marked to identify fluids and prevent operational errors. (e.g. gas insulated equipment) Casing of oil filled transformers shall be of robust design. Ref. PS12 for details on transformer safety system requirements. All components and systems shall be designed to enable necessary inspection, testing and correction in compliance with established inspection program. Materials and connections used in piping systems shall as minimum meet the requirements in DNV-ST-0145 or project specific material selection report. Diesel bunkering system. All hoses and connections (hose assemblies) shall comply with TR1803. Classification: Internal Status: Final Expiry date: 23 of 78 TR1803 Hoses and couplings DNV-ST-0145 Offshore substations - Rules and standards C256-EQ-M-FD-00001 Material selection Philosophy – WTG foundations, Offshore Substation C274-RA-M-RA-01000 – MFW – Material Selection and Coating Report C274-RA-R-FD-01000 – MFW – Mechanical Design Brief granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Hose reel station: The hose shall be equipped with quick release auto close connection on the towards the CTV/SOV. The diesel bunkering system shall have integrity towards the maximum shut-in pressure of the pump at CTV/SOV. Diesel lines between bunded areas of hose reel station and diesel storage tanks shall be welded. 6.2 Natural ventilation and HVAC (PS 2) Role and Need for Barrier Reference Natural ventilation shall: • Dilute gas concentrations and reduce the size of flammable gas clouds • Dilute harmful concentrations of smoke or toxic gases • Ensure acceptable working and equipment environment HVAC shall, with respect to accidental events: • Provide smoke ventilation for internal fire conditions if active smoke ventilation philosophy is chosen to facilitate safe escape from manned areas • Ensure acceptable equipment environment • Dilute and remove concentrations of flammable or toxic gas Relevant hazards • Smoke generation from fire in diesel engine or transformer area exposing HVAC inlets to spaces with safety critical functions • Electrical fires within electrical rooms creating toxic atmosphere • Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere • Flammable gas accumulation / oil mist in transformer area in the event of internal arch fault and gas leakage from transformer casing • Release of decomposed products of SF6 gas in the event arc fault and burst of GIS casing Classification: Internal Status: Final Expiry date: 24 of 78 DNV-ST-0145 Offshore substations C274-RA-H-FD-01000 - MFW - HVAC Design Brief granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Requirements: Transformer area Natural ventilation is the preferred solution for the transformer areas. Battery rooms: Battery rooms shall be provided with sufficient ventilation to maintain non-hazardous status, forced or natural, according to DNV-ST-0145. Ventilation inlets and outlets Ventilation air inlets serving shelter area and emergency equipment rooms shall be located such that they are minimally affected by smoke from on-board incidents. Measures shall be taken to avoid accumulation of ice and snow. Dampers Dampers shall provide quick, reliable and effective means to prevent ingress or spreading of gas or smoke. If smoke is detected at ventilation air inlets, the ventilation fan in question shall be stopped and all inlet and outlet dampers closed. Dampers and fans shall be interlocked to avoid abnormal pressure configurations. Fire dampers shall be closed automatically by signal from the F&G-system or by “fusible link” where specified. If release of decomposed products (powder) of SF6 gas is detected (e.g. arc failure in GIS equipment followed by loss of SF6 pressure) the dampers in the rom shall be closed to prevent decomposed products to be distributed to other areas. Classification: Internal Status: Final Expiry date: 25 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 6.3 Leak detection (PS 3) Rev. no. 02 Valid from: Role and Need for Barrier Reference The leak detection system shall continuously monitor for the presence of flammable or toxic gases, to alert personnel and allow control actions to be initiated manually or automatically to minimize the probability of explosion, fire and acute effects of personnel exposure. Relevant hazards • Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere • SF 6 (or other insulation gas type) leak in GIS area or GIB resulting in potential risk of asphyxiation • Leak from inert gas storage bottles resulting in potential risk of asphyxiation Requirements: Battery rooms H 2 detection shall be installed in battery rooms if dangerous concentrations can accumulate. • Single H 2 detection shall give alarm in onshore central control room (CCR). • Confirmed H 2 detection in the room shall stop boost charging of batteries (if applied). Unless required by local regulation, H 2 detectors may be omitted if boost charging (if applied) is interlocked with room ventilation and batteries do not emit H 2 gas during normal charging, or if it can be documented that dangerous quantities of hydrogen cannot be generated. GIS rooms and GIB SF 6 gas density is approx. 6 times larger than air and might be an asphyxiate. If the quantity per gas compartment is small, however, it might not represent a personnel hazard. SF 6 detection may then be omitted with the following preconditions: • SF6 detection is not required by codes or regulation • Acceptable risk to personnel is confirmed by SF6 risk assessment, considering layout, volume, congestion, and ventilation of the GIS room/area. • Pressure monitoring is integrated into the GIS equipment. External flash beacon shall be provided at door entrance to warn personnel of potential SF 6 release (upon confirmed pressure drop in GIS compartment) Procedure shall be in place to ventilate GIS room, e.g. by opening doors, before entry in case of detected pressure drop in GIS compartment. Classification: Internal Status: Final Expiry date: 26 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference 6.4 Emergency Shutdown system (PS 4) Role and Need for Barrier Reference The purpose of the emergency shutdown system (ESD) is to prevent escalation of abnormal conditions into a major hazardous event and to limit the extent and duration of any such events that do occur. In addition, ESD initiations will activate (direct or indirect) other safety systems/functions such as HVAC (PS 2), Emergency power and lighting (PS 11), Alarm and communication system for use in emergency situations (PS 13). Relevant hazards - Abnormal condition on ONS, OSS or a WTG not detected and controlled by the Protection & Control system, e.g. high hydrogen concentration, smoke or flame detection, ship collision/ship on collision course etc. - Abnormal condition / loss of communication situation requiring local manual shutdown at ONS, OSS or WTG to ensure safety of personnel, environment or asset. Requirements: Shutdown functions, with logic solvers independent from the Protection & Control system, shall be available to perform necessary actions to protect personnel, environment and assets (ONS, OSS and WTGs) from abnormal conditions. A separate Emergency Shutdown System may be omitted if shutdown actions are included in the F&G logic solver. The shutdown actions may be initiated manually and automatically. Once initiated, actions shall be automatically executed. The shutdown functions shall be arranged in a tree-structured level hierarchy, reflecting different levels of facility or wind farm shutdown. The higher levels in the hierarchy shall initiate lower levels. A signal on a certain level shall not initiate actions on higher ESD levels. Classification: Internal Status: Final Expiry date: 27 of 78 DNV-ST-0145 Offshore substations C274-RA-S-FD-01000 - MFW - HSE Design Brief granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations MFW Bałtyk II & MFW Bałtyk III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Reference is made to Appendix B – Emergency shutdown philosophy – where a generic ESD hierarchy is presented. Shutdown levels for the OSS shall include: - Total substation shutdown (A and B system) including utility systems - Substation shutdown (A and B system) - System shutdown (e.g. A or B system) - Equipment shutdown Where relevant, remote equipment emergency shutdown shall be available through ESI control and protection system and be available in ESD HMI. A CAP panel with “Total shutdown” and “System A” and “System B” shutdown included as minimum shall be located in a strategic location on the OSS. Cascading effects shall be avoided. This implies that in some situations, a larger part of the facility or wind farm than directly affected by the incident in the first stage should be shut down Depending on the shutdown levels attributed to particular accidental event, ESD actions or their combinations shall include - Shutdown of HV equipment - Stop of auxiliary generator - Prevent start-up of equipment as required during an emergency situation, e.g. inhibiting the start-up of auxiliary generators during the shutdown of HV system - Disconnection of the substation from the grid - Start-up of auxiliary supply, load transfer of emergency services from transitional / emergency source of power - Activation of diesel shut-off valves - Shutdown of power ventilation - Stop battery charging - Closure of doors and ventilation openings - Initiation of audible siren signal Classification: Internal Status: Final Expiry date: Polenergia 28 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Any shutdown, spurious or intended, shall require a manual reset from onshore control room after normalization and systems have been confirmed OK to restart (e.g. by system status reporting / CCTV). ESD alarm annunciation Shutdown status shall continuously be available in the control room, and the system shall raise alarms in the control room for operator awareness or actions, considering: - Level of shutdown initiated - Shutdown function failure to execute actions upon demand - Shutdown function (sensor, logic solver or final element) defect or failure Personnel shall be warned to ensure safe escape and evacuation, ref. PS13. Upon shutdown (automatic or manual), general alarm shall be automatically initiated. An ESD alarm shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon ESD alarm. Logic solver The logic solver including I/O, logic and communication interfaces, shall comply with prevailing regulations and practices for normal operation, test and emergency situations. The logic solver compliance with the intended use and safety integrity requirements shall be demonstrated, i.e.: - Logic solver (firmware, as standard manufacturer provision) compliance with IEC 61508 shall be documented and certified / type approved (note: also valid for system software revisions). Use of existing non-certified equipment may be accepted subject to particular safety assessment and “prior use” characteristics. - Logic solver (hardware and software, according to user requirements) arrangement and application configuration shall be subject to acceptance based on independent verifications. System safety manual shall provide guidance to applications and application program development. ESD system units (logic solver) shall not be used for non-safety related systems. Classification: Internal Status: Final Expiry date: 29 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Logic solver shall include measures that prohibit unauthorized and avoid unintentional changes of system parameters, i.e. key-lock, password or software configuration. 6.5 Open Drain system (PS 5) Role and Need for Barrier Reference The purpose of the open drain system is to provide measures for containment and proper disposal of flammable or environmentally hazardous liquid spills, as well as handling wash-down, rainwater and fire water. The open drain system consists of equipment such as drip trays and bunding, drain pots and liquid seals, piping and pumping arrangement, collection and treatment tanks necessary to collect and handle spillage of hydrocarbon liquids, wash down water, fire water and rainwater. Relevant hazards: Release with potential damage to environment or prolonged fire from: • Transformers with mineral oil • Coolers for transformers containing mineral oil • Diesel leaks (machinery, storage, and bunkering system) • Hydraulic leaks (e.g. from crane and winch) Requirements Open drain systems shall be provided to contain and collect spills and leaks in all areas that have a source of flammable or environmentally hazardous liquid so as to minimize the risk of fires and personnel exposure to hazardous materials and avoid damage to the environment. Tanks and vessels containing flammable or environmental hazardous liquids shall have a bunding covering the tank perimeter to control the spread of spills. There shall be adequate drainage within the bunding. Classification: Internal Status: Final Expiry date: 30 of 78 C274-RA-R-SP-01001 - MFW - Pollution Prevention System Specification C274-RA-R-SP-01000 - MFW - Cleaning System Specification granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Guidance Dedicated bunding per tank or vessel may be exempted if part of a larger containment area provided with fire protection grating (restricting air to burning liquids and extinguish fire) and containment basin. End of guidance Open drain systems shall be designed with adequate slope to control spills. Cooler areas Open drain from the external cooler areas shall be connected to the oily water package including tank. Transformer areas: Leak containment criteria: The transformer areas shall be provided with fire protection grating and containment basins with minimum capacity for the largest transformer oil inventory in the area + firewater/foam liquid volumes +10%. An alternative to containment basin is a drip tray / bund area with fire protection grating and drains to collection tank with same capacities as specified above, The containment basins / collection tank shall be provided with overflow to sea, such that rainwater can be discharged in all conditions. Drainpipes from drip tray or bund area to collection tank shall be of sufficient size to drain the oil inventory in the tank without overflowing the drip tray underneath the transformer. There shall be means of continuous measuring of hydrocarbon content in the liquid to stop unwanted release to sea. National / local requirements to the system shall be observed and adhered to. The drain system needs to consider operability in cold climate. The overflow system shall: • control the liquid level in the containment basins / collection tank such that the leak containment criteria is met. • be designed such that liquid is removed from a section with continuous water phase of the containment basins • have sufficient capacity to handle the heaviest rainfall of 1-hour duration over a 10-year recurrence period. Auxiliary diesel engine skid The auxiliary diesel engine skid and diesel storage shall preferably be self-contained with capacity for the maximum potential diesel leak inventory, or alternatively be connected to open drain system on the installation. Classification: Internal Status: Final Expiry date: 31 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Hose reel station The hose reel station is envisaged to be in infrequent use and located at low level on the installation. Diesel bunkering will be a manned operation. The hose reel station shall be provided with bunding with capacity to minimum contain possible flow back diesel inventory in piping or hoses and credible pressurized leak before SOV/CTV supply pump is stopped. In case of a diesel leakage, removing the diesel from the bunding will be an operation requiring temporary pump and suitable tote tank to pump the diesel to. Segregation between areas The containment basins for Transformer A and B area shall be separated according to the fire division between the areas. The open drain system shall provide effective means, e.g., liquid seals if relevant, to prevent liquids, vapors and gases to spread to other fire areas via the drain system. The drain system, such as drain box and piping, shall not impair the integrity of fire partitions. 6.6 Ignition source control (PS 6) Role and Need for Barrier Reference The ignition probability of flammable liquids and explosive gas atmospheres shall be minimized by rendering the sources of ignition harmless or reducing the likelihood of occurrence of effective ignition sources. Relevant hazards: - Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere. - Electrical fault in transformers resulting in arc flash and flammable gas and oil mist released to atmosphere. - Release of flammable diesel oil mist inside diesel engine generator skid exposing hot surfaces. Requirements Classification: Internal Status: Final Expiry date: 32 of 78 DNV-ST-0145 Offshore substations - Rules and standards granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Battery rooms: Rev. no. 02 Valid from: Battery type shall be VRLA or other similar low hydrogen emission type. Boost charging of batteries shall not be used. The HVAC extract fans from battery rooms shall be certified for operation in zone 2. For further control of risk of hydrogen accumulation, it is referred to requirements to battery rooms in PS 2 HVAC and PS 3 Leak Detection. Transformer areas: Barriers to detect and shutdown electrical equipment and transformers upon electrical faults are described in PS 12 Process safety. Natural ventilation is preferred to minimize potential gas clouds, ref. PS 2 HVAC Diesel engine skids Hot surfaces inside generator skids that can potentially be exposed to diesel oil leaks shall be thermally insulated, e.g. internal exhaust ducting and turbochargers, 6.7 Fire detection (PS 7) Role and Need for Barrier Reference The fire detection system shall continuously monitor for the presence of a fire to alert personnel and allow control actions to be initiated manually or automatically to minimize the likelihood of fire escalation and probability of personnel exposure. The fire detection system shall, relevant to specific equipment and areas, monitor continuously for the presence of an incipient fire condition to alert personnel and allow control actions to be initiated manually to minimize the probability of a fire condition to develop. Relevant hazards: • Electrical fires (e.g. in electrical rooms) • Fires in oil filled transformers (mineral oil) • Diesel fires (Auxiliary diesel engine, diesel storage & supply) Requirements: Classification: Internal Status: Final Expiry date: 33 of 78 EN 54 all parts DNV-ST-0145 Offshore substations - Rules and standards IEC 61508 Functional safety of electrical/electronic/progr ammable electronic safety-related systems - granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference The fire detection function shall provide reliable and fast detection of a fire by adequate type, number and location of fire detectors and shall ensure timely alarm and initiation of control actions. Sufficient fire detection redundancy shall be implemented to ensure that the fire detection will be maintained if defect fire detectors are not repaired or changed immediately. Possibility for manual reset from onshore control room after normalization and systems have been confirmed OK to restart (e.g. by system status reporting / CCTV), to disable detectors etc. Detectors shall be provided based on an assessment of fire scenarios within each area considering potential fire sources and characteristics, consequences, area and equipment arrangement and environmental conditions. Design premises for determination of fire detection coverage shall apply flame size, smoke characteristics and temperature (heat) rise, established for each area, as basis (sensor number and distribution). The basis and assumptions used for detector selection and location shall be documented. Smoke dispersion studies may be performed for verification and optimization of location of detectors. The location of smoke detectors shall be confirmed by smoke dispersion tests for actual conditions inside rooms with and without ventilation. A mix of standard and high-sensitive smoke detectors shall be given preference for use as general detection in rooms containing P&C panels, automation/instrument/telecom panels and low voltage distribution boards and switchgears. Access to perform maintenance of detectors shall be planned for and documented. It shall be able to test detectors from deck level, test equipment shall be included as part of special tools. Areas requiring fire detection Fire detectors shall be provided in all areas where fires may occur and where ingress of smoke is to be prevented. Classification: Internal Status: Final Expiry date: 34 of 78 Part 1: General requirements granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Fire detector arrangements should be implemented in accordance with the following: Area / Room Detector type Comment Oil filled Transformer area and areas with flammable Flame liquids / gases Utility area without flammable liquids / gases Flame, heat or Detector selection dependent upon fire smoke characteristics Instrument rooms, Control room, LV electrical rooms Smoke High sensitive type for early warning and manual (rooms containing panels, cubicles, distribution shutdown. boards) Standard smoke detectors for automatic actions. HV Electrical rooms Smoke and/or flame Classification: Internal Status: Final Expiry date: Smoke detector suitable for high energy fires in addition to high sensitive type. Flame detectors to be evaluated for detection of HV arcs Diesel machinery spaces Flame Rooms containing gas bottles (typically inert gas for Smoke fire suppression system) Storage room for flammable materials Flame and/or E.g. paint or chemical storage heat Workshops, storage area without flammable Smoke or heat Type of activity to be considered materials HVAC inlets Smoke Confined spaces, e.g. below false floor, above Smoke ceiling Manual Call Points (MCP) Manual call points shall be located strategically, and in locations such as • Along escape ways • Embarkation areas, such as SOV/CTV landing area, etc. • At door (inside) for every exit to outside deck The maximum walking distance to a Manual Call Point in outdoor areas shall not exceed 30 meters. Manual Call points shall be protected against inadvertent activation and easily recognized by signs and color coding. 35 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Fire detector characteristics and calibration Fire detectors shall be self-monitoring. Detector safety characteristics should be optimized through preferences and adoption of best available technology including provisions of self-diagnostic. Flame detectors shall comply with actual fire potential and environment conditions within the relevant area, e.g.: • IR or UV where flame is predominating and according to flame wave radiation characteristic • Sensor range and cone of vision. Based on a typical flame detector characteristic, the distance between flame detectors and targets monitored shall be in accordance with current technology • Sensor direction and angle • Sensitivity to external impact such as arc welding Heat point detectors (electrical) characteristics shall comply with actual fire potential and environmental conditions within the relevant area, e.g.: • Normally limited use, i.e. specific high-risk areas and where other detection principles are not suitable. • Maximum coverage in naturally ventilated area approximate 24 m 2 , maximum distance between sensors 7 m and maximum distance from wall 4.5 m and minimum 0.5 meters away from outside wall or dividing partition. • Maximum coverage in mechanically ventilated area approximate 37 m 2 , maximum distance between sensors 9 m and maximum distance from wall 4.5 m. Smoke detectors characteristics shall comply with actual fire potential and environmental conditions within the relevant area, e.g.: • Optical detectors used for smoldering fires. • Detectors, e.g., ionic type, suitable for energy intensive smoke generating fires, e.g., fire in high voltage switchgear caused by short circuit. • Smoke detectors mounted in areas such as suspended ceilings and raised floors shall have their location indicated by visible tag-plate. • Early warning sensor specified with higher sensitivity than norm recommendation. • Maximum distance between sensors 11 meters, maximum distance from sensor to bulkhead 5.5 meters and minimum 0.5 meters away from outside wall or dividing partition. Fire detection actions Automatic initiation of actions shall include Classification: Internal Status: Final Expiry date: 36 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference • ESD (confirmed fire) • HVAC and fire damper shutdown, except for areas subject to smoke control (confirmed fire) • Activation of Fire Fighting Equipment (confirmed fire) • General installation alarm (confirmed fire) • MCP activation shall initiate alarm in central control room. Central control room to verify and initiate further actions and alarm on installation as required. Guidance Early smoke detection may be subject to manual initiation of actions only. End of guidance A fire alarm shall be presented in CCR on an OSS layout to easily identify location. Confirmed fire shall be based on voting between two or more fire detectors in alarm. Voting shall include all fire detectors within a defined area (any type of detectors) and exposed to the same fire scenario. The voting logic shall be arranged such that confirmed fire can be achieved with faulty detectors, and also including inhibited detectors unless safe detector inhibit is achieved by established operating procedures. The following voting principles should apply (for automatic actions only): Smoke (except areas such as accommodation or offices with manual intervention): Flame: Heat: • 2ooN detectors to reach specified alarm limit when N ≥ 3 Note: Smoke detectors are less likely to be used together with other types of fire detectors, and applications that require voting are not common. Smoke detectors covering enclosures and HVAC inlets shall not be voted together with other fire detectors in the same area. • 2ooN detectors to reach specified alarm limit when N ≥ 3 Classification: Internal Status: Final Expiry date: 37 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference • 1ooN detectors to reach specified alarm limit when N ≥ 2. 1ooN voting with highly reliable heat detectors to be approved by Company. Fire detection alarms Detection of fire, failure to execute actions upon demand and system defects shall be presented as alarms in Central Control Room (see also PS 22). F&G system status shall be continuously available in CCR, and the system shall raise alarms in CCR for operator awareness or action, considering: • Detection of fire or activation of Manual Call Point • Failure to execute action upon demand • Function (sensor, logic solver, final element) defect or failure. Status/alarm parameters for each individual fire detector shall be identifiable in the CCR. An F&G alarm condition shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon F&G alarm. CCTV coverage CCTV cameras shall be installed in order to help the control room operators evaluate appropriate actions following an alarm event on the unmanned substation. Evaluation shall be performed to identify relevant locations, but CCTV cameras shall as minimum be installed with sufficient coverage of transformer containment area and high voltage switchgear / GIS areas. Independence The F&G safety related functions shall fulfil their intended role independently of other control - and safety related control systems, Prerequisites to fulfil the independence requirements are: • Logic solver (firmware, as standard manufacturer provision) shall be certified / type approved to relevant standard (i.e. IEC 61508). Use of existing non-certified equipment may be accepted subject to particular safety assessment and “prior use” characteristics. • F&G safety related functions shall be realized in addition to and independent of installation basic control systems. • F&G system units (logic solver) shall not be used for non-safety related systems. • F&G sensor loop including accessories (e.g. air supply branch-off and power fuses) shall be separate from other functions, directly connected to F&G system unit. • F&G final element shall be operated directly from F&G system unit unless actions are executed through the ESD system. Classification: Internal Status: Final Expiry date: 38 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Possible use of common SAS data network and operator stations are addressed in automation discipline requirements. Same reference will apply to signal exchanged between different safety systems. 6.8 Active Fire Protection (PS 9) Role and Need for Barrier Reference The main purpose of the firefighting systems is to provide quick and reliable means for firefighting in addition to cooling of equipment and structures. Relevant hazards • Fires in oil filled transformers • Diesel fires (e.g. related to diesel storage or auxiliary generator) • Electrical fires Requirements Active fire protection strategy Fixed fire-fighting systems shall be installed in areas representing a fire risk, and particularly for equipment containing significant quantities of hydrocarbons or other flammable materials. The fire protection strategies shall take into consideration that manual intervention normally is not available at the unmanned substation. Asset protection shall hence be part of the considerations. The following active fire protection strategies are envisaged, but shall be further assessed and developed based on risk assessment: Area / room Active fire protection Comment Classification: Internal Status: Final Expiry date: 39 of 78 DNV-GL-ST 0145 Offshore substations - Rules and standards NFPA 101, Life Safety Code NFPA 850, Recommended Practice for Fire Protection for Electric Generating Plants and High Voltage Direct Current Converter Stations IEEE 979 - Guide for Substation Fire Protection granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Oil filled transformers Fixed expanding foam Diesel engine room/enclosure Electrical rooms, / instrument rooms system Classification: Internal Status: Final Expiry date: In combination with certified fire protection grating solution within bunding around transformers (ref. PS 10). Foam system extinguish and prevent pool fire on top of the fire protection grating and plated deck. The qualities of the grating prevent fire within the bound underneath the grating. Water mist In combination with remote operated or automatic isolation valve on diesel Inert gas suppression system (e.g. Argonite, inergen etc.) fuel line Fixed CO2 extinguishing systems shall not be used. The active fire protection systems shall have possibility of remote (onshore) and local activation. For automatically initiated systems, a manual release station shall be provided and conveniently located outside the area. The inert gas suppression system shall be one central system with valve-controlled distribution system to direct the suppression gas to the intended room. The inert gas system shall have 2x100% capacity to provide back-up coverage e.g. if the system is unintentionally released. Refer to Appendix A in this document for specifications for active fire protection systems. Manual fire fighting Fire extinguishers shall be provided in line with the fire assessment of the rooms and areas. The location shall be clearly identified with photo-luminescent signage in addition to all statutory signage. Any outdoor fire extinguisher and emergency equipment shall be located in cabinets. 40 of 78 NFPA 11 Standard for Low, Medium, and High- Expansion Foam, Chapter 7 Compressed Air Foam Systems NFPA 750 Standard on Water Mist Fire Protection Systems NFPA 2001 Standard for Clean Agent Fire Extinguishing Systems granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 6.9 Passive Fire Protection (PS 10) Rev. no. 02 Valid from: Role and Need for Barrier Reference Passive fire protection (PFP) shall ensure that relevant structures and equipment components have adequate fire resistance with regard to load bearing properties, integrity and insulation properties during a dimensioning fire, and contribute in reducing the consequences in general. Relevant hazards: • Escalation of fire between equipment (e.g. between adjacent transformers in one area) • Escalation of fire between rooms or areas (e.g. from transformer A to transformer area B or adjacent electrical rooms) • Escalation of fire to safety critical elements before the equipment has performed its intended duty in a fire scenario (e.g. UPS or control systems, muster area) Requirements: All rooms shall have bulkheads with rating A-0 or stricter, according to DNV-ST-0145. Bulkheads between Transformer A and B areas and between transformer areas and adjacent spaces shall be H-rated unless a lower fire rating is justified by structural fire response analysis. The fire divisions shall be capable of resisting dimensioning fire and explosion loads. Penetrations, e.g. for ventilation ducts, piping, cables, beams as well as doors in fire divisions, shall not reduce the fire and explosion integrity of the divisions. Doors in fire divisions shall be of a self-closing type. Load bearing structures / important elements shall have adequate fire protection to prevent unacceptable deformations or collapse during a dimensioning fire. However, contractor shall strive to reduce fire insulation to a minimum. Need for fire insulation of structure, piping etc. shall be assessed and justified. Coat back of attachments to main structures: If the contact area including the cross-sectional area inside hollow sections of an unprotected structural element is equal or larger than 1000 mm 2 per square meter of fireproofed structural elements, the need for coat back must be evaluated. To do this, the Classification: Internal Status: Final Expiry date: 41 of 78 DNV-ST-0145 Offshore substations IEC 60332 Test on electrical cables under fire conditions GL0644 Guideline Coat back on Steel Structure C274-RA-S-RA-01011 - MFW - Fire and Explosion Risk Analysis granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: actual structural design and utilization can be compared with the solutions described in GL0644. In most cases coat back can be avoided and it is not expected that the coat back distance in any case needs to be more than 150 mm. Cables for emergency services/safety services required to be operable under fire conditions shall be of a fire-resistant type, especially when they pass through high fire risk areas other than those which they serve. All other cables shall be minimum flame retardant as per IEC 60332. Containment around oil filled transformers shall be provided with certified passive fire-protecting grating (restricting air to the burning liquids and quenching of fire) to minimize risk of long-lasting pool fire, ref. PS 5. 6.10 Emergency Power and Lightning (PS 11) Role and Need for Barrier Reference The purpose of the Emergency Power and Lighting is to provide the following: - Electrical power when main power generation or supply is being shut down. - Emergency electrical power supply for a specific period of time for systems required to be in operation during or after a major hazard incident. - Sufficient lighting for evacuation and escape in an emergency situation. Requirements Emergency power supply Two redundant and independent UPS systems (2x100) with three (3) hours total capacity serving both emergency and non-emergency consumers shall be provided. Each emergency consumer is fed from each of the two UPS systems with local change over to ensure availability of the emergency services for minimum three (3) hours. Classification: Internal Status: Final Expiry date: 42 of 78 DNV-GL-ST 0145 Offshore substations EN 1838:2013, Lighting applications - Emergency lighting C256-EQ-Z-SP-00009 Offshore Substation (OSS) granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference The available UPS capacity shall, at any time when needed, ensure that safety systems will be kept operational during periods of accidental events, evacuation and escape. Reference is made to Appendix C for assessment of required emergency power and duration of emergency power. Emergency consumers to be supplied by the UPS shall include: • Emergency and escape lighting • Active fire protection (when firefighting equipment is dependent on emergency source of electrical power) • Control and communication systems required in an abnormal situation (incl. HV P&C) • Alarm systems • HVAC systems required to prevent overheating of rooms with safety critical or essential functions. Consumers supplied from the UPS shall also enable personnel to perform corrective actions to restore main power, this includes but not limited to: • Sufficient lighting at key areas • Strategically located sockets. Separate UPS system(s) with 96-hour capacity shall be provided for: • navigation lights • aviation warning lights • structure marking. Shut down of ventilation shall not cause temperatures above vulnerable components’ tolerance within the required operating time of the relevant installation safety systems. Minimum required operating time in this scenario is 30 minutes, to ensure availability of safety critical functions until escape and evacuation is completed. Guidance: Room temperature may exceed the maximum allowed continuous ambient temperature for a short section at the end of the period, provided that lifetime consequence is evaluated and found acceptable. Classification: Internal Status: Final Expiry date: 43 of 78 Topside Technical Specification C274-RA-E-FD-01000 - - Design Brief - Electrical Low Voltage Systems granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference End guidance. The emergency power system shall be monitored and raise critical status alarms in Control room. Emergency lighting: Emergency and escape lighting shall be provided in order to allow escape during emergency situations and provide sufficient lighting in areas which are manned during such events. This includes Escape routes, muster areas, SOV/CTV access gates, escape chute areas, helicopter winch area, sea illumination of boat landing and escape-to-sea systems. The emergency lighting shall be minimum 30% of the normal lighting level and ensure sufficient illumination for safe work in areas required to be manned during emergency situations. Escape lighting levels shall be minimum 15 lux at high risk task areas and evacuation stations and 1 lux on escape routes. Emergency exit signs shall either have an illuminated or fluorescent type of design. Survivability requirements UPS shall be located in protected area. Cables to emergency consumers shall be fire resistant. Emergency light fixtures without internal batteries, shall be arranged in A and B system, each supplied from separate redundant power sources. Classification: Internal Status: Final Expiry date: 44 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 6.11 Process Safety (PS 12) Rev. no. 02 Valid from: Role and Need for Barrier Reference Process safety means of protection, incorporating electrical and mechanical protection devices and safety instrumented functions, shall ensure that the process conditions do not exceed specified process safety limits. The main process for wind farms is understood as generation and transmission of electrical energy. The aim is to control any abnormal process operating conditions to prevent and/or minimize possible accidental events or releases. Typical actions, by means of protection devices include: • Process shutdown by tripping of Circuit Breakers (CBs) • Pressure relief The extent of a shutdown situation will depend on type of abnormality and may vary from shutdown of process sections with minimum effect on the production, to a total shutdown. Relevant hazards • Electrical faults resulting in short circuits / arcing events and subsequent fire or explosion scenarios. Requirements: Electrical faults are detected and cleared by protection relays without operator intervention. A SCADA system will be installed for monitoring of the wind farm plant. If abnormal condition is detected in the electrical systems, the operator in onshore central control room shall evaluate and consider appropriate actions. There will also be automatic actions based on predefined levels/limits. The control room shall be manned 24/7. High system reliability shall be ensured by: - Autonomous protection relays will clear any electrical fault in the system. Classification: Internal Status: Final Expiry date: 45 of 78 C274-RA-S-RA-01004- ELHAZ Report granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference - Primary protection relays are backed up by secondary back up relays if fault is not cleared by primary. Redundant protection relays are as minimum provided for main HV equipment and cables (e.g. transformers and export cables). - Relays from different vendors/models All relays onshore and offshore shall be communicating on redundant fiber networks (IEC61850). Transformer safety (electrical oil filled equipment) Each oil filled transformer shall be protected by redundant protection systems aimed to detect internal failures and quench an internal arc by the feeding circuit breaker. As minimum the following shall be provided as part of the short circuit protection: - Buchholz Relay (not redundant detection but redundant tripping) - Differential protection relay - Earth Fault protection The Transformers shall be equipped with a Pressure Release Valve (PRV) to protect the transformer tank in scenarios with gradual pressure build-up and low-energy arching faults (as result of fire exposure, oil filling operation or other maintenance operations or transformer malfunction scenarios). PRV shall be equipped with an external duct to guide the ruptured oil down below the deck grating instead of spreading to the surroundings. The PRV shall be designed to not limit the free flow of oil in any way. 6.12 Alarm and Communication System for use in Emergency Situations (PS 13) Role and Need for Barrier Reference GA, Alarm and communication systems for use in emergency situations shall: • Alert and inform personnel as quickly as possible in the event of a hazardous or emergency situation • Provide two-way communication of information regarding emergency events to the Control Room • Allow the co-ordination of rescue, recovery, and emergency assistance. Classification: Internal Status: Final Expiry date: 46 of 78 DNV-GL-ST 0145 Offshore substations granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Requirements Rev. no. 02 Valid from: All personnel onboard shall carry personal, two-way radios suitable for effective, intelligible communication. This is intended to replace the need for a dedicated public address (PA) system. The GA/alarm system, loudspeakers, alarm horns/ sirens, bells and flashing lights shall comply with prevailing regulations and practices to ensure that personnel will be alerted and informed in the event of an emergency situation. Layout and location of loudspeakers, horns/ sirens and bells shall be reviewed during design and verified during start-up and operation. This also applies to alarm/ flashing lights particularly with respect to areas with high noise level and possible toxic gas. Flashing light shall be installed in areas with noise levels exceeding 85 dBA. The alarm system shall be fully redundant (separate A system and B system). Alarm signals The alarm system shall distribute audio alarms, visual alarms and emergency messages, and shall be interfaced with the emergency shutdown and Fire & Gas systems for alarm input. Signal types, visual color codes and alarm types (e.g.: general, muster, abandon and toxic) shall be according to local requirements and practice. Emergency communication Minimum two means of communication shall be available between onshore CCR and OSS via redundant communication links (e.g. VHF radio, IP telephony, TETRA). A telephone system shall be installed on the OSS so that personnel can alert the onshore CCR. External emergency communication The facilities shall have necessary equipment for communications with external emergency response resources| Classification: Internal Status: Final Expiry date: 47 of 78 C274-RA-S-FD-01000 - - HSE Design Brief granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Radio system shall also provide marine communication to allow for co-ordination of active fire protection, response to marine pollution and emergency assistance. Equipment for communication shall be powered from dedicated battery supplies and/ or powered from the facility’s UPS system. 6.13 Escape, Evacuation and Rescue; EER (PS 14) Role and Need for Barrier Reference Escape and evacuation route and exits In the case of a hazardous incident, the purpose of escape and evacuation routes is to: • Ensure that personnel can leave the area(s) in question by at least one safe route • Enable personnel to safely reach the assigned mustering area from any position on the installation they are likely to occupy (and hence the designated embarkation area). • Enable rescue/medical teams to safely bring injured personnel to areas where medical treatment can be given Temporary refuges and embarkation areas (Muster area) The purpose of refuges and embarkation(mustering) areas is to. • Provide safe refuge on the installation as long as required for a controlled evacuation to be carried out. • Ensure easy, fast and safe entering of the evacuation systems in question Evacuation systems The purpose of the evacuation system(s) is to ensure safe means of evacuating the maximum POB. Rescue and safety equipment The purpose of rescue and safety equipment is to: • Provide personnel with necessary equipment to ensure safe EER Classification: Internal Status: Final Expiry date: 48 of 78 SOLAS Chapter III – Life Saving Appliances and arrangements I DNV-ST-0145 Offshore Substations CAP 437 Standards for offshore helicopter landing areas ISO 3864 Graphical symbols — Safety colors and safety signs granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference • Ensure that injured personnel are given adequate first aid treatment and a professional follow up, thus minimizing the effects from possible injuries. Requirements Escape and evacuation routes and exits Escape routes and muster area shall be provided enabling all personnel to safely leave the affected area(s) in case of a hazardous incident. A minimum of two independent escape routes leading from any area to muster area shall be provided. The muster area(s) shall be positioned in lower deck with close access to escape chutes, boat landing ladders and SOV gangway connection points. Survival suits shall be stored nearby or at muster areas. Escape routes shall preferably be provided on the outside, along the periphery of the installation, and be designed to be passable by position rather than by special protection. Escape and evacuation routes leading to a higher or lower level shall be provided by stairways. They shall be located nearly diagonally opposite each other as practicable. Hatches shall not be part of escape routes. Ladders can be used as part of escape routes in areas where the work is of such a nature that only a few persons (3 or less) are in the area on a short time basis when the platform is manned. The length of a stair flight or a ladder shall be as low as possible. The substation shall be designed for stretcher transport to embarkation points at the lower deck and to helicopter hoist area. It shall be demonstrated in all cases that equipment used for transportation of injured personnel can be turned at corners and in the staircases. Required width of main access / escape routes shall emphasize easy transport of injured personnel on a stretcher. The dimensions shall minimum be 1 m in width (0.9 m for doors) and 2.3 m in height (2050 mm for doors). Classification: Internal Status: Final Expiry date: 49 of 78 ISO 7010 Graphical symbols — Safety colors and safety signs – Registered safety signs C256-EQ-Z-SP-00009 Offshore Substation (OSS) Topside Technical Specification C274-RA-S-RA-01012 - Escape and Evacuation Assessment granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference There shall be at least two exits to escape routes from areas that are permanently or intermittently manned during inspection or maintenance visits, leading in different escape directions and situated as far apart from each other as possible. Internal room arrangement shall be considered for possible blocking of exits following an accident. Layout shall accommodate that escape from one area to another area with higher risk level is not required. Escape from a HV room may be through another HV room of same or lower risk level. All doors shall be constructed so that one person can easily open them from either side. They shall open in the direction of escape without blocking the outside escape route and be self-closing. This requirement should consider the effect of wind (1-year condition). If analysis shows that a door can be used from both directions during escape/evacuation, e.g. due to two separate incidents, a sliding door should be used. Doors that are normally locked can be accepted with opening in either direction in such cases. Corridors and dead ends shall not exceed 7 meters unless provided with at least two exits, one at each end. Survivability of escape routes Escape routes outside the area for the initial event shall be designed and protected so that at least one route of escape is available for the required period of time during a dimensioning accidental event. Personnel shall be able to use the escape routes without being exposed to excessive toxic fumes, smoke nor unacceptable heat loads, hot liquids or falling objects. Signs and markings A sufficient number of safety signs and markings shall be provided to convey necessary information to guide personnel in emergency situations and give clear information regarding directions/locations of various functions, areas and exits. Classification: Internal Status: Final Expiry date: 50 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Safety signs and markings shall conform with regional requirements and with reference to international industry standards, e.g. ISO 3864 and ISO 7010. Signs and markings shall be consistent throughout the plant, and the color code used shall be specific and not used for other purposes. A descriptive text shall be added to the sign if symbols are not easily understood. Text shall however be kept to a minimum. All signs/markings and their supports shall be constructed from robust material; durable and suitable for the intended use, the environmental forces and cleaning methods to which they will be subjected. Escape routes shall have signs/markings showing the preferred direction of escape. Escape and evacuation routes on plated decks shall be provided with a non-skid, oil resistant coating in yellow (RAL1023), unless local requirements regulate the color coding. On deck grating, two parallel 100 mm wide yellow (RAL 1023 if no other requirements are given) lines shall be painted indicating the width of the escape route. Escape and evacuation routes inside rooms with other floor finish than plated deck or grating, e.g. multipurpose and control room, shall be provided with low level fluorescent arrows showing correct escape direction. Other enclosed spaces shall be considered separately. Safety plans shall be strategically located / posted on the premises with high degree of accessibility. Such a plan shall include: • Locations of safety, rescue and firefighting equipment • Emergency exits, escape and evacuation routes • Evacuation instructions and legends Muster area The muster area is a safe place where personnel normally muster while emergency response are undertaken. Muster area shall be safe by position rather than by protection. Two easily accessible muster areas (primary and secondary) shall be clearly defined and separated from each other as widely as practicable. The muster areas shall be located in protected area at lower deck with easy access to the escape chutes, boat landing ladders and SOV gangway connection points. The muster areas, and the evacuation routes from muster area to the embarkation area in question, shall be arranged and protected in order to ensure the Classification: Internal Status: Final Expiry date: 51 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference safety of all personnel during the period required for the evacuation process to be completed in an organized and efficient way. The primary Muster Area shall remain unimpaired by excessive toxic fumes, smoke, unacceptable heat load, hot liquids and falling objects for minimum 60 minutes. Additional functions for the muster area are to provide first aid, information, and communication. The size of the muster areas shall as minimum correspond to N*0.4 m 2 , where N denotes maximum personnel at the substation. Emergency communication systems (e.g. telephone and UHF radios) shall be available at the muster station. At escape chutes waterproof portable VHF shall be available and adapted for use in life rafts. Evacuation systems Primary method of evacuation is to CTV via the boat landing ladders or to SOV via gangway connection, i.e. the normal method of getting to and from the installation. Secondary method of evacuation is helicopter winching from upper level of the OSS (medevac or non-emergency scenario) Tertiary method of evacuation is evacuation to sea by escape chutes with life rafts. Evacuation by SOV SOV will not be permanently connected when personnel are on-board the OSS. The SOV shall be able to react and connect with gangway to the OSS within 30 minutes upon request. The SOV walk-to-work system shall as minimum be operational for wave heights up to 2.5 m Hs. Classification: Internal Status: Final Expiry date: 52 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Weather conditions shall be monitored and personnel onboard the OSS shall be transferred to SOV prior to the critical weather condition is reached. The SOV shall be equipped with fast rescue craft and have emergency medical facility. Evacuation via CTV Minimum two boat landings shall be available for CTV access. Helicopter winching area A helicopter winching area shall be provided on the top deck. The winching area is for emergency scenarios when not requiring immediate evacuation. It is not intended for normal crew transfer nor normal goods logistics but may be used in exceptional cases for personnel transfer and/or goods logistics. Design and obstacle restrictions and visual aids marking shall be according to requirements for helicopter winching areas in CAP 437 and relevant local codes and standards. There shall be no obstructions such as antennas, masts or other equipment preventing helicopter access above the winching area. The maximum helicopter rotor diameter size shall correspond to type of SAR helicopters to be used in Polish waters. Escape chutes with life rafts Escape chutes with life rafts shall be provided on two separate locations of the installation arranged such as to maximize availability with respect to sea conditions. Each escape chute location shall have capacity for maximum POB. The escape chutes shall comply with air-gap requirements as specified in the OSS Topside Technical Specification and be located such that they are unimpaired by excessive toxic fumes, smoke, unacceptable heat loads, hot liquids and falling objects for minimum 60 minutes after all reasonably foreseeable incidents begin. The chute system’s life rafts and boarding raft shall be lowered together with the chute, and the boarding raft shall automatically inflate. Classification: Internal Status: Final Expiry date: 53 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference The escape chute system shall be readily available and easy to operate with clear operating instructions located on an appropriate place, e.g. on the wall inside container. Winch for recovery should be fed by main power. Removal of rafts for re-certification shall be possible without affecting the suspension system including lifting wire. Location and arrangement shall ensure easy lifting, installation and removal of the chutes. The evacuation-to-sea-equipment shall be type approved and tested according to IMO/SOLAS/LSA, code and national maritime regulatory requirements. Rescue and safety equipment Suits and life jackets Permanent cabinets for storage of survival suits (with floating and thermal protection abilities) shall be located at or close to the primary muster station, corresponding to the maximum POB on the OSS. The survival suit is personal safety equipment, meaning that each person on the installation shall have their own suit that is brought onboard and temporarily stored in the permanent cabinets. There shall be sufficient space around the cabinets to ensure quick dress up for the maximum number of POB. Additional storage of survival suits corresponding to the maximum POB shall be available at the muster station. Survival suits shall as a minimum be type approved according to IMO/SOLAS/ LSA Code, but additional requirements may come out of the EER analysis. The following applies: • Design should minimize impact to the neck of the wearer in case of jumping from a high level • Be of a color which is easily visible at sea (yellow, orange, etc.) • Have reflecting and/or fluorescent markings to facilitate rescue in the dark Life buoys Life buoys shall be installed at regular intervals on lower deck perimeter along the walkway, for guidance see DNV-ST-0145. Safety showers and eyebaths Classification: Internal Status: Final Expiry date: 54 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Need for safety showers or eyebaths and strategic locations shall be identified through a separate evaluation considering the chemicals handled and spillage that may occur or risk for burns or exposure of hot fluids to personnel. Potable water quality shall be used for safety showers and eyebaths. First aid kits and equipment An adequate number of first aid kits shall be provided at suitable locations and shall as minimum be provided at the Multipurpose room. The muster station / locker room shall further accommodate storage/space for first aid equipment such as medication, rigged stretcher and defibrillation equipment. Search and rescue equipment Breathing masks/smoke hoods for escape through areas exposed to toxic fumes or smoke shall be evaluated. Electrical rescue kits shall be available and easily accessible for personnel performing tasks in electrical rooms. 6.14 Layout Design Principles and Explosion Barriers (PS 15) Role and Need for Barrier Reference The layout and arrangement shall reduce the probability and the consequences of accidents through location, separation and orientation of areas, equipment and functions. The explosion barriers shall reduce the consequences of the pressure loads from an ignited cloud of released gas or oil mist to prevent the accident to spread to other areas and/or critical equipment. Classification: Internal Status: Final Expiry date: 55 of 78 TR3021 Electrical system design, offshore units DNV-ST-0145 Offshore Substations granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Relevant hazards • Safety critical functions impaired by accidental loads • Security incidents or accidents caused by third party entry to the installation • Explosion e.g. due to fault in oil filled transformers resulting in escalation between equipment or areas • Asphyxiation risk related to leaks from pressurized bottles (inert gas, SF6, N2) Requirements Areas or equipment of high-risk potential (e.g. oil filled transformer area) shall be segregated by sufficient distance or barriers from areas required to be of low risk potential, and from areas containing important safety functions. Incident escalation between areas shall be avoided. Muster and embarkation areas and rooms with safety critical functions shall be located at lower deck level, separated and protected by plated deck towards areas and spaces with higher risk potential which shall be located above (e.g. transformer areas, cooler areas). Physical security Access to boat landing and ladder up to lower deck level may be available for third party, but access to deck shall be controlled and locked for third party, e.g. by mariner cage or similar. The lock design on the mariner cage entrance door must facilitate escape from the platform. Ladder entry and boat landings shall be part of CCTV coverage. All rooms on the installation shall be locked as default. High voltage rooms locked with dedicated keys. High Voltage cabinets locked with pad locks. Ref high voltage (HV) safety rules. Explosion design principles for rooms for major electrical equipment The rooms shall withstand without any damage the highest blast pressure caused by a short circuit. As a general rule it is not necessary to do any calculations to document this requirement for short circuit levels up to the levels listed below (indicated as the maximum symmetrical root mean square (RMS) value of the sub transient fault current): - 11 / 6,6/3,3 kV: 40 kA RMS - 690 V: 50 kA RMS Classification: Internal Status: Final Expiry date: 56 of 78 C274-RA-S-SP-01000 - - Design Accidental Load Specification (DAL) granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference - 400/230 V: 30 kA RMS – Main distribution board; - 400/230 V: 10 kA RMS – Sub-distribution board For higher short circuit levels, the room integrity towards blast pressure caused by a short circuit shall be documented. Explosion design principles - Oil filled transformer areas The amount of venting available, the degree of blockage and congestion in the area significantly influence the severity of an explosion and shall be optimized to reduce explosion risk. Oil filled transformers should be located in natural ventilated area. Dimensioning explosion loads shall be established and implemented in design for structures and equipment. Explosion panels shall be provided in walls facing sea (if partially enclosed) in order to reduce explosion load potential. Storage of pressurized bottles (Inert gas, SF 6 , N 2 ) Storage of pressurized bottles should be in naturally ventilated area. If gas bottles are stored in enclosed spaces, introducing risk of asphyxiation, adequate ventilation shall be provided, and leak detection evaluated. 6.15 Offshore cranes (PS 16A) Role and Need for Barrier Reference The crane barrier shall reduce the probability that errors and hazards will arise during crane operation and reduce the possibility of boom or load fall. Relevant hazards Classification: Internal Status: Final Expiry date: 57 of 78 TR1727 Substitution to TR1727 ver 5, Unmanned installations granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference • Dropped objects impacting e.g. personnel, critical equipment, CTV or SOV, subsea cables etc. Requirements The offshore crane and davits shall comply with TR1727 Substitution for unmanned installations. The likelihood of crane boom or load fall as well as hanging loads hitting personnel or critical equipment shall be reduced as far as practicably possible. Crane coverage and laydown areas shall be arranged to promote safe operations of the cranes and free, unobstructed visibility to lay down and lifting zones for operator of the crane. There shall be no lifting zones above unprotected equipment or piping, containing flammable or toxic gas/liquid. Lifting zones to SOV/CTV shall be located such that lifting operations to the SOV/CTV can be done leeward of the predominant weather conditions. The lifting zones should be located away from cables to or from the OSS if practical. The cable protection system (CPS) shall be capable of handling relevant dropped object loads. The lifting zones shall be defined and available as a lifting map. Deck load limitation chart shall be established. A sign indicating maximum weight and loading rating shall be displayed at each laydown area. The cranes shall be equipped with necessary fire protection means, The crane shall be operable to a safe position in the event of an accident. The davit crane shall be capable and certified to lower injured personnel to CTV. Swinging load protection shall be implemented on laydown areas as required to prevent impact to critical equipment and critical damage to load bearing structures. This is also relevant in all foreseeable lifting zones from cranes on the OSS and use of SOV gangway and gangway associated SOV Classification: Internal Status: Final Expiry date: 58 of 78 DNV-ST-0145 Offshore Substations EN 13852-1 and 3 C274-RA-R-SP-01003 - Main Crane System Specification C274-RA-R-SP-01004 - Davit Crane System Specification C274-RA-R-SP-01005 - GIS Room Crane System Specification granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference associated crane (if equipped). The boat landing, including ladders and platforms, shall be designed with respect to impact / swinging loads from material handling. 6.16 Avoidance of vessel collisions (PS 19) Role and Need for Barrier Reference The Vessel Collision Avoidance System shall reduce the risk of vessel collisions. The surveillance of the sector around the installation may be performed by a central surveillance unit, a local surveillance unit (a unit or vessel responsible for more than one installation), a dedicated standby vessel or the installation itself. Hazards • Ship collision with infield vessels in transit (powered collision), e.g. Service Operation Vessel (SOV) or Crew Transfer Vessel (CTV), • Ship collision with SOV during approach (“drift on” or “drift off”) • Ship collision whilst in position next to the OSS (“drift on” or “drift off”) • Collision with fishing vessel or passing merchant vessel Requirements The unmanned OSS will not be equipped with a radar system. The collision avoidance strategy is based on surveillance by CTV/SOV when personnel is on the OSS, in combination with requirements to aids to navigational, wind farm layout and procedures for infield vessel movement. The OSS design shall incorporate AIS. CCR shall be able to survey the area around the OSS in all directions by CCTV. Field layout Classification: Internal Status: Final Expiry date: 59 of 78 International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) Recommendation O-139, The marking of man-made offshore structures (2013) granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference The OSS shall be located minimum 500 meter behind the straight line of wind turbines defining the perimeter of the wind farm (towards parallel navigational route). Wind farm internal transit routes shall allow infield vessels to pass the OSS with minimum 500 m clearance. SOV requirements (in the event SOV should be used on the windfarms) The SOV shall have minimum DP class 2 design. Operational procedure shall be in place for the SOV to approach and connect to the OSS on the leeward side of the installation with respect to the dominating environmental forces, such that SOV will drift away from installation if incapable of maintaining target position and/or heading. Aids to navigation (AtoN) The following AtoN measures shall as minimum be implemented on the OSS, each with an availability of no less than 99.0% (IALA Availability Category 2). • AIS base station • Foghorn • Marking of the substation in accordance international and national requirements. • DP laser reflectors Communication system System shall be in place for communication with vessel on collision course. SOV and CTV shall be equipped with necessary equipment to get attention from vessel on collision course, e.g.: • Signal lamps with intensity of minimum 1000 candelas • Megaphone with sound intensity of 80 dBa Fast rescue craft on the SOV shall be equipped with approved maritime VHF. Classification: Internal Status: Final Expiry date: 60 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Systems for consequence reduction and evacuation • Evacuation of personnel • ESD - platform shutdown 6.17 Structural integrity (PS 20) Role and Need for Barrier Reference Load bearing structure shall withstand all loading situations under normal operation and also ensure structural integrity after a dimensioning accidental event. Main design principles Load bearing structures shall be sufficiently robust to ensure that local damage or failure will not result in unacceptable consequences. • Slender, main load bearing structural elements shall be demonstrated to be redundant. • Main load bearing structures shall be designed so that water penetration through outer walls facing the sea cannot lead to loss of main safety functions. The topside structural integrity shall be documented for all governing conditions and phases during the platform lifetime, i.e. from prefabrication, assembly, weighing, site moves, barge transportation and installation to offshore hook-up, operation and abandonment. The jacket and topside structure shall be designed to withstand the Dimensioning Accidental Loads (DAL) associated with the following Major Accident Hazards (MAH) where relevant: Fire, Explosion, Dropped objects, Extreme Weather and Ship collisions. Recognized models/methods and competent personnel shall be used to determine the corresponding design accidental loads. Classification: Internal Status: Final Expiry date: 61 of 78 DNV-ST-0145 Offshore substations DNV-RP-C204 Structural design against accidental loads C256-EQ-Z-SP-00012 OSS Substructure Technical Specification C274-RA-S-SP-01000 - - Design Accidental Load Specification (DAL) granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference Dimensioning accidental loads and environmental loads shall not cause the loss of main safety function(s). Ship collision It is not considered practical to design for impact energies associated with a passing merchant vessel collision. This hazard shall be addressed by preventive measures (ref. PS19). The OSS shall be designed to withstand a collision of a service operation vessel up to 6000t displacement. For ALS, a ship impact speed of minimum 2.0 m/s shall be used with added mass as per requirements in DNV-ST-0145. Energy absorbed by striking vessel may be taken according to DNV-RP-C204. Some structural damage is considered acceptable under the above circumstances provided the overall structural integrity of the platform is not compromised. Collision with vessel superstructure shall be considered in design of the topside. Safety critical equipment or equipment that could cause environmental harm in case of a collision shall not be positioned at the outer faces of the topside. Layout around the OSS gangway landing areas shall prevent SOV DP failure (drive-off/drift-off) with inward movement of the gangway leading to an escalating event, e.g. by causing damage to safety critical equipment. Extreme weather Airgap requirements given in DNV-ST-0145 shall be fulfilled. The topside shall have positive air gap in all conditions, reference is made to the Offshore Substation Substructure technical specification for details. Classification: Internal Status: Final Expiry date: 62 of 78 C274-RA-N-FD-01001 - - Structural Design Brief (Topside) granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: 6.18 Human Machine Interface and Alarm Management (PS 22) Role and Need for Barrier Reference Human machine interface (HMI) in central control room (CCR) shall provide system information presentation and means for operator interactions. HMI provides the physical interface between systems and facility operator, maintenance technicians and other personnel operating and monitoring the facilities. The HMI shall present safety-related information for all systems, including: • Status of wind turbine generators (start-stop, trip/shutdown), substations, transmission system and grid connections • Status of navigational aids on the wind turbine generators and substations • Electrical overview, including status/position of high voltage switches and breakers, local isolations etc. • Weather monitoring/forecast, including lightning, sea state etc. • Fire detection on wind turbine generators and in substations • Location of vessels (service operating vessels, CTVs as well as other vessels) • Location of helicopters (where relevant) • Location of personnel • Status of work permits / work releases • For offshore structures: External CCTV monitoring. Internal CCTV monitoring to be considered. Night vision to be considered for external cameras. • Intruder detection for all wind turbine generators, substations • Natural ventilation and heating, ventilation, and air conditioning • Shutdown hierarchy overview and status • Fire & gas overview, e.g.., per main fire area and/or fire detection area The HMI shall include a main operating interface in CCR and allow for manual activation of critical safety functions. Classification: Internal Status: Final Expiry date: 63 of 78 TR 4031 Automation technology -Offshore wind TR4036 Operator station HMI – Offshore Wind Power EN 62682 Management of alarms systems for the process industries EEMUA Publication 191 Alarm systems - a guide to design, management and procurement EN ISO 11064 Ergonomic design of control centers Part 1: Principles for the design of control centres granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: Role and Need for Barrier Reference All systems and HMI designated critical for safety or production shall be designed such that easy, fast recovery methods can be employed to regain control of the system. This includes management of software backups and system components as well as documentation to facilitate recovery. The system shall be designed for continuous operation, such that system function is always maintained. The HMI shall be designed to prevent inadvertent operations due to operator misperception and unintended actions. EN 62682 and EEMUA 191 shall be used as basis for design of alarm functions. TR1494 and EEMUA Guideline 191 should be used for guidance. Failure to execute safety functions on demand shall initiate an alarm in CCR. The HMI facilities shall include detailed safety system information such as input and output status, alarms, status of inhibit, override and suppression and safety system fault indication. Number of visual display units shall depend on the result of the function and work task analysis. Failure to execute safety functions shall initiate an alarm in CCR. HMI control functions • Initiate shutdowns (ESD / process level) • ESD level reset • F&G reset (e.g., per fire detection area) • F&G common reset of inhibits and overrides (e.g., per fire detection area) • ESD common reset of inhibits and overrides • Firefighting release Requirements in EN ISO 11064 “Ergonomic design of control centers Part 1: Principles for the design of control centres” shall be adhered to Classification: Internal Status: Final Expiry date: 64 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 6.19 Safety & automation system security (PS 23) Rev. no. 02 Valid from: Role and Need for Barrier Reference The Safety- and Automation Systems, including other control and monitoring facilities, shall be protected against threats such as unauthorized access and malware that may be introduced due to external data communication and information exchange, i.e., by application of security measures of the technical networks. Barriers shall be installed to prevent intruders to access the topside deck levels of the OSS. CCTV surveillance of lower deck/top of jacket where unauthorized personnel may access shall be installed. Classification: Internal Status: Final Expiry date: 65 of 78 TR1658 Information Security of Industrial Automation and Control Systems IEC 62443 Network and system security for industrial-process measurement and control granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 7 Additional information 7.1 Abbreviations and definitions AIS Automatic identification system Rev. no. 02 Valid from: ALARP As low as reasonably practical (term is related to reducing risk level) ALS Accidental limit state CAP Critical action panel CCR Central control room CCTV Closed-circuit television CTV Crew transfer vessel DNV Det norske Veritas DP Dynamic positioning EER Escape, evacuation and rescue ESD Emergency shutdown ESI Electrical System Infrastructure F&G Fire and gas GA General alarm GIS Gas insulated switchboard GWP Global-warming potential HMI Human-machine interface HVAC Heating, ventilation and air conditioning IP Internet Protocol IR Infra-red MCP Manual call points MFW Morska Farma Wiatrowa MOB Man overboard boat ONS Onshore substation OSS Offshore substation PA Public address P&C Process and Control POB People on board PRV Pressure release valve SAR Search and Rescue SCADA Supervisory Control and Data Acquisition SF6 Sulfur Hexafluoride SOV Service operation vessel TETRA Terrestrial Trunked Radio UHF Ultra-high frequency UPS Uninterrupted power supply UV Ultraviolet VHF Very high frequency VRLA Valve regulated lead–acid WTG Wind turbine generator Classification: Internal Status: Final Expiry date: 66 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 7.2 Definitions Rev. no. 02 Valid from: Fire division class A Fire rated physical division between two fire areas. A division made of non-combustible materials fulfilling the following criteria: 1. it shall be sufficiently braced 2. it shall prevent the propagation of flames and smoke for a minimum of one hour of the standardized fire test following the temperature-time curve defined in ISO 834-1, 3. it is designed so that the average temperature and the temperature at any single point on the unexposed side does not exceed 140 degrees C and 180 degrees C respectively above the initial temperature within the time limits stated below: Class A-60: 60 minutes Class A-30: 30 minutes Class A-15: 15 minutes Class A- 0: 0 minutes Fire division class H Fire rated physical division between two fire areas. A division made of non-combustible materials fulfilling the following criteria: 1. it shall be sufficiently braced, 2. it shall prevent the propagation of flames and smoke for a minimum of two hours of the standardized fire test following the described time- temperature curve defined in EN 1363-2, 3. it is designed so that the average temperature and the temperature at any single point on the unexposed side does not exceed 140 degrees C and 180 degrees C respectively above the initial temperature within the time limits stated below: Class H- 120: 120 minutes Class H-60: 60 minutes Class H-0: 0 minutes Offshore substation Offshore installation which receives the electrical power produced at the wind turbine generators, transform the voltage to a higher level suited for export to shore and export the power to onshore. Offshore windfarm The offshore area where the wind turbine generators are located. Offshore substation is located within the offshore wind farm. 7.3 Changes from previous version Revision no. 02: General - Minor updates on wording and references. Section 4 - Additional hazards identified. Section 6 - References to relevant FEED reports added in section 6 – Safety strategies. Appendices – New appendix B and Appendix C added. Classification: Internal Status: Final Expiry date: 67 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 8 References 1. DNV-ST-0145 Offshore substations - Rules and standards 2. C274-EQ-Z-SP-00001_04 - Metocean Design Basis 3. C275-EQ-Z-SP-00002_04 - Metocean Design Basis. Rev. no. 02 Valid from: 4. C256-EQ-Z-CA-00001_02 Clarification of ice strength coefficient for 5. TR1055 rev 9 Performance Standards for safety systems and barriers - offshore 6. TR1803 Hoses and couplings 7. IEC 61508 8. IEC 61511 9. EN 54 series 10. NFPA 101, Life Safety Code 11. NFPA 850, Recommended Practice for Fire Protection for Electric Generating Plants and High Voltage Direct Current Converter Stations 12. IEEE 979 - Guide for Substation Fire Protection 13. NFPA 11 Standard for Low, Medium, and High-Expansion Foam, Chapter 7 Compressed Air Foam Systems 14. NFPA 750 Standard on Water Mist Fire Protection Systems 15. NFPA 2001 Standard for Clean Agent Fire Extinguishing Systems 16. IEC 60332 Test on electrical cables under fire conditions 17. GL0644 Guideline Coat back on Steel Structure 18. EN 1838:2013, Lighting applications - Emergency lighting 19. IEC61850 20. SOLAS Chapter III – Life Saving Appliances and arrangements I 21. CAP 437 Standards for offshore helicopter landing areas 22. ISO 3864 Graphical symbols — Safety colors and safety signs 23. ISO 7010 Graphical symbols — Safety colors and safety signs – Registered safety signs 24. TR3021 Electrical system design, offshore units 25. TR1727 Substitution to TR1727 ver. 5, Unmanned installations 26. DNV-RP-C204 Structural design against accidental loads 27. TR 4031 Automation technology -Offshore wind (HOLD not yet issued) 28. EN 62682 Management of alarms systems for the process industries 29. EEMUA Publication 191 Alarm systems - a guide to design, management and procurement 30. EN ISO 11064 Ergonomic design of control centers Part 1: Principles for the design of control centres 31. IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 1: General requirements 32. C256-EQ-Z-SP-00009 Offshore Substation (OSS) Topside Technical Specification 33. C256-EQ-Z-SP-00012 OSS Substructure Technical Specification 34. TR1658 Information Security of Industrial Automation and Control Systems 35. IEC 62443 Network and system security for industrial-process measurement and control Classification: Internal Status: Final Expiry date: 68 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 9 Appendices Rev. no. 02 Valid from: 9.1 Appendix A - Specification for active fire protection systems Water mist system The water mist systems shall provide a quick and reliable discharge of water mist at a sufficient density and at sufficient duration for fire suppression and control. Operating devices shall include water mist releasing devices or valves, discharge controls, and shutdown equipment necessary for successful performance of the system. Easily accessible manual release facilities shall be provided at main entrances to the areas. The ventilation (fans and/or dampers) shall be closed and the area disconnected before release of water mist systems. The water mist cabinet shall be located outside of the protected space. Compatible materials shall be used throughout the system, e.g. nozzle / distribution piping. The water mist skid including compressed gas bottles shall be certified for the actual maximum operating pressure. Release duration and design should be in accordance with contractor’s recommendations, and/or typically range from 5 up to 30 minutes as indicated in NFPA 750 depending on application. IMO MSC/CIRC: 668, 728, 913 & 1165 can also be consulted. Inert gas system The inert gas firefighting system shall provide a quick and reliable discharge of gaseous agents for fire mitigation at sufficient concentration and at sufficient duration for fire suppression and control, whilst retaining an atmosphere non-harmful to humans. Inert gas system shall be one central system with valve-controlled distribution system to direct the system toward intended room. The inert gas system shall have 2x100% capacity to provide back-up coverage if e.g. inert gas system is unintentionally released. The ventilation (fans and/or dampers) shall be closed and the area isolated before release of gaseous systems. The room where the gaseous agent is released shall be sufficiently tight to maintain the prescribed concentration for the pre-determined time period of minimum 10 minutes. The compressed gas bottles shall be certified for the actual maximum operating pressure. The gas bottles shall be located outside of the protected room and the location is to be carefully chosen with respect to easy replenishment. Classification: Internal Status: Final Expiry date: 69 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: In order to enable personnel to evacuate before gas discharge, appropriate means for warning of gas release prior to release shall be provided, i.e. clearly visual and audible alarms. All rooms protected by gaseous agents shall be furnished with clear audible and visual means for system status annunciation on the outside at the room entries. Where appropriate, the system shall be monitored to enable the detection of faults which may affect the operational efficiency of the system. Protection by use of CO2 or other noxious and poisonous gases is not allowed. Fixed foam system Foam system shall provide a quick and reliable supply of firefighting foams with the correct foam concentration for a minimum pre-determined time period. A fixed self-contained foam system shall be used for transformer areas. The foam shall be expansion type foam suitable to maintain a protective foam layer. The design of foam systems shall be based on recognized international standard, e.g. NFPA 11. The self-contained foam system shall be designed to operate in freezing conditions. Foam concentrate shall be of a quality which withstands freezing conditions. The foam system shall be released upon signal from the instrumented fire and gas detection system as well as by manual release. The foam system shall as a minimum have the following monitoring with signal transfer and alarms to control room: • Volume water/foam • Pressure propellant • Alarm upon released system Foam release valves shall fail in last position upon loss of signal from F&G logic supplied with diagnostics alarm to CCR. Classification: Internal Status: Final Expiry date: 70 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 9.2 9.2.1 9.2.2 9.2.3 Rev. no. 02 Valid from: Appendix B - Emergency shutdown philosophy and shutdown hierarchy Introduction are separate entities, each consists of a wind farm with WTG’s, one offshore substation, and one onshore substation. The onshore substations are co-located in same area, separated by some distance and fence. Each development consists of two independent power transmission trains (A & B system) through the OSS and the ONS. From the ONS each wind farm continues with one power cable each to the Third party owned TSO station. are controlled from the common onshore control centre located in Leba, approximately 80 km driving distance by car to the onshore substations. Control and protection system In normal operation the electrical transmission system is controlled and protected by the control and protection system. The control and protection system monitor the transmission system and will disconnect parts of, or the whole system in the event of a failure in the system. Such disconnection is performed by electrical protection systems, interlocks, intertrips etc. In modern control and protection systems the protection functions are performed by IEDs (Intelligent Electronic Devices) communicating on a 61850 system. The protection system contains several layers of protection, and it is normally one protection function for each type of error in an IED. In addition there are spare protection functions in another IED. It may be further additional layers of spare protection included in the system. High-voltage systems have an increased level of safety, and it is normal to have redundant primary protection functions and two secondary protection functions as back-up. The protection system is a fast-acting system and normally acting within milliseconds when an internal failure is detected. To have selectivity the secondary protection normally has 50-100 milliseconds delay for a controlled shutdown of the faulty part. Safety functions for emergency events In addition to a robust and efficient control and protection system, it shall be available safety functions to handle abnormal conditions which are not managed by the control and protection system. Potential incidents which may occur in the production and transmission of wind power is limited to incidents related to high, medium, and low voltage equipment, diesel fuel, and batteries (e.g. high hydrogen concentration, smoke, or flame detection). For offshore installations, potential risk for ship collision is also relevant. Shutdown functions allocated to these safety functions are denoted emergency shutdown (ESD) functions to distinct them from those initiated by the control and protection system. The emergency shutdown function is a safety barrier which shall be independent of, and in addition to, the normal control and protection system. [However, some shutdown functions may be performed via the protection system when independence from control of the incident can be demonstrated, e.g. closing or opening of breaker on another installation.] An abnormal condition on one of the facilities may partly or fully affect the other facilities: 1. Wind turbine generators (WTG’s) 2. Offshore Substation (OSS) 3. Onshore Substation (ONS) 4. 3. Party TSO station 5. [Onshore control centre due to investigation and potential rectifying the event] Classification: Internal Status: Final Expiry date: 71 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 9.2.4 Rev. no. 02 Valid from: Abnormal conditions at 3. party TSO station can affect one or both wind farms. However, it is not expected to have automatic ESD actions between the 3 party TSO station and the B. The consequences at B of an abnormal condition at TSO area are expected to be handled by the normal control and protection system. Hardware transfer of ESD signals between installations via the ESD logic solver should be avoided. Such communication should be via dedicated redundant fibre, alternatively via control and protection system. It is expected that the control and protection system on installations upstream and downstream of the affected installation is intact to perform the required control and shutdown based on the response/power transmission from the affected installation. Shutdown principles The ESD functions are arranged in a three-structure level hierarchy designed to suit the installation with the largest need, i.e. the OSS. The ESD hierarchy consist of the following shutdown levels: • ESD 1: Total shutdown of facility ESD 1 is the highest level of shutdown and shall be initiated manually only. • ESD 2: Facility shutdown. Disconnection of all incoming Electrical power to the facility (e.g. shutdown of A & B system) • ESD 3A/3B System shutdown. Disconnection of single transmission system (System A or System B) The specific shut down actions for each level may vary between facilities, e.g. WTG’s will be different from substations. A principle shut down hierarchy for an offshore substation is shown below in figure 1. Classification: Internal Status: Final Expiry date: 72 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 ESDI E5D2 ESD3A Note 1 Equipment , r shutdown Notes Manual pushbutton and manual from SCADA HMI Manual push- Button in field Start diesel generator -Manual from CCR -Local push button General Alarm Note 7 Figure 1 ESD hierarchy. Muster ala rm -Shutdown diesel generator -Prevent start of diesel generator Notes to figure 1 ESD hierarchy: Manual from CCR (CAP/HMI) Release 1. ESD 3A/3B denotes transmission system A and system B. Rev. no. 02 Valid from: Less of communication with cc ntrol system at su bstati on Time delay Note Z Confirmed Fire detection System A Note 6 F re fighting Equipment In relevant area Note 3 Time delay Isolate Equipment System A 'Slow" / controlled shutdown of WTG Classification: Internal Status: Final Expiry date: Timer based shutdown of: General alarm system Fire detection system Control and protection system Radio/external comm unication Note 4 E5D3B .Notes isolate system A from grid Note 1 same input /output as ESD SA 73 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: 2. A time delay of e.g. 2 hours should be implemented before shutdown is activated. The time delay could be longer as the control/protection system still operates and safeguard the transmission system. NB! Loss of communication is understood as loss of both MPLS communication lines between installation and CCR at same time. 3. On automatic fire detection in a power transmission train, a signal to be sent to WTGs control system to perform a controlled stop (soft stop) of WTGs. 4. Time delay for activation of ESD level 3 to be implemented to allow a fast soft stop of WTGs. 5. OSS: For each incoming inter-array cable to the transmission system the breaker on the WTG closest to the OSS and the onshore breaker on export cable shall be opened to de-energize the transmission system. ONS: The onshore breaker on the offshore export cable and the breaker on the transfer cable to the transmission substation shall be opened to de-energize the onshore transmission system. Inter-trip to open export cable offshore breaker and breaker at transmission substation recommended. 6. Automatic firefighting system released automatically upon confirmed fire detection while transmission system is still running down and energized. 7. ESD push button initiate hard stop of WTGs (due to breakers on IAC open) of, and immediate electrical isolation of power train. 8. On the utility shut down level, shut down and isolation of utility systems, utility equipment and support functions to the transmission trains shall be executed by the electrical protection system and fire detection system according to developed Cause and effect diagrams, e.g. electrical isolation of GIS switchboard upon confirmed detection of lack of isolation gas. Release of fire protection system for utility areas, e.g. diesel generator shall be executed by fire detection system. 9.2.4.1 Wind turbine generators The individual WTGs are controlled according to the turbine vendors own hazard and risk evaluations which form the basis for the design and type approval of the WTG. In the event of shutdown of a transmission train, the WTGs are prevented from delivering the power and will be stopped. Either by signal for controlled rundown of the WTG or an emergency stop initiated by the control system for the turbine. Detection of events on a WTG and the status of actions shall be alarmed and displayed in the onshore control room. 9.2.4.2 Offshore substation (OSS) ESD functions shall be realised according to DNV-ST-0145 by using a separate logic solver. Alternatively, upon agreement with Owner, the fire and gas logic solver can be used. The logic solver, or the fire and gas logic solver, shall be mutually independent of the control and alarm system related to the same equipment under control. The defined ESD actions shall be initiated automatically and manually by pushbuttons at defined locations. Initiating event, detection and status shall be alarmed and displayed in onshore control room. The following shutdown levels for Offshore substation are assumed (ref also figure 1): ESD-1 - Total shutdown of facility. Total substation shutdown will isolate the substation from the grid and de-energize the substation. UPS power will be isolated after a predefined time delay. Only systems left operating are Nav aid systems including marking lights. ESD-1 should be initiated if there is a danger of a catastrophic incident e.g. an external owned vessel can collide with the offshore substation. Decision to activate ESD-1 will be made upon evaluation of the ship Classification: Internal Status: Final Expiry date: 74 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: surveillance of the area, or by a responsible personnel visiting the facility. It is expected that personnel on the offshore substation in such case are in radio contact with onshore control room and can request a shutdown to be initiated from the control room. Hence pushbutton for ESD-1 level is not required installed on the offshore substation. Upon ESD-1 the following shall be initiated: • Muster alarm on OSS • Shutdown of diesel generator • Prevent start of diesel generator • ESD-2 level which entails: o Both transmission system A and B be isolated and de-energized, o All WTGs connected to the substation are given stop command, alternatively WTG’s will stop immediately when OSS shut down, o Breakers on OSS side on export cables shall be open, the need for opening breakers on ONS side to be evaluated, Nav aids, fire alarm system and fire extinguishing system shall still be available for the duration of their required battery time. Monitoring of ship collision should be available via UPS. ESD 1 should be available for remote reset from CCR if it is verified by surveillances systems that collision did not happen, (i.e. last-minute averting). ESD-2 Substation shutdown (A & B system). ESD-2 shut down the substation transmission systems A & B and isolate the substation from the grid. Auxiliary generator, UPS power and utility systems are still connected and available. ESD2 shall be initiated as follows: • Automatically with time delay upon loss of communication with control system between onshore control room and substation (i.e., loss of signal resulting in no information from the C&P on installation shown on the screens in the CCR), • Manually from onshore control room • Potentially manually from pushbuttons at OSS if found required by the safety strategy. Upon ESD-2 the following shall be initiated: • ESD level 3A and ESD level 3B • Start diesel generator. ESD-3A, ESD-3B System shutdown. ESD 3 level shut down each individual power transmission system, i.e. system A or system B, in the event of an emergency incident affects one of the areas where the individual train is located. The individual train is also isolated from the grid. Shutdown of an individual train e.g. system A do not affect the other train, system B, which will continue its power transmission to shore. ESD 3A/3B shall be initiated as follows: • Automatically with time delay upon confirmed fire detection within one of the areas for the individual systems (i.e. transformer area, switchgear rooms, electrical equipment rooms), o The confirmed fire detection shall • send stop signal to WTGs for controlled and fast rundown of the turbines. Classification: Internal Status: Final Expiry date: 75 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: • immediately initiate the fire extinguishing system for the area where fire is confirmed. • Manually from pushbuttons in the field • Manually from CCR. Upon ESD 3A/3B the following shall be initiated: • Activate general alarm. • Isolate/de-energize the affected room or equipment from the transmission power (i.e. shutdown the transmission train). WTGs connected to the individual system is automatically shut down as consequence of no possibility to deliver the power. • Isolate the system from the grid. Equipment shut down. Utility systems, utility areas and other areas e.g. auxiliary diesel generator and diesel system, are monitored by fire and gas detection system and are shut down by fire and gas detection system and the control system. Equipment shut down of individual equipment shall be automatically initiated in the event fire is detected in equipment or in the area the equipment is located. Equipment shut down shall also be initiated if flammable or toxic gas is detected in an area with equipment which contain gas or which in a failure condition is able to produce flammable/toxic gas, e.g. batteries, Upon equipment shutdown the following shall be initiated: • Equipment shall be stopped and electrically isolated • Alarm and status signal to onshore control room • Alarm personnel onboard OSS Active fire protection, mechanical ventilation and closure of fire dampers shall be controlled as required by the fire and gas logic. 9.2.4.3 Onshore substation (ONS) To be developed in separate document. Classification: Internal Status: Final Expiry date: 76 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: 9.3 Appendix C – Assessment of emergency power and UPS The assessment intends to document the background for the chosen solution for emergency power and duration of operation of the UPS based on relevant parts of DNV-ST-0145. 1. OSS is defined as type A substation – i.e. unmanned substation, persons are onboard only for inspection and maintenance, no overnight stays on OSS are planned. However possibility for emergency overnight stay is available in the event personnel cannot be picked up from the substation as planned. 2. DNV definition of island condition: - An offshore substation is in islanded condition when the electrical connection with the external grid is not available. Consideration of islanded condition is mandatory for offshore substations of type B and C, see [DNV-ST-0145 section 3.3.2]. For offshore substations of type A, see [3.3.2], the same requirement applies unless it is assured that evacuation of personnel on board can be initiated immediately upon the occurrence of islanded condition. Possibility of immediate evacuation presumes availability of primary means of evacuation on or in direct vicinity of the offshore substation. Evaluated evacuation time shall in no case exceed 30 minutes. Emergency services shall be available during islanded condition. [Comment: offshore substations is type A and could be designed without possibility for island mode condition. The CTV will be in the area while personnel are on board the substation. The substation can be evacuated within 30 minutes using the CTV, maybe slightly more than 30 minutes if using the SOV. However, all emergency systems are intact, and power supplied by UPS.] 3. Emergency services - Emergency services are those services that are essential for safety in an emergency condition. Examples of equipment and systems for emergency services: -equipment and systems that need to be in operation in order to maintain, at least, those services that are required to be supplied from the emergency source of electrical power -equipment and systems that need to be in operation in order to maintain, at least, those services that are required to be supplied from transitional source(s) of emergency electrical power -equipment and systems for starting and control of emergency generator sets -equipment and systems for starting and control of diesel engines for emergency fire-fighting pumps, if any. Requirements for emergency services are given in [DNV-ST-0145 section 5.5.3]. 4. Emergency condition - An emergency condition is a condition under which services needed for normal operational and habitable conditions are not in working order due to a failure of the main source of auxiliary power system as a consequence of a malfunction or an accidental event including fire, flooding, extreme waves and similar. Worst case scenarios and necessary emergency services and procedures shall be considered during the design process. At least the emergency power consumers given in Table 5-2 shall be available during emergency condition. A schematic presentation of the emergency condition is given in DNV-ST-0145 Appendix C. [Comment: Services needed for habitable conditions are not relevant for OSS as the substations are not intended for planned overnight stay. This should also be reason to relax on the duration of emergency services given in table 5-2.] Classification: Internal Status: Final Expiry date: 77 of 78 granularity=word contentanalysis={punctuationbreaks=false dehyphenate=false} layoutanalysis={tabledetect=0 layoutdetect=0} Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from: 5. DNV Section 5.5.2 Main power of auxiliary power system - On offshore substations of type B and C, main source of power supply for auxiliary power system required for islanded condition shall be dedicated generator set(s) located on the offshore substation. [Comment: Since OSS are substations of type A it is not a requirement to have a main source of power supply for auxiliary power system for island condition.] 6. 5.5.3 Emergency power supply of auxiliary power system. - Includes emergency generator and batteries. The emergency source of electric power is a source of electric power intended in the event of outage of main power supply for auxiliary power system to supply electric power to the emergency switchboard (ESB) and/or equipment for emergency services. Requirements: a) Self-contained, safe location, separate from auxiliary power, automatically connected to emergency switchboard, if it is a generator it shall be automatically started and in 45 seconds supply at least the services required in Table 5-2 upon loss of main power supply. [Comment: According to point 6 a.) it is clear that the emergency power supply do not need to consist of an emergency generator. Hence, sufficient battery capacity is acceptable as emergency power supply.] 7. 5.5.3.4 Capacity of emergency source of power - Shall supply emergency services listed in table 5-2. Conclusion: The electrical power available shall be sufficient to supply all services essential for safety in an emergency, with due regard being paid to such services as may be operated simultaneously, also taking into account starting currents and transitory nature of certain loads. [Comment: Table 5-2 also list required duration for emergency services but it don’t reflect the difference in Type A substation which is evacuated immediately and Type B & C substation which can be inhabited. For substation type A as for OSS, the need of emergency services is limited to escape and evacuation to CTV, firefighting, F&G detection, and potential CCTV surveillance for a period (to be decided) after evacuation. There is no planned overnight stay on OSS which would require long duration of emergency power, e.g. while waiting for transport to shore.] The substations have two main power systems (system A & system B) supplied from the grid via EATs. I.e. redundant main power. In addition the substations are equipped with a diesel generator each which can operate for 7 days in island mode condition, but not defined as emergency generator. Finally the substations are provided with redundant UPS battery banks providing emergency power for a total of 3 hours if the main power and diesel generators fails. Substations are unmanned and no planned overnight stay, personnel are evacuated to the CTV located on the field. Hence the need for several of the emergency services are limited after the personnel is evacuated. UPS with 3 hours duration as emergency power after loss of main and auxiliary power is considered sufficient. However it may be seen as a deviation to current wording in DNV-ST-0145 re. requirement of 18 hours emergency power as DNV do not describe substation of Type A very well. But there is no logic of having 18 hours duration of emergency power for a substation of Type A which is expect shall be evacuated when there is no power from the grid available. Classification: Internal Status: Final Expiry date: 78 of 78 0.00 1.00 0.00 0.00 0.33 0.38 0.45 0.42 0.17 0.49 0.50 0.53 0.58 0.29 0.43 0.28 0.02 0.48 0.46 1.00 0.81 0.90 0.93 0.34 0.25 0.40 0.43 0.04 0.04 0.68 0.18 0.13 0.47 0.45 0.22 0.09 0.32 0.35 0.04 0.27 0.81 0.03 0.03 0.78 0.02 0.02 0.46 0.09 0.45 0.71 0.84 0.20 0.14 0.29 0.33 0.46 0.20 0.11 0.15 0.32