This document describes the safety strategy for the offshore substation. The safety strategy is input to the development of the substation and shall be further detailed during the engineering phase to document conclusions on safety aspects relevant for the development of the offshore substation and interface with the wind farm.The safety strategy describes how risks are to be managed based on the outcome of a systematic identification and evaluation of the hazards and effects which may arise on the specific installation.The aim of developing the specific safety strategy is to identify installation specific philosophies, strategies and requirements. This information shall outline the design principles for layout, configuration, arrangement, the selection and role of safety barriers to manage risk on the installation. Further the safety strategy shall define initial performance requirements and design requirements.In general, requirements in DNV-ST-0145 Offshore Substations shall apply, but this Safety Strategy provides supplementary requirements and clarification of safety barrier strategies applicable to the Wind project. In case of conflicting requirements, the requirements in this safety strategy shall prevail.The document shall be used as specification for safety related aspects including detection and mitigation hazardous situations and events. This document shall however not restrict designers in developing the most optimized design. The safety strategy shall be updated by Company during the engineering phases. Contractors who perform design of the OSS shall contribute with input to the strategy document, addressing specifics related to their proposed concept. If solutions chosen / proposed by Contractor conflicts with this document, Company shall be consulted.The safety strategy is structured according to the Company defined barrier systems, with the objective to:• Describe the need for and role of barriers that are established to manage risk related to major accidents.• Visualize the connection between risk and hazard evaluations specific to the offshore substation and the wind farm hazards• Establish adequate understanding of the barriers in order to make correct decisions and understand their role.• Form a basis which can be used as a management tool to keep the integrity of the barriers intact during operation and modifications.The safety strategy is a lifecycle document and shall follow the installations into the operation as documentation of the safety barriers and for follow-up of the safety barriers. This safety strategy is established for the project phase intended to suite engineering and construction work.This document describes Company minimum requirements. However, if national authority requirements are stricter these shall prevail.This safety strategy covers the offshore substation (structures, equipment and control of the OSS) and subsea installations within the scour protection area around the jacket.Target group for this document is the Company project organization, Company operations organization and project engineering, design Contractors and authorities. Furthermore, the document can be used as supporting documentation to Authority submissions.FEED documents with document number type C274-RA-x-xx-nnnnn added as reference document in section 6 represent the status of the FEED phase and shall be considered as guidance only. The solutions presented in the referred FEED documentation shall not prevent Contractors from further improvements and development of the proposed design.The areas of interest are in the southwestern Baltic Sea within Polish waters with water depths ranging from 20m to 45m. The total area of is 122 km 2 and the total area of is 117 km 2 .are located 55 and 60 km respectively from the windfarm boundary to the landfall location near Ustka, and a further 10 km from the landfall point to the Onshore Sub Station (ONS) at Slupsk (distances calculated along the export cable corridor). Closest straight-line distance to shore is 36 km from the perimeter of and 22 km for .Both project´s cable arrays shall have a dedicated Offshore Sub Station (OSS), centrally located in each park, directing export cables through a single route to shore.Potential future wind farms are being developed around and between the area of as shown in FigureOffshore Wind Law, Phase 1 Areas Wind Farms, other possible future areas Bird Migration Corridors Protection Areas (Natura 2000)Figure 1 - Neighbouring future offshore wind farmsThe scope of the wind farm development encompasses wind turbines (WTGs), their foundations, inter-array cabling, one offshore substation per wind farm, an export cable system, a landfall, two separate substations in one common area and the connection to a transmission grid substation where the electricity will be exported to the Polish power grid. The two projects have according to the Polish regulatory requirements a combined maximum capacity of 1440 MW, 720 MW per wind farm. A schematic visualization of the project scope is shown in Figure 2.The power production from the WTG’s is split into two separate power production trains, A and B train. The two trains are physical segregated from each other to avoid accidents in one train to influence the other train.• Roof with possibility for Heli hoist (medevac or special lifts)Base case for access to the OSS is by CTV during the operations phase via access ladders from sea level. In addition, landing areas for use of service offshore vessel (SOV) and walk to work bridge shall be installed. The SOV size can be up to 6000 tons displacement. The SOV or the CTV will not stay connected when personnel are onboard but located in the field at a distance outside the safety zone. The OSS will be visited approximately once a year for routine inspection and maintenance activities and every three years for a planned outage maintenance campaign.• C274-EQ-Z-SP-00001_05 (MAD RE2019-006 rev 4) - Metocean Design Basis• C275-EQ-Z-SP-00001_05 (MAD RE2019-007 rev 4) - Metocean Design Basis.Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:All-year wind rose 10 m above sea level are shown in Figure 3 for and figure 3 forFigure 3 - All-year wind rose for for the period 1980-2018 Baltyk 111 - All yearThe current rose at surface for are shown in Figure 7 and Figure 8 respectively.Wet snow may accumulate on surfaces and vertical structures, e.g. communication mast. Atmospheric icing is possible. Estimated ice thickness (data for 50 yrs available) at 100 meters on cylinders and non-rotating structure elements is approx. 30 mm. Specific assessment atmospheric icing on OSS is not performed. Sea spray icing is caused by freezing sea spray. Sea spray icing can be expected up to 25 meters above sea level and with the thickest ice layer of up to 80 mm (100 yrs) between 5-10 meter. There will also be ice accumulation below 5 m but not during extreme storm when large waves will transport heat to the lower region of the structure and the ice is exposed to thermal and mechanical deterioration. These values are equal for .Sea ice can occur at and an average ice season is in range of 10-20 days while maximum duration is about 40 days. Expected annual probability of occurrence of ice is approximately 10 -1 . The sea ice thickness at 100 years return period is estimated in ref /C256-EQ-Z-CA-00001_05 / to be 0,38 m for and 0,39m for .There are fishing activities within both wind farms and along the route for the export power cables. Within the wind farms the type of fishing gear used is bottom nets. There are also fishing vessels passing through the wind farms as there is an area for trawl fishing north of the wind farm areas.There are ship navigation routes both south of and north of the wind farms. AIS data show very low density of ship traffic in the vicinity of the wind farms as per today. When WTGs are present in the future and the sea maps are marked, the ship traffic is expected to be even lower. The OSS is located within the windfarm surrounded by the WTGs.Reference is given to Appendix E of the Contract.In general, systems that are easy to design, operate and maintain will be safer than more complex designs. This is also valid for design of safety systems. In priority it is recommended to develop our plant designs in the following order, ref Figure 9:Elimination of hazard - design it out Substitution - use something less hazardousTable 1 Description of consequence (impact) categories (Internal reference R-24383, RM100)Table 2 Interpretation of colours in design phase (internal reference R-11452, RM100)The following main safety functions are further defined for the OSS:• The main load carrying capacity (structure) shall be intact until the installation has been evacuated (in manned scenarios), which means that there must not be extensive deformation or collapse of the whole or considerable parts of the installation before evacuation.• Installation parts with functions that are vital to combat accidents and/or ensure safe shutdown shall be intact until the emergency activity has been completed or the facility has been evacuated.• Mustering areas, evacuation means, and other areas defined as “safe areas” shall be protected so that they remain intact until the facility has been evacuated.• At least one escape route for personnel in other areas than the area(s) exposed to the initial accidental event shall be intact until all personnel have escaped to safe area.The annual probability of loss of the main safety functions shall be lower than 1 x 10 -4 for each of the following accidental loads:• Heat loads (e.g. due to fires in combustible materials such as transformer oil, diesel etc.)• Smoke and toxic loads (e.g. due fires in combustible materials such as transformer oil, diesel etc.)• Explosion loads (e.g. related to transformer failure)• Impact loads (e.g. collision loads from vessels, dropped object loads from lifting operations, etc.)• Extreme environmental loads, such as o Wind, wave, current o Sea ice o Icing o EarthquakeBased on a perceived well known and controllable risk picture, these quantitative criteria may be assumed complied with by using the following minimum design criteria:• Platform structural integrity and robust layout shall secure safe escape from all areas of the platform during an incident, maintaining the main safety functions• The fire protection design shall ensure that a fire or explosion in the equipment is contained and will not lead to escalation to other areas or parts of the electrical system. Segregation of transformers and other criticalequipment shall be ensured so that a fire or explosion in one transformer does not lead to complete loss of production• A fire- and explosion analysis is required to document the design and ALARP evaluations shall be made. o Transformer Fire: The dimensioning fire load for oil-filled transformers are determined by the pool fire subsequent to a transformer explosion scenario (an explosion will rupture the transformer resulting in loss of transformer oil to the surroundings). The size of the pool is determined by the size of the bunding, or containment area and a typical heat flux can be of the order of 150 kW/m2. The duration of the pool fire will be determined by the evaporation rate (typical 50 g/m2/s) and the drain capacity in the area. o Transformer Explosion: The dimensioning explosion load for oil-filled* transformers are determined by an internal electrical arc, leading to a transformer rupture resulting in an ignited gas cloud (containing both oil mist and pyrolysis reaction products). The energy involved (for gas cloud size) is determined by the circuit breaker time and the transformer rating.• Impact loads - vessels: The structure shall be designed to withstand a collision from SOV with displacement of 6000 t and vessel speed minimum 2 m/s as per requirements in DNV-ST-0145.• Extreme Weather: The installation is designed to as minimum withstand the 100-year return period storm conditions without experiencing any impairment of the safety functions or integrity of the installation. The installation is unmanned in extreme weather, but it shall as minimum be designed for a 1000-year return period ALS event.If the above points are adhered to, further quantification is deemed unnecessary. Otherwise, normal quantitative risk analysis shall be performed.Barriers shall be in place to prevent a single event to developing into major accidents. A traditional barrier diagram illustrating the principle of barrier functions to prevent unwanted events and consequences are shown in Figure 11Reduce probability of fault, hazard and accident situationsIdentify conditions that can lead to fault, hazard and accident situationsReduce possibility of fault, hazard and accident situations developing into unwanted eventFigure 11 - Barrier diagram indicating barrier functions (shown in red) to prevent unwanted events and consequences.Company has, based on systematic review of different hazard and accident scenarios, internal and external requirements, international standards and best practices, established company requirements to barriers for O&G facilities classified as performance requirements and sorted by performance standards (PS). The company performance standards for O&G offshore facilities are provided in TR1055. Relevant performance standard definitions are used in this safety strategy for the OSS in order to provide a comparable basis towards the standardized barrier definitions within the Company, see Table 3. The role and need for barriers according to this structure are provided in chapter 6.Table 3 Performance Standards (PS) for the offshore substationShip collision with Service Operation Vessel (SOV), Crew Transfer Vessel (CTV), fishing vessel or passing merchant vessel. Collision may happen during vessel approach to transfer people via walk to work bridge, boat landing or for cargo handling. Reason for collision may be operator failure, failure of dynamic position system, vessel steering system or propulsion system, e.g. black-out of machinery. Consequences may be damage to CTV/SOV which may affect stability and floatability of the CTV/SOV. Personnel injuries and personnel into water may be a result. CTV’s/SOV (minimum of 3 CTVs across the two sites) will usually be the only vessels from the operator on the field and assistance may be left to randomly passing vessels and national rescue organization(s).SOV loss of position causing gangway impact to critical equipment/structures or personnel Loss of position before the gangway is in position may cause hit of structure which may be damaged. It may be risk that the W2W bridge is impacted too. If vessel loss of position occurs when bridge is in position it can be risk to personnel using the bridge or entering the bridge.Explosion as result of internal arcing fault in oil filled transformers and rupture/release of explosive gas and oil mist Internal electrical fault creates a high heat spot decomposing mineral cooling oil into flammable gas products. The explosion pressure of ignited released gas and oil mist has the potential to influence the building structure surrounding the transformers. Liquid leaks from the transformer can be expected.Explosion due to explosive atmosphere from battery hydrogen release Charging of batteries can cause release of hydrogen. The potential for release is dependent on battery type. Ignition of hydrogen gas leads to explosion inside the battery room.Explosion due to faults in electrical equipment Faults in high-voltage equipment can be developing fast and cause an explosion damaging equipment and harm people.Fire in or around oil filled transformers. Heat or toxic smoke exposure to personnel Fire may start in transformers cooling liquid (oil) as result of internal arcing fault. Transformer fires may be more rapid and develop quickly, mainly because of the high voltage and that the cooling liquid is involved.Fire in electrical systems (short circuit, overload, malfunction of equipment). Heat or toxic smoke exposure to personnel A fire may start due to development of high temperature in components, faults or short-circuit. Some fires may start slowly and take some time to develop. Faults in high-voltage equipment can be developing fast.The OSS is configured in a 2 x 50% configuration. If a fire is contained within one train the power export can continue with reduced capacity from the other power train which is not affected by the fire. Spread of a fire on the OSS will stop the power export from the OSS and from the whole wind farm.The OSS’s are remotely operated from the onshore control centre by the SCADA system. The OSS may have accessibility limitations depending on weather conditions. This may cause delays in entering, inspecting and rectifying damages caused by even a small fire.Fire in hydrocarbon systems (Hydraulic Oils, diesel engine, etc.). Other causes of fire are fire in diesel equipment including emergency generators, fire in shelter area, storage rooms etc. Risk to personnel is heat or toxic smoke, and potential for loss of escape route when the OSS is manned.Oxygen deprivation / asphyxia and greenhouse gas release due to leaks of SF6 from gas-insulated switchgear (GIS) and gas-insulated busbars (GIB) SF6 is used as an insulation gas in high voltage switchboards, breakers and to segregate electrical leads to allow for low spacing between electrical leads. The gas is not harmful to personnel except for the risk of asphyxiation in case of leaks in closed spaces, but SF6 is one of the most potent greenhouse gases with a high global warming potential (GWP=22.000 vs CO 2 =1). The density of SF6 gas is considerably higher than the density of air and will accumulate in the lower parts of an area.Handling / exposure to SF6 decomposition products after internal arc fault. SF6 decomposes into toxic products in the form of a fine dust if the SF6 is exposed to high voltage sparks. This can happen if there is a fault in the equipment protected by SF6 or in case of a short circuit in the equipment. The decomposed products should be contained inside the equipment enclosure and in such case the cleaning can be performed in a controlled manner. However, there is no guarantee that the equipment enclosure resists the overpressure caused by the high voltage short-circuit and the decomposed products can enter the room where the equipment is located, or it can be released to the environment if used in outdoor equipment.Dropped objects Material handling from CTV to OSS is performed by the davit crane on OSS. Dropped load may drop onto CTV. Material handling between deck levels on OSS will be by crane lifting between laydown areas mainly above sea. Main risk for dropped object on OSS is related to maintenance tasks when equipment is lifted internally on the OSS. Man overboard Personnel entering from CTV will use fall arrest system to prevent them from falling into sea from the ladder. Onboard OSS handrails will be installed at the perimeter of the installation protecting personnel from falling to sea. Gates for W2W access are installed in the handrail at the bridge landing area and secured. In case of accident with man overboard there is no man overboard boat (MOB) located on OSS to assist. The CTV is in the field and will act as a MOB vessel in a man overboard situation. When SOV is in the field the MOB vessel on SOV is used.Loss of containment / spills to environment Extreme weather event (storm, hurricane) threatening structural integrity and leading to potential material damage and spill to environment. Liquid spills can be transformer cooling oil and diesel. Gas spills can be leaks of gas used for electrical insulation, e.g. SF6 type gas. Hurricane / adverse weatherOSS is unmanned installation and personnel shall not be present if weather forecast predicts bad weather. During planned visits it is a possibility that weather may worsen and prevent CTV from collecting the personnel. In such case personnel is left on OSS until weather improves or picked up by other means. Accumulation of snow and ice There is the possibility of ice collecting on access ladders, jacket structure, communication tower etc. in cold climates (both atmospheric and sea spray icing). Potential consequences of ice collection and potential drop of ice include equipment damage, injuries to personnel/third parties who may be in the area, issues accessing OSS for maintenance etc. Security incidents OSS is accessible by the boat landing (ladder from sea level) up to and including the cellar deck. Intruder protection is installed at cellar deck to prevent access to other areas of the OSS. It should be assumed that people who intend to pass the intruder barrier are authorised as competent to pass it. Global structural failure Global structural failure is related to main load bearing structure for substructure and topside. Types of incidents which can cause failure are:communication between offshore and onshore control and safety systems may fell out, meaning that onshore control center cannot monitor the parameters offshore or control them until the communication is restored.Safety strategy for offshore substations MFW Bałtyk II & MFW Bałtyk IIIDoc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:Diesel engine skids Hot surfaces inside generator skids that can potentially be exposed to diesel oil leaks shall be thermally insulated, e.g. internal exhaust ducting and turbochargers,Battery rooms: Battery type shall be VRLA or other similar low hydrogen emission type. Boost charging of batteries shall not be used. The HVAC extract fans from battery rooms shall be certified for operation in zone 2. For further control of risk of hydrogen accumulation, it is referred to requirements to battery rooms in PS 2 HVAC and PS 3 Leak Detection.Transformer areas: Barriers to detect and shutdown electrical equipment and transformers upon electrical faults are described in PS 12 Process safety. Natural ventilation is preferred to minimize potential gas clouds, ref. PS 2 HVACRole and Need for Barrier Reference Fire detector arrangements should be implemented in accordance with the following:Area / Room Detector type Comment Oil filled Transformer area and areas with flammable Flame liquids / gases Utility area without flammable liquids / gases Flame, heat or Detector selection dependent upon fire smoke characteristics Instrument rooms, Control room, LV electrical rooms Smoke High sensitive type for early warning and manual (rooms containing panels, cubicles, distribution shutdown. boards) Standard smoke detectors for automatic actions.Smoke detector suitable for high energy fires in addition to high sensitive type. Flame detectors to be evaluated for detection of HV arcsDiesel machinery spaces Flame Rooms containing gas bottles (typically inert gas for Smoke fire suppression system) Storage room for flammable materials Flame and/or E.g. paint or chemical storage heatSmoke or heat Type of activity to be considered materials HVAC inlets Smoke Confined spaces, e.g. below false floor, above Smoke ceilingManual Call Points (MCP) Manual call points shall be located strategically, and in locations such as• Embarkation areas, such as SOV/CTV landing area, etc.• At door (inside) for every exit to outside deckThe maximum walking distance to a Manual Call Point in outdoor areas shall not exceed 30 meters.Manual Call points shall be protected against inadvertent activation and easily recognized by signs and color coding.The main purpose of the firefighting systems is to provide quick and reliable means for firefighting in addition to cooling of equipment and structures.• Diesel fires (e.g. related to diesel storage or auxiliary generator)Active fire protection strategy Fixed fire-fighting systems shall be installed in areas representing a fire risk, and particularly for equipment containing significant quantities of hydrocarbons or other flammable materials. The fire protection strategies shall take into consideration that manual intervention normally is not available at the unmanned substation. Asset protection shall hence be part of the considerations.DNV-GL-ST 0145 Offshore substations - Rules and standardsNFPA 850, Recommended Practice for Fire Protection for Electric Generating Plants and High Voltage Direct Current Converter StationsThe following active fire protection strategies are envisaged, but shall be further assessed and developed based on risk assessment:IEEE 979 - Guide for Substation Fire ProtectionOil filled transformers Fixed expanding foam In combination with certified fire protection grating solution within bunding system around transformers (ref. PS 10). Foam system extinguish and prevent pool fire on top of the fire protection grating and plated deck. The qualities of the grating prevent fire within the bound underneath the grating.Diesel engine Water mist In combination with remote operated or automatic isolation valve on diesel room/enclosure fuel lineElectrical rooms, / Inert gas suppression system Fixed CO2 extinguishing systems shall not be used. instrument roomsThe active fire protection systems shall have possibility of remote (onshore) and local activation. For automatically initiated systems, a manual release station shall be provided and conveniently located outside the area.The inert gas suppression system shall be one central system with valve-controlled distribution system to direct the suppression gas to the intended room. The inert gas system shall have 2x100% capacity to provide back-up coverage e.g. if the system is unintentionally released.NFPA 11 Standard for Low, Medium, and High- Expansion Foam, Chapter 7 Compressed Air Foam SystemsNFPA 750 Standard on Water Mist Fire Protection SystemsNFPA 2001 Standard for Clean Agent Fire Extinguishing SystemsRefer to Appendix A in this document for specifications for active fire protection systems.Manual fire fighting Fire extinguishers shall be provided in line with the fire assessment of the rooms and areas. The location shall be clearly identified with photo-luminescent signage in addition to all statutory signage.Any outdoor fire extinguisher and emergency equipment shall be located in cabinets.actual structural design and utilization can be compared with the solutions described in GL0644. In most cases coat back can be avoided and it is not expected that the coat back distance in any case needs to be more than 150 mm.Cables for emergency services/safety services required to be operable under fire conditions shall be of a fire-resistant type, especially when they pass through high fire risk areas other than those which they serve. All other cables shall be minimum flame retardant as per IEC 60332.Containment around oil filled transformers shall be provided with certified passive fire-protecting grating (restricting air to the burning liquids and quenching of fire) to minimize risk of long-lasting pool fire, ref. PS 5.Requirements All personnel onboard shall carry personal, two-way radios suitable for effective, intelligible communication. This is intended to replace the need for a dedicated public address (PA) system.The GA/alarm system, loudspeakers, alarm horns/ sirens, bells and flashing lights shall comply with prevailing regulations and practices to ensure that personnel will be alerted and informed in the event of an emergency situation.Layout and location of loudspeakers, horns/ sirens and bells shall be reviewed during design and verified during start-up and operation. This also applies to alarm/ flashing lights particularly with respect to areas with high noise level and possible toxic gas.Flashing light shall be installed in areas with noise levels exceeding 85 dBA.The alarm system shall be fully redundant (separate A system and B system).Alarm signals The alarm system shall distribute audio alarms, visual alarms and emergency messages, and shall be interfaced with the emergency shutdown and Fire & Gas systems for alarm input. Signal types, visual color codes and alarm types (e.g.: general, muster, abandon and toxic) shall be according to local requirements and practice.Emergency communication Minimum two means of communication shall be available between onshore CCR and OSS via redundant communication links (e.g. VHF radio, IP telephony, TETRA).A telephone system shall be installed on the OSS so that personnel can alert the onshore CCR.External emergency communication The facilities shall have necessary equipment for communications with external emergency response resources|Radio system shall also provide marine communication to allow for co-ordination of active fire protection, response to marine pollution and emergency assistance.Equipment for communication shall be powered from dedicated battery supplies and/ or powered from the facility’s UPS system.Revision no. 02: General - Minor updates on wording and references. Section 4 - Additional hazards identified. Section 6 - References to relevant FEED reports added in section 6 – Safety strategies. Appendices – New appendix B and Appendix C added.Water mist system The water mist systems shall provide a quick and reliable discharge of water mist at a sufficient density and at sufficient duration for fire suppression and control.Operating devices shall include water mist releasing devices or valves, discharge controls, and shutdown equipment necessary for successful performance of the system.Easily accessible manual release facilities shall be provided at main entrances to the areas.The ventilation (fans and/or dampers) shall be closed and the area disconnected before release of water mist systems.The water mist cabinet shall be located outside of the protected space.Compatible materials shall be used throughout the system, e.g. nozzle / distribution piping.The water mist skid including compressed gas bottles shall be certified for the actual maximum operating pressure.Release duration and design should be in accordance with contractor’s recommendations, and/or typically range from 5 up to 30 minutes as indicated in NFPA 750 depending on application. IMO MSC/CIRC: 668, 728, 913 & 1165 can also be consulted.Inert gas system The inert gas firefighting system shall provide a quick and reliable discharge of gaseous agents for fire mitigation at sufficient concentration and at sufficient duration for fire suppression and control, whilst retaining an atmosphere non-harmful to humans.Inert gas system shall be one central system with valve-controlled distribution system to direct the system toward intended room. The inert gas system shall have 2x100% capacity to provide back-up coverage if e.g. inert gas system is unintentionally released.The ventilation (fans and/or dampers) shall be closed and the area isolated before release of gaseous systems.The room where the gaseous agent is released shall be sufficiently tight to maintain the prescribed concentration for the pre-determined time period of minimum 10 minutes.The compressed gas bottles shall be certified for the actual maximum operating pressure.The gas bottles shall be located outside of the protected room and the location is to be carefully chosen with respect to easy replenishment.In order to enable personnel to evacuate before gas discharge, appropriate means for warning of gas release prior to release shall be provided, i.e. clearly visual and audible alarms.All rooms protected by gaseous agents shall be furnished with clear audible and visual means for system status annunciation on the outside at the room entries.Where appropriate, the system shall be monitored to enable the detection of faults which may affect the operational efficiency of the system.Protection by use of CO2 or other noxious and poisonous gases is not allowed.Fixed foam system Foam system shall provide a quick and reliable supply of firefighting foams with the correct foam concentration for a minimum pre-determined time period.A fixed self-contained foam system shall be used for transformer areas. The foam shall be expansion type foam suitable to maintain a protective foam layer.The design of foam systems shall be based on recognized international standard, e.g. NFPA 11.The self-contained foam system shall be designed to operate in freezing conditions.Foam concentrate shall be of a quality which withstands freezing conditions.The foam system shall be released upon signal from the instrumented fire and gas detection system as well as by manual release.The foam system shall as a minimum have the following monitoring with signal transfer and alarms to control room:Foam release valves shall fail in last position upon loss of signal from F&G logic supplied with diagnostics alarm to CCR.Abnormal conditions at 3. party TSO station can affect one or both wind farms. However, it is not expected to have automatic ESD actions between the 3 party TSO station and the B. The consequences at B of an abnormal condition at TSO area are expected to be handled by the normal control and protection system.Hardware transfer of ESD signals between installations via the ESD logic solver should be avoided. Such communication should be via dedicated redundant fibre, alternatively via control and protection system. It is expected that the control and protection system on installations upstream and downstream of the affected installation is intact to perform the required control and shutdown based on the response/power transmission from the affected installation.-Shutdown diesel generator -Prevent start of diesel generatorTimer based shutdown of: General alarm system Fire detection system Control and protection system Radio/external comm unicationLess of communication with cc ntrol system at su bstati onESD-1 - Total shutdown of facility. Total substation shutdown will isolate the substation from the grid and de-energize the substation. UPS power will be isolated after a predefined time delay. Only systems left operating are Nav aid systems including marking lights. ESD-1 should be initiated if there is a danger of a catastrophic incident e.g. an external owned vessel can collide with the offshore substation. Decision to activate ESD-1 will be made upon evaluation of the shipsurveillance of the area, or by a responsible personnel visiting the facility. It is expected that personnel on the offshore substation in such case are in radio contact with onshore control room and can request a shutdown to be initiated from the control room. Hence pushbutton for ESD-1 level is not required installed on the offshore substation.• ESD-2 level which entails: o Both transmission system A and B be isolated and de-energized, o All WTGs connected to the substation are given stop command, alternatively WTG’s will stop immediately when OSS shut down, o Breakers on OSS side on export cables shall be open, the need for opening breakers on ONSside to be evaluated, Nav aids, fire alarm system and fire extinguishing system shall still be available for the duration of their required battery time. Monitoring of ship collision should be available via UPS. ESD 1 should be available for remote reset from CCR if it is verified by surveillances systems that collision did not happen, (i.e. last-minute averting).ESD-2 Substation shutdown (A & B system). ESD-2 shut down the substation transmission systems A & B and isolate the substation from the grid. Auxiliary generator, UPS power and utility systems are still connected and available. ESD2 shall be initiated as follows:• Automatically with time delay upon loss of communication with control system between onshore control room and substation (i.e., loss of signal resulting in no information from the C&P on installation shown on the screens in the CCR),• Potentially manually from pushbuttons at OSS if found required by the safety strategy.• ESD level 3A and ESD level 3BESD-3A, ESD-3B System shutdown. ESD 3 level shut down each individual power transmission system, i.e. system A or system B, in the event of an emergency incident affects one of the areas where the individual train is located. The individual train is also isolated from the grid. Shutdown of an individual train e.g. system A do not affect the other train, system B, which will continue its power transmission to shore.• Automatically with time delay upon confirmed fire detection within one of the areas for the individual systems (i.e. transformer area, switchgear rooms, electrical equipment rooms), o The confirmed fire detection shall• send stop signal to WTGs for controlled and fast rundown of the turbines.• immediately initiate the fire extinguishing system for the area where fire is confirmed.Upon ESD 3A/3B the following shall be initiated:• Isolate/de-energize the affected room or equipment from the transmission power (i.e. shutdown the transmission train). WTGs connected to the individual system is automatically shut down as consequence of no possibility to deliver the power.Equipment shut down. Utility systems, utility areas and other areas e.g. auxiliary diesel generator and diesel system, are monitored by fire and gas detection system and are shut down by fire and gas detection system and the control system. Equipment shut down of individual equipment shall be automatically initiated in the event fire is detected in equipment or in the area the equipment is located. Equipment shut down shall also be initiated if flammable or toxic gas is detected in an area with equipment which contain gas or which in a failure condition is able to produce flammable/toxic gas, e.g. batteries,Upon equipment shutdown the following shall be initiated:• Equipment shall be stopped and electrically isolated• Alarm and status signal to onshore control roomActive fire protection, mechanical ventilation and closure of fire dampers shall be controlled as required by the fire and gas logic.The assessment intends to document the background for the chosen solution for emergency power and duration of operation of the UPS based on relevant parts of DNV-ST-0145.Mitigation and sharing of risk Risk level RED Single red risk is generally intolerable and far beyond the Group's risk tolerance criteria. Mitigating actions must be implemented as soon as possible. ORANGE Single orange risk is generally intolerable, and mitigating actions must be implemented. YELLOW Mitigating actions shall be identified based on the ALARP (As Low As Reasonably Practicable)/ BAT (Best Available Technology) principle or other applicable principles subject to relevant jurisdiction(s). Risks in the green zone are generally tolerable and actions are normally not required. GREEN# Barriers # Barriers Alarm and Communication System for use in Emergency Situations PS2 Natural ventilation and HVAC PS14 Escape, Evacuation and Rescue (EER) PS3 Leak detection PS15 Layout Design Principles and Explosion Barriers PS4 Emergency Shut Down (ESD) PS16A Offshore cranes PS5 Open drain PS16B N/A PS6 Ignition source control PS17A N/A PS7 Fire Detection PS17B N/A PS8 N/A PS18 N/A PS9 Active Fire Protection PS19 Avoidance of vessel collisions PS10 Passive Fire Protection PS20 Structural integrity PS11 Emergency Power and Lightning PS22 Human Machine Interface and Alarm Management PS12 Process Safety PS23 Safety & automation system securityRole and Need for Barrier Reference TR1803 Hoses and couplings DNV-ST-0145 Offshore substations - Rules and standards C256-EQ-M-FD-00001 Material selection Philosophy – WTG foundations, Offshore Substation C274-RA-M-RA-01000 – MFW – Material Selection and Coating Report C274-RA-R-FD-01000 – MFW – Mechanical Design Brief The containment function shall prevent release of flammable fluids or harmful fluids Relevant hazards • Transformer oil leaks • Diesel leaks (machinery, storage, and bunkering system) • Hydraulic leaks (e.g. from crane and winch) • Insulation gas (SF6) used on gas insulated electrical equipment Requirements All piping, tanks, valves, connections, pumps, rotating machinery, instruments, and other components in systems handling flammable fluids and/or harmful fluids (chemicals, toxic gases, etc.) shall be designed, constructed, maintained, and operated with the aim to avoid leaks to occur. Piping and other components shall be tagged and marked to identify fluids and prevent operational errors. (e.g. gas insulated equipment) Casing of oil filled transformers shall be of robust design. Ref. PS12 for details on transformer safety system requirements. All components and systems shall be designed to enable necessary inspection, testing and correction in compliance with established inspection program. Materials and connections used in piping systems shall as minimum meet the requirements in DNV-ST-0145 or project specific material selection report. Diesel bunkering system. All hoses and connections (hose assemblies) shall comply with TR1803.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations C274-RA-H-FD-01000 - MFW - HVAC Design Brief Natural ventilation shall: • Dilute gas concentrations and reduce the size of flammable gas clouds • Dilute harmful concentrations of smoke or toxic gases • Ensure acceptable working and equipment environment HVAC shall, with respect to accidental events: • Provide smoke ventilation for internal fire conditions if active smoke ventilation philosophy is chosen to facilitate safe escape from manned areas • Ensure acceptable equipment environment • Dilute and remove concentrations of flammable or toxic gas Relevant hazards • Smoke generation from fire in diesel engine or transformer area exposing HVAC inlets to spaces with safety critical functions • Electrical fires within electrical rooms creating toxic atmosphere • Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere • Flammable gas accumulation / oil mist in transformer area in the event of internal arch fault and gas leakage from transformer casing • Release of decomposed products of SF6 gas in the event arc fault and burst of GIS casingRole and Need for Barrier Reference Hose reel station: The hose shall be equipped with quick release auto close connection on the towards the CTV/SOV. The diesel bunkering system shall have integrity towards the maximum shut-in pressure of the pump at CTV/SOV. Diesel lines between bunded areas of hose reel station and diesel storage tanks shall be welded.Role and Need for Barrier Reference Requirements: Transformer area Natural ventilation is the preferred solution for the transformer areas. Battery rooms: Battery rooms shall be provided with sufficient ventilation to maintain non-hazardous status, forced or natural, according to DNV-ST-0145. Ventilation inlets and outlets Ventilation air inlets serving shelter area and emergency equipment rooms shall be located such that they are minimally affected by smoke from on-board incidents. Measures shall be taken to avoid accumulation of ice and snow. Dampers Dampers shall provide quick, reliable and effective means to prevent ingress or spreading of gas or smoke. If smoke is detected at ventilation air inlets, the ventilation fan in question shall be stopped and all inlet and outlet dampers closed. Dampers and fans shall be interlocked to avoid abnormal pressure configurations. Fire dampers shall be closed automatically by signal from the F&G-system or by “fusible link” where specified. If release of decomposed products (powder) of SF6 gas is detected (e.g. arc failure in GIS equipment followed by loss of SF6 pressure) the dampers in the rom shall be closed to prevent decomposed products to be distributed to other areas.Role and Need for Barrier Reference The leak detection system shall continuously monitor for the presence of flammable or toxic gases, to alert personnel and allow control actions to be initiated manually or automatically to minimize the probability of explosion, fire and acute effects of personnel exposure. Relevant hazards • Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere • SF 6 (or other insulation gas type) leak in GIS area or GIB resulting in potential risk of asphyxiation • Leak from inert gas storage bottles resulting in potential risk of asphyxiation Requirements: Battery rooms H 2 detection shall be installed in battery rooms if dangerous concentrations can accumulate. • Single H 2 detection shall give alarm in onshore central control room (CCR). • Confirmed H 2 detection in the room shall stop boost charging of batteries (if applied). Unless required by local regulation, H 2 detectors may be omitted if boost charging (if applied) is interlocked with room ventilation and batteries do not emit H 2 gas during normal charging, or if it can be documented that dangerous quantities of hydrogen cannot be generated. GIS rooms and GIB SF 6 gas density is approx. 6 times larger than air and might be an asphyxiate. If the quantity per gas compartment is small, however, it might not represent a personnel hazard. SF 6 detection may then be omitted with the following preconditions: • SF6 detection is not required by codes or regulation • Acceptable risk to personnel is confirmed by SF6 risk assessment, considering layout, volume, congestion, and ventilation of the GIS room/area. • Pressure monitoring is integrated into the GIS equipment. External flash beacon shall be provided at door entrance to warn personnel of potential SF 6 release (upon confirmed pressure drop in GIS compartment) Procedure shall be in place to ventilate GIS room, e.g. by opening doors, before entry in case of detected pressure drop in GIS compartment.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations C274-RA-S-FD-01000 - MFW - HSE Design Brief The purpose of the emergency shutdown system (ESD) is to prevent escalation of abnormal conditions into a major hazardous event and to limit the extent and duration of any such events that do occur. In addition, ESD initiations will activate (direct or indirect) other safety systems/functions such as HVAC (PS 2), Emergency power and lighting (PS 11), Alarm and communication system for use in emergency situations (PS 13). Relevant hazards - Abnormal condition on ONS, OSS or a WTG not detected and controlled by the Protection & Control system, e.g. high hydrogen concentration, smoke or flame detection, ship collision/ship on collision course etc. - Abnormal condition / loss of communication situation requiring local manual shutdown at ONS, OSS or WTG to ensure safety of personnel, environment or asset. Requirements: Shutdown functions, with logic solvers independent from the Protection & Control system, shall be available to perform necessary actions to protect personnel, environment and assets (ONS, OSS and WTGs) from abnormal conditions. A separate Emergency Shutdown System may be omitted if shutdown actions are included in the F&G logic solver. The shutdown actions may be initiated manually and automatically. Once initiated, actions shall be automatically executed. The shutdown functions shall be arranged in a tree-structured level hierarchy, reflecting different levels of facility or wind farm shutdown. The higher levels in the hierarchy shall initiate lower levels. A signal on a certain level shall not initiate actions on higher ESD levels.Role and Need for Barrier ReferenceRole and Need for Barrier Reference Reference is made to Appendix B – Emergency shutdown philosophy – where a generic ESD hierarchy is presented. Shutdown levels for the OSS shall include: - Total substation shutdown (A and B system) including utility systems - Substation shutdown (A and B system) - System shutdown (e.g. A or B system) - Equipment shutdown Where relevant, remote equipment emergency shutdown shall be available through ESI control and protection system and be available in ESD HMI. A CAP panel with “Total shutdown” and “System A” and “System B” shutdown included as minimum shall be located in a strategic location on the OSS. Cascading effects shall be avoided. This implies that in some situations, a larger part of the facility or wind farm than directly affected by the incident in the first stage should be shut down Depending on the shutdown levels attributed to particular accidental event, ESD actions or their combinations shall include - Shutdown of HV equipment - Stop of auxiliary generator - Prevent start-up of equipment as required during an emergency situation, e.g. inhibiting the start-up of auxiliary generators during the shutdown of HV system - Disconnection of the substation from the grid - Start-up of auxiliary supply, load transfer of emergency services from transitional / emergency source of power - Activation of diesel shut-off valves - Shutdown of power ventilation - Stop battery charging - Closure of doors and ventilation openings - Initiation of audible siren signalRole and Need for Barrier Reference Any shutdown, spurious or intended, shall require a manual reset from onshore control room after normalization and systems have been confirmed OK to restart (e.g. by system status reporting / CCTV). ESD alarm annunciation Shutdown status shall continuously be available in the control room, and the system shall raise alarms in the control room for operator awareness or actions, considering: - Level of shutdown initiated - Shutdown function failure to execute actions upon demand - Shutdown function (sensor, logic solver or final element) defect or failure Personnel shall be warned to ensure safe escape and evacuation, ref. PS13. Upon shutdown (automatic or manual), general alarm shall be automatically initiated. An ESD alarm shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon ESD alarm. Logic solver The logic solver including I/O, logic and communication interfaces, shall comply with prevailing regulations and practices for normal operation, test and emergency situations. The logic solver compliance with the intended use and safety integrity requirements shall be demonstrated, i.e.: - Logic solver (firmware, as standard manufacturer provision) compliance with IEC 61508 shall be documented and certified / type approved (note: also valid for system software revisions). Use of existing non-certified equipment may be accepted subject to particular safety assessment and “prior use” characteristics. - Logic solver (hardware and software, according to user requirements) arrangement and application configuration shall be subject to acceptance based on independent verifications. System safety manual shall provide guidance to applications and application program development. ESD system units (logic solver) shall not be used for non-safety related systems.Role and Need for Barrier Reference C274-RA-R-SP-01001 - MFW - Pollution Prevention System Specification C274-RA-R-SP-01000 - MFW - Cleaning System Specification The purpose of the open drain system is to provide measures for containment and proper disposal of flammable or environmentally hazardous liquid spills, as well as handling wash-down, rainwater and fire water. The open drain system consists of equipment such as drip trays and bunding, drain pots and liquid seals, piping and pumping arrangement, collection and treatment tanks necessary to collect and handle spillage of hydrocarbon liquids, wash down water, fire water and rainwater. Relevant hazards: Release with potential damage to environment or prolonged fire from: • Transformers with mineral oil • Coolers for transformers containing mineral oil • Diesel leaks (machinery, storage, and bunkering system) • Hydraulic leaks (e.g. from crane and winch) Requirements Open drain systems shall be provided to contain and collect spills and leaks in all areas that have a source of flammable or environmentally hazardous liquid so as to minimize the risk of fires and personnel exposure to hazardous materials and avoid damage to the environment. Tanks and vessels containing flammable or environmental hazardous liquids shall have a bunding covering the tank perimeter to control the spread of spills. There shall be adequate drainage within the bunding.Role and Need for Barrier Reference Logic solver shall include measures that prohibit unauthorized and avoid unintentional changes of system parameters, i.e. key-lock, password or software configuration.Role and Need for Barrier Reference Guidance Dedicated bunding per tank or vessel may be exempted if part of a larger containment area provided with fire protection grating (restricting air to burning liquids and extinguish fire) and containment basin. End of guidance Open drain systems shall be designed with adequate slope to control spills. Cooler areas Open drain from the external cooler areas shall be connected to the oily water package including tank. Transformer areas: Leak containment criteria: The transformer areas shall be provided with fire protection grating and containment basins with minimum capacity for the largest transformer oil inventory in the area + firewater/foam liquid volumes +10%. An alternative to containment basin is a drip tray / bund area with fire protection grating and drains to collection tank with same capacities as specified above, The containment basins / collection tank shall be provided with overflow to sea, such that rainwater can be discharged in all conditions. Drainpipes from drip tray or bund area to collection tank shall be of sufficient size to drain the oil inventory in the tank without overflowing the drip tray underneath the transformer. There shall be means of continuous measuring of hydrocarbon content in the liquid to stop unwanted release to sea. National / local requirements to the system shall be observed and adhered to. The drain system needs to consider operability in cold climate. The overflow system shall: • control the liquid level in the containment basins / collection tank such that the leak containment criteria is met. • be designed such that liquid is removed from a section with continuous water phase of the containment basins • have sufficient capacity to handle the heaviest rainfall of 1-hour duration over a 10-year recurrence period. Auxiliary diesel engine skid The auxiliary diesel engine skid and diesel storage shall preferably be self-contained with capacity for the maximum potential diesel leak inventory, or alternatively be connected to open drain system on the installation.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations - Rules and standards The ignition probability of flammable liquids and explosive gas atmospheres shall be minimized by rendering the sources of ignition harmless or reducing the likelihood of occurrence of effective ignition sources. Relevant hazards: - Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere. - Electrical fault in transformers resulting in arc flash and flammable gas and oil mist released to atmosphere. - Release of flammable diesel oil mist inside diesel engine generator skid exposing hot surfaces. RequirementsRole and Need for Barrier Reference Hose reel station The hose reel station is envisaged to be in infrequent use and located at low level on the installation. Diesel bunkering will be a manned operation. The hose reel station shall be provided with bunding with capacity to minimum contain possible flow back diesel inventory in piping or hoses and credible pressurized leak before SOV/CTV supply pump is stopped. In case of a diesel leakage, removing the diesel from the bunding will be an operation requiring temporary pump and suitable tote tank to pump the diesel to. Segregation between areas The containment basins for Transformer A and B area shall be separated according to the fire division between the areas. The open drain system shall provide effective means, e.g., liquid seals if relevant, to prevent liquids, vapors and gases to spread to other fire areas via the drain system. The drain system, such as drain box and piping, shall not impair the integrity of fire partitions.Role and Need for Barrier Reference The fire detection system shall continuously monitor for the presence of a fire to alert personnel and allow control actions to be initiated manually or automatically to minimize the likelihood of fire escalation and probability of personnel exposure. The fire detection system shall, relevant to specific equipment and areas, monitor continuously for the presence of an incipient fire condition to alert personnel and allow control actions to be initiated manually to minimize the probability of a fire condition to develop. Relevant hazards: • Electrical fires (e.g. in electrical rooms) • Fires in oil filled transformers (mineral oil) • Diesel fires (Auxiliary diesel engine, diesel storage & supply) Requirements: EN 54 all parts DNV-ST-0145 Offshore substations - Rules and standards IEC 61508 Functional safety of electrical/electronic/progr ammable electronic safety-related systems -Role and Need for Barrier Reference Part 1: General requirements The fire detection function shall provide reliable and fast detection of a fire by adequate type, number and location of fire detectors and shall ensure timely alarm and initiation of control actions. Sufficient fire detection redundancy shall be implemented to ensure that the fire detection will be maintained if defect fire detectors are not repaired or changed immediately. Possibility for manual reset from onshore control room after normalization and systems have been confirmed OK to restart (e.g. by system status reporting / CCTV), to disable detectors etc. Detectors shall be provided based on an assessment of fire scenarios within each area considering potential fire sources and characteristics, consequences, area and equipment arrangement and environmental conditions. Design premises for determination of fire detection coverage shall apply flame size, smoke characteristics and temperature (heat) rise, established for each area, as basis (sensor number and distribution). The basis and assumptions used for detector selection and location shall be documented. Smoke dispersion studies may be performed for verification and optimization of location of detectors. The location of smoke detectors shall be confirmed by smoke dispersion tests for actual conditions inside rooms with and without ventilation. A mix of standard and high-sensitive smoke detectors shall be given preference for use as general detection in rooms containing P&C panels, automation/instrument/telecom panels and low voltage distribution boards and switchgears. Access to perform maintenance of detectors shall be planned for and documented. It shall be able to test detectors from deck level, test equipment shall be included as part of special tools. Areas requiring fire detection Fire detectors shall be provided in all areas where fires may occur and where ingress of smoke is to be prevented.Role and Need for Barrier Reference Fire detector characteristics and calibration Fire detectors shall be self-monitoring. Detector safety characteristics should be optimized through preferences and adoption of best available technology including provisions of self-diagnostic. Flame detectors shall comply with actual fire potential and environment conditions within the relevant area, e.g.: • IR or UV where flame is predominating and according to flame wave radiation characteristic • Sensor range and cone of vision. Based on a typical flame detector characteristic, the distance between flame detectors and targets monitored shall be in accordance with current technology • Sensor direction and angle • Sensitivity to external impact such as arc welding Heat point detectors (electrical) characteristics shall comply with actual fire potential and environmental conditions within the relevant area, e.g.: • Normally limited use, i.e. specific high-risk areas and where other detection principles are not suitable. • Maximum coverage in naturally ventilated area approximate 24 m 2 , maximum distance between sensors 7 m and maximum distance from wall 4.5 m and minimum 0.5 meters away from outside wall or dividing partition. • Maximum coverage in mechanically ventilated area approximate 37 m 2 , maximum distance between sensors 9 m and maximum distance from wall 4.5 m. Smoke detectors characteristics shall comply with actual fire potential and environmental conditions within the relevant area, e.g.: • Optical detectors used for smoldering fires. • Detectors, e.g., ionic type, suitable for energy intensive smoke generating fires, e.g., fire in high voltage switchgear caused by short circuit. • Smoke detectors mounted in areas such as suspended ceilings and raised floors shall have their location indicated by visible tag-plate. • Early warning sensor specified with higher sensitivity than norm recommendation. • Maximum distance between sensors 11 meters, maximum distance from sensor to bulkhead 5.5 meters and minimum 0.5 meters away from outside wall or dividing partition. Fire detection actions Automatic initiation of actions shall includeRole and Need for Barrier Reference • ESD (confirmed fire) • HVAC and fire damper shutdown, except for areas subject to smoke control (confirmed fire) • Activation of Fire Fighting Equipment (confirmed fire) • General installation alarm (confirmed fire) • MCP activation shall initiate alarm in central control room. Central control room to verify and initiate further actions and alarm on installation as required. Guidance Early smoke detection may be subject to manual initiation of actions only. End of guidance A fire alarm shall be presented in CCR on an OSS layout to easily identify location. Confirmed fire shall be based on voting between two or more fire detectors in alarm. Voting shall include all fire detectors within a defined area (any type of detectors) and exposed to the same fire scenario. The voting logic shall be arranged such that confirmed fire can be achieved with faulty detectors, and also including inhibited detectors unless safe detector inhibit is achieved by established operating procedures. The following voting principles should apply (for automatic actions only): Smoke (except areas such as accommodation or offices with manual intervention): • 2ooN detectors to reach specified alarm limit when N ≥ 3 Note: Smoke detectors are less likely to be used together with other types of fire detectors, and applications that require voting are not common. Smoke detectors covering enclosures and HVAC inlets shall not be voted together with other fire detectors in the same area. Flame: • 2ooN detectors to reach specified alarm limit when N ≥ 3 Heat:Role and Need for Barrier Reference • 1ooN detectors to reach specified alarm limit when N ≥ 2. 1ooN voting with highly reliable heat detectors to be approved by Company. Fire detection alarms Detection of fire, failure to execute actions upon demand and system defects shall be presented as alarms in Central Control Room (see also PS 22). F&G system status shall be continuously available in CCR, and the system shall raise alarms in CCR for operator awareness or action, considering: • Detection of fire or activation of Manual Call Point • Failure to execute action upon demand • Function (sensor, logic solver, final element) defect or failure. Status/alarm parameters for each individual fire detector shall be identifiable in the CCR. An F&G alarm condition shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon F&G alarm. CCTV coverage CCTV cameras shall be installed in order to help the control room operators evaluate appropriate actions following an alarm event on the unmanned substation. Evaluation shall be performed to identify relevant locations, but CCTV cameras shall as minimum be installed with sufficient coverage of transformer containment area and high voltage switchgear / GIS areas. Independence The F&G safety related functions shall fulfil their intended role independently of other control - and safety related control systems, Prerequisites to fulfil the independence requirements are: • Logic solver (firmware, as standard manufacturer provision) shall be certified / type approved to relevant standard (i.e. IEC 61508). Use of existing non-certified equipment may be accepted subject to particular safety assessment and “prior use” characteristics. • F&G safety related functions shall be realized in addition to and independent of installation basic control systems. • F&G system units (logic solver) shall not be used for non-safety related systems. • F&G sensor loop including accessories (e.g. air supply branch-off and power fuses) shall be separate from other functions, directly connected to F&G system unit. • F&G final element shall be operated directly from F&G system unit unless actions are executed through the ESD system.Role and Need for Barrier Reference Possible use of common SAS data network and operator stations are addressed in automation discipline requirements. Same reference will apply to signal exchanged between different safety systems.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations IEC 60332 Test on electrical cables under fire conditions GL0644 Guideline Coat back on Steel Structure C274-RA-S-RA-01011 - MFW - Fire and Explosion Risk Analysis Passive fire protection (PFP) shall ensure that relevant structures and equipment components have adequate fire resistance with regard to load bearing properties, integrity and insulation properties during a dimensioning fire, and contribute in reducing the consequences in general. Relevant hazards: • Escalation of fire between equipment (e.g. between adjacent transformers in one area) • Escalation of fire between rooms or areas (e.g. from transformer A to transformer area B or adjacent electrical rooms) • Escalation of fire to safety critical elements before the equipment has performed its intended duty in a fire scenario (e.g. UPS or control systems, muster area) Requirements: All rooms shall have bulkheads with rating A-0 or stricter, according to DNV-ST-0145. Bulkheads between Transformer A and B areas and between transformer areas and adjacent spaces shall be H-rated unless a lower fire rating is justified by structural fire response analysis. The fire divisions shall be capable of resisting dimensioning fire and explosion loads. Penetrations, e.g. for ventilation ducts, piping, cables, beams as well as doors in fire divisions, shall not reduce the fire and explosion integrity of the divisions. Doors in fire divisions shall be of a self-closing type. Load bearing structures / important elements shall have adequate fire protection to prevent unacceptable deformations or collapse during a dimensioning fire. However, contractor shall strive to reduce fire insulation to a minimum. Need for fire insulation of structure, piping etc. shall be assessed and justified. Coat back of attachments to main structures: If the contact area including the cross-sectional area inside hollow sections of an unprotected structural element is equal or larger than 1000 mm 2 per square meter of fireproofed structural elements, the need for coat back must be evaluated. To do this, theRole and Need for Barrier Reference DNV-GL-ST 0145 Offshore substations EN 1838:2013, Lighting applications - Emergency lighting C256-EQ-Z-SP-00009 Offshore Substation (OSS) The purpose of the Emergency Power and Lighting is to provide the following: - Electrical power when main power generation or supply is being shut down. - Emergency electrical power supply for a specific period of time for systems required to be in operation during or after a major hazard incident. - Sufficient lighting for evacuation and escape in an emergency situation. Requirements Emergency power supply Two redundant and independent UPS systems (2x100) with three (3) hours total capacity serving both emergency and non-emergency consumers shall be provided. Each emergency consumer is fed from each of the two UPS systems with local change over to ensure availability of the emergency services for minimum three (3) hours.Role and Need for Barrier Reference Topside Technical Specification C274-RA-E-FD-01000 - - Design Brief - Electrical Low Voltage Systems The available UPS capacity shall, at any time when needed, ensure that safety systems will be kept operational during periods of accidental events, evacuation and escape. Reference is made to Appendix C for assessment of required emergency power and duration of emergency power. Emergency consumers to be supplied by the UPS shall include: • Emergency and escape lighting • Active fire protection (when firefighting equipment is dependent on emergency source of electrical power) • Control and communication systems required in an abnormal situation (incl. HV P&C) • Alarm systems • HVAC systems required to prevent overheating of rooms with safety critical or essential functions. Consumers supplied from the UPS shall also enable personnel to perform corrective actions to restore main power, this includes but not limited to: • Sufficient lighting at key areas • Strategically located sockets. Separate UPS system(s) with 96-hour capacity shall be provided for: • navigation lights • aviation warning lights • structure marking. Shut down of ventilation shall not cause temperatures above vulnerable components’ tolerance within the required operating time of the relevant installation safety systems. Minimum required operating time in this scenario is 30 minutes, to ensure availability of safety critical functions until escape and evacuation is completed. Guidance: Room temperature may exceed the maximum allowed continuous ambient temperature for a short section at the end of the period, provided that lifetime consequence is evaluated and found acceptable.Role and Need for Barrier Reference End guidance. The emergency power system shall be monitored and raise critical status alarms in Control room. Emergency lighting: Emergency and escape lighting shall be provided in order to allow escape during emergency situations and provide sufficient lighting in areas which are manned during such events. This includes Escape routes, muster areas, SOV/CTV access gates, escape chute areas, helicopter winch area, sea illumination of boat landing and escape-to-sea systems. The emergency lighting shall be minimum 30% of the normal lighting level and ensure sufficient illumination for safe work in areas required to be manned during emergency situations. Escape lighting levels shall be minimum 15 lux at high risk task areas and evacuation stations and 1 lux on escape routes. Emergency exit signs shall either have an illuminated or fluorescent type of design. Survivability requirements UPS shall be located in protected area. Cables to emergency consumers shall be fire resistant. Emergency light fixtures without internal batteries, shall be arranged in A and B system, each supplied from separate redundant power sources.Role and Need for Barrier Reference C274-RA-S-RA-01004- ELHAZ Report Process safety means of protection, incorporating electrical and mechanical protection devices and safety instrumented functions, shall ensure that the process conditions do not exceed specified process safety limits. The main process for wind farms is understood as generation and transmission of electrical energy. The aim is to control any abnormal process operating conditions to prevent and/or minimize possible accidental events or releases. Typical actions, by means of protection devices include: • Process shutdown by tripping of Circuit Breakers (CBs) • Pressure relief The extent of a shutdown situation will depend on type of abnormality and may vary from shutdown of process sections with minimum effect on the production, to a total shutdown. Relevant hazards • Electrical faults resulting in short circuits / arcing events and subsequent fire or explosion scenarios. Requirements: Electrical faults are detected and cleared by protection relays without operator intervention. A SCADA system will be installed for monitoring of the wind farm plant. If abnormal condition is detected in the electrical systems, the operator in onshore central control room shall evaluate and consider appropriate actions. There will also be automatic actions based on predefined levels/limits. The control room shall be manned 24/7. High system reliability shall be ensured by: - Autonomous protection relays will clear any electrical fault in the system.Role and Need for Barrier Reference DNV-GL-ST 0145 Offshore substations GA, Alarm and communication systems for use in emergency situations shall: • Alert and inform personnel as quickly as possible in the event of a hazardous or emergency situation • Provide two-way communication of information regarding emergency events to the Control Room • Allow the co-ordination of rescue, recovery, and emergency assistance.Role and Need for Barrier Reference - Primary protection relays are backed up by secondary back up relays if fault is not cleared by primary. Redundant protection relays are as minimum provided for main HV equipment and cables (e.g. transformers and export cables). - Relays from different vendors/models All relays onshore and offshore shall be communicating on redundant fiber networks (IEC61850). Transformer safety (electrical oil filled equipment) Each oil filled transformer shall be protected by redundant protection systems aimed to detect internal failures and quench an internal arc by the feeding circuit breaker. As minimum the following shall be provided as part of the short circuit protection: - Buchholz Relay (not redundant detection but redundant tripping) - Differential protection relay - Earth Fault protection The Transformers shall be equipped with a Pressure Release Valve (PRV) to protect the transformer tank in scenarios with gradual pressure build-up and low-energy arching faults (as result of fire exposure, oil filling operation or other maintenance operations or transformer malfunction scenarios). PRV shall be equipped with an external duct to guide the ruptured oil down below the deck grating instead of spreading to the surroundings. The PRV shall be designed to not limit the free flow of oil in any way.Role and Need for Barrier Reference Escape and evacuation route and exits In the case of a hazardous incident, the purpose of escape and evacuation routes is to: • Ensure that personnel can leave the area(s) in question by at least one safe route • Enable personnel to safely reach the assigned mustering area from any position on the installation they are likely to occupy (and hence the designated embarkation area). • Enable rescue/medical teams to safely bring injured personnel to areas where medical treatment can be given Temporary refuges and embarkation areas (Muster area) The purpose of refuges and embarkation(mustering) areas is to. • Provide safe refuge on the installation as long as required for a controlled evacuation to be carried out. • Ensure easy, fast and safe entering of the evacuation systems in question Evacuation systems The purpose of the evacuation system(s) is to ensure safe means of evacuating the maximum POB. Rescue and safety equipment The purpose of rescue and safety equipment is to: • Provide personnel with necessary equipment to ensure safe EER SOLAS Chapter III – Life Saving Appliances and arrangements I DNV-ST-0145 Offshore Substations CAP 437 Standards for offshore helicopter landing areas ISO 3864 Graphical symbols — Safety colors and safety signsRole and Need for Barrier Reference ISO 7010 Graphical symbols — Safety colors and safety signs – Registered safety signs C256-EQ-Z-SP-00009 Offshore Substation (OSS) Topside Technical Specification C274-RA-S-RA-01012 - Escape and Evacuation Assessment • Ensure that injured personnel are given adequate first aid treatment and a professional follow up, thus minimizing the effects from possible injuries. Requirements Escape and evacuation routes and exits Escape routes and muster area shall be provided enabling all personnel to safely leave the affected area(s) in case of a hazardous incident. A minimum of two independent escape routes leading from any area to muster area shall be provided. The muster area(s) shall be positioned in lower deck with close access to escape chutes, boat landing ladders and SOV gangway connection points. Survival suits shall be stored nearby or at muster areas. Escape routes shall preferably be provided on the outside, along the periphery of the installation, and be designed to be passable by position rather than by special protection. Escape and evacuation routes leading to a higher or lower level shall be provided by stairways. They shall be located nearly diagonally opposite each other as practicable. Hatches shall not be part of escape routes. Ladders can be used as part of escape routes in areas where the work is of such a nature that only a few persons (3 or less) are in the area on a short time basis when the platform is manned. The length of a stair flight or a ladder shall be as low as possible. The substation shall be designed for stretcher transport to embarkation points at the lower deck and to helicopter hoist area. It shall be demonstrated in all cases that equipment used for transportation of injured personnel can be turned at corners and in the staircases. Required width of main access / escape routes shall emphasize easy transport of injured personnel on a stretcher. The dimensions shall minimum be 1 m in width (0.9 m for doors) and 2.3 m in height (2050 mm for doors).Role and Need for Barrier Reference There shall be at least two exits to escape routes from areas that are permanently or intermittently manned during inspection or maintenance visits, leading in different escape directions and situated as far apart from each other as possible. Internal room arrangement shall be considered for possible blocking of exits following an accident. Layout shall accommodate that escape from one area to another area with higher risk level is not required. Escape from a HV room may be through another HV room of same or lower risk level. All doors shall be constructed so that one person can easily open them from either side. They shall open in the direction of escape without blocking the outside escape route and be self-closing. This requirement should consider the effect of wind (1-year condition). If analysis shows that a door can be used from both directions during escape/evacuation, e.g. due to two separate incidents, a sliding door should be used. Doors that are normally locked can be accepted with opening in either direction in such cases. Corridors and dead ends shall not exceed 7 meters unless provided with at least two exits, one at each end. Survivability of escape routes Escape routes outside the area for the initial event shall be designed and protected so that at least one route of escape is available for the required period of time during a dimensioning accidental event. Personnel shall be able to use the escape routes without being exposed to excessive toxic fumes, smoke nor unacceptable heat loads, hot liquids or falling objects. Signs and markings A sufficient number of safety signs and markings shall be provided to convey necessary information to guide personnel in emergency situations and give clear information regarding directions/locations of various functions, areas and exits.Role and Need for Barrier Reference Safety signs and markings shall conform with regional requirements and with reference to international industry standards, e.g. ISO 3864 and ISO 7010. Signs and markings shall be consistent throughout the plant, and the color code used shall be specific and not used for other purposes. A descriptive text shall be added to the sign if symbols are not easily understood. Text shall however be kept to a minimum. All signs/markings and their supports shall be constructed from robust material; durable and suitable for the intended use, the environmental forces and cleaning methods to which they will be subjected. Escape routes shall have signs/markings showing the preferred direction of escape. Escape and evacuation routes on plated decks shall be provided with a non-skid, oil resistant coating in yellow (RAL1023), unless local requirements regulate the color coding. On deck grating, two parallel 100 mm wide yellow (RAL 1023 if no other requirements are given) lines shall be painted indicating the width of the escape route. Escape and evacuation routes inside rooms with other floor finish than plated deck or grating, e.g. multipurpose and control room, shall be provided with low level fluorescent arrows showing correct escape direction. Other enclosed spaces shall be considered separately. Safety plans shall be strategically located / posted on the premises with high degree of accessibility. Such a plan shall include: • Locations of safety, rescue and firefighting equipment • Emergency exits, escape and evacuation routes • Evacuation instructions and legends Muster area The muster area is a safe place where personnel normally muster while emergency response are undertaken. Muster area shall be safe by position rather than by protection. Two easily accessible muster areas (primary and secondary) shall be clearly defined and separated from each other as widely as practicable. The muster areas shall be located in protected area at lower deck with easy access to the escape chutes, boat landing ladders and SOV gangway connection points. The muster areas, and the evacuation routes from muster area to the embarkation area in question, shall be arranged and protected in order to ensure theRole and Need for Barrier Reference safety of all personnel during the period required for the evacuation process to be completed in an organized and efficient way. The primary Muster Area shall remain unimpaired by excessive toxic fumes, smoke, unacceptable heat load, hot liquids and falling objects for minimum 60 minutes. Additional functions for the muster area are to provide first aid, information, and communication. The size of the muster areas shall as minimum correspond to N*0.4 m 2 , where N denotes maximum personnel at the substation. Emergency communication systems (e.g. telephone and UHF radios) shall be available at the muster station. At escape chutes waterproof portable VHF shall be available and adapted for use in life rafts. Evacuation systems Primary method of evacuation is to CTV via the boat landing ladders or to SOV via gangway connection, i.e. the normal method of getting to and from the installation. Secondary method of evacuation is helicopter winching from upper level of the OSS (medevac or non-emergency scenario) Tertiary method of evacuation is evacuation to sea by escape chutes with life rafts. Evacuation by SOV SOV will not be permanently connected when personnel are on-board the OSS. The SOV shall be able to react and connect with gangway to the OSS within 30 minutes upon request. The SOV walk-to-work system shall as minimum be operational for wave heights up to 2.5 m Hs.Role and Need for Barrier Reference Weather conditions shall be monitored and personnel onboard the OSS shall be transferred to SOV prior to the critical weather condition is reached. The SOV shall be equipped with fast rescue craft and have emergency medical facility. Evacuation via CTV Minimum two boat landings shall be available for CTV access. Helicopter winching area A helicopter winching area shall be provided on the top deck. The winching area is for emergency scenarios when not requiring immediate evacuation. It is not intended for normal crew transfer nor normal goods logistics but may be used in exceptional cases for personnel transfer and/or goods logistics. Design and obstacle restrictions and visual aids marking shall be according to requirements for helicopter winching areas in CAP 437 and relevant local codes and standards. There shall be no obstructions such as antennas, masts or other equipment preventing helicopter access above the winching area. The maximum helicopter rotor diameter size shall correspond to type of SAR helicopters to be used in Polish waters. Escape chutes with life rafts Escape chutes with life rafts shall be provided on two separate locations of the installation arranged such as to maximize availability with respect to sea conditions. Each escape chute location shall have capacity for maximum POB. The escape chutes shall comply with air-gap requirements as specified in the OSS Topside Technical Specification and be located such that they are unimpaired by excessive toxic fumes, smoke, unacceptable heat loads, hot liquids and falling objects for minimum 60 minutes after all reasonably foreseeable incidents begin. The chute system’s life rafts and boarding raft shall be lowered together with the chute, and the boarding raft shall automatically inflate.Role and Need for Barrier Reference The escape chute system shall be readily available and easy to operate with clear operating instructions located on an appropriate place, e.g. on the wall inside container. Winch for recovery should be fed by main power. Removal of rafts for re-certification shall be possible without affecting the suspension system including lifting wire. Location and arrangement shall ensure easy lifting, installation and removal of the chutes. The evacuation-to-sea-equipment shall be type approved and tested according to IMO/SOLAS/LSA, code and national maritime regulatory requirements. Rescue and safety equipment Suits and life jackets Permanent cabinets for storage of survival suits (with floating and thermal protection abilities) shall be located at or close to the primary muster station, corresponding to the maximum POB on the OSS. The survival suit is personal safety equipment, meaning that each person on the installation shall have their own suit that is brought onboard and temporarily stored in the permanent cabinets. There shall be sufficient space around the cabinets to ensure quick dress up for the maximum number of POB. Additional storage of survival suits corresponding to the maximum POB shall be available at the muster station. Survival suits shall as a minimum be type approved according to IMO/SOLAS/ LSA Code, but additional requirements may come out of the EER analysis. The following applies: • Design should minimize impact to the neck of the wearer in case of jumping from a high level • Be of a color which is easily visible at sea (yellow, orange, etc.) • Have reflecting and/or fluorescent markings to facilitate rescue in the dark Life buoys Life buoys shall be installed at regular intervals on lower deck perimeter along the walkway, for guidance see DNV-ST-0145. Safety showers and eyebathsRole and Need for Barrier Reference The layout and arrangement shall reduce the probability and the consequences of accidents through location, separation and orientation of areas, equipment and functions. The explosion barriers shall reduce the consequences of the pressure loads from an ignited cloud of released gas or oil mist to prevent the accident to spread to other areas and/or critical equipment. TR3021 Electrical system design, offshore units DNV-ST-0145 Offshore SubstationsRole and Need for Barrier Reference Need for safety showers or eyebaths and strategic locations shall be identified through a separate evaluation considering the chemicals handled and spillage that may occur or risk for burns or exposure of hot fluids to personnel. Potable water quality shall be used for safety showers and eyebaths. First aid kits and equipment An adequate number of first aid kits shall be provided at suitable locations and shall as minimum be provided at the Multipurpose room. The muster station / locker room shall further accommodate storage/space for first aid equipment such as medication, rigged stretcher and defibrillation equipment. Search and rescue equipment Breathing masks/smoke hoods for escape through areas exposed to toxic fumes or smoke shall be evaluated. Electrical rescue kits shall be available and easily accessible for personnel performing tasks in electrical rooms.Role and Need for Barrier Reference C274-RA-S-SP-01000 - - Design Accidental Load Specification (DAL) Relevant hazards • Safety critical functions impaired by accidental loads • Security incidents or accidents caused by third party entry to the installation • Explosion e.g. due to fault in oil filled transformers resulting in escalation between equipment or areas • Asphyxiation risk related to leaks from pressurized bottles (inert gas, SF6, N2) Requirements Areas or equipment of high-risk potential (e.g. oil filled transformer area) shall be segregated by sufficient distance or barriers from areas required to be of low risk potential, and from areas containing important safety functions. Incident escalation between areas shall be avoided. Muster and embarkation areas and rooms with safety critical functions shall be located at lower deck level, separated and protected by plated deck towards areas and spaces with higher risk potential which shall be located above (e.g. transformer areas, cooler areas). Physical security Access to boat landing and ladder up to lower deck level may be available for third party, but access to deck shall be controlled and locked for third party, e.g. by mariner cage or similar. The lock design on the mariner cage entrance door must facilitate escape from the platform. Ladder entry and boat landings shall be part of CCTV coverage. All rooms on the installation shall be locked as default. High voltage rooms locked with dedicated keys. High Voltage cabinets locked with pad locks. Ref high voltage (HV) safety rules. Explosion design principles for rooms for major electrical equipment The rooms shall withstand without any damage the highest blast pressure caused by a short circuit. As a general rule it is not necessary to do any calculations to document this requirement for short circuit levels up to the levels listed below (indicated as the maximum symmetrical root mean square (RMS) value of the sub transient fault current): - 11 / 6,6/3,3 kV: 40 kA RMS - 690 V: 50 kA RMSRole and Need for Barrier Reference The crane barrier shall reduce the probability that errors and hazards will arise during crane operation and reduce the possibility of boom or load fall. Relevant hazards TR1727 Substitution to TR1727 ver 5, Unmanned installationsRole and Need for Barrier Reference - 400/230 V: 30 kA RMS – Main distribution board; - 400/230 V: 10 kA RMS – Sub-distribution board For higher short circuit levels, the room integrity towards blast pressure caused by a short circuit shall be documented. Explosion design principles - Oil filled transformer areas The amount of venting available, the degree of blockage and congestion in the area significantly influence the severity of an explosion and shall be optimized to reduce explosion risk. Oil filled transformers should be located in natural ventilated area. Dimensioning explosion loads shall be established and implemented in design for structures and equipment. Explosion panels shall be provided in walls facing sea (if partially enclosed) in order to reduce explosion load potential. Storage of pressurized bottles (Inert gas, SF 6 , N 2 ) Storage of pressurized bottles should be in naturally ventilated area. If gas bottles are stored in enclosed spaces, introducing risk of asphyxiation, adequate ventilation shall be provided, and leak detection evaluated.Role and Need for Barrier Reference DNV-ST-0145 Offshore Substations EN 13852-1 and 3 C274-RA-R-SP-01003 - Main Crane System Specification C274-RA-R-SP-01004 - Davit Crane System Specification C274-RA-R-SP-01005 - GIS Room Crane System Specification • Dropped objects impacting e.g. personnel, critical equipment, CTV or SOV, subsea cables etc. Requirements The offshore crane and davits shall comply with TR1727 Substitution for unmanned installations. The likelihood of crane boom or load fall as well as hanging loads hitting personnel or critical equipment shall be reduced as far as practicably possible. Crane coverage and laydown areas shall be arranged to promote safe operations of the cranes and free, unobstructed visibility to lay down and lifting zones for operator of the crane. There shall be no lifting zones above unprotected equipment or piping, containing flammable or toxic gas/liquid. Lifting zones to SOV/CTV shall be located such that lifting operations to the SOV/CTV can be done leeward of the predominant weather conditions. The lifting zones should be located away from cables to or from the OSS if practical. The cable protection system (CPS) shall be capable of handling relevant dropped object loads. The lifting zones shall be defined and available as a lifting map. Deck load limitation chart shall be established. A sign indicating maximum weight and loading rating shall be displayed at each laydown area. The cranes shall be equipped with necessary fire protection means, The crane shall be operable to a safe position in the event of an accident. The davit crane shall be capable and certified to lower injured personnel to CTV. Swinging load protection shall be implemented on laydown areas as required to prevent impact to critical equipment and critical damage to load bearing structures. This is also relevant in all foreseeable lifting zones from cranes on the OSS and use of SOV gangway and gangway associated SOVRole and Need for Barrier Reference International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) Recommendation O-139, The marking of man-made offshore structures (2013) The Vessel Collision Avoidance System shall reduce the risk of vessel collisions. The surveillance of the sector around the installation may be performed by a central surveillance unit, a local surveillance unit (a unit or vessel responsible for more than one installation), a dedicated standby vessel or the installation itself. Hazards • Ship collision with infield vessels in transit (powered collision), e.g. Service Operation Vessel (SOV) or Crew Transfer Vessel (CTV), • Ship collision with SOV during approach (“drift on” or “drift off”) • Ship collision whilst in position next to the OSS (“drift on” or “drift off”) • Collision with fishing vessel or passing merchant vessel Requirements The unmanned OSS will not be equipped with a radar system. The collision avoidance strategy is based on surveillance by CTV/SOV when personnel is on the OSS, in combination with requirements to aids to navigational, wind farm layout and procedures for infield vessel movement. The OSS design shall incorporate AIS. CCR shall be able to survey the area around the OSS in all directions by CCTV. Field layoutRole and Need for Barrier Reference associated crane (if equipped). The boat landing, including ladders and platforms, shall be designed with respect to impact / swinging loads from material handling.Role and Need for Barrier Reference The OSS shall be located minimum 500 meter behind the straight line of wind turbines defining the perimeter of the wind farm (towards parallel navigational route). Wind farm internal transit routes shall allow infield vessels to pass the OSS with minimum 500 m clearance. SOV requirements (in the event SOV should be used on the windfarms) The SOV shall have minimum DP class 2 design. Operational procedure shall be in place for the SOV to approach and connect to the OSS on the leeward side of the installation with respect to the dominating environmental forces, such that SOV will drift away from installation if incapable of maintaining target position and/or heading. Aids to navigation (AtoN) The following AtoN measures shall as minimum be implemented on the OSS, each with an availability of no less than 99.0% (IALA Availability Category 2). • AIS base station • Foghorn • Marking of the substation in accordance international and national requirements. • DP laser reflectors Communication system System shall be in place for communication with vessel on collision course. SOV and CTV shall be equipped with necessary equipment to get attention from vessel on collision course, e.g.: • Signal lamps with intensity of minimum 1000 candelas • Megaphone with sound intensity of 80 dBa Fast rescue craft on the SOV shall be equipped with approved maritime VHF.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations DNV-RP-C204 Structural design against accidental loads C256-EQ-Z-SP-00012 OSS Substructure Technical Specification C274-RA-S-SP-01000 - - Design Accidental Load Specification (DAL) Load bearing structure shall withstand all loading situations under normal operation and also ensure structural integrity after a dimensioning accidental event. Main design principles Load bearing structures shall be sufficiently robust to ensure that local damage or failure will not result in unacceptable consequences. • Slender, main load bearing structural elements shall be demonstrated to be redundant. • Main load bearing structures shall be designed so that water penetration through outer walls facing the sea cannot lead to loss of main safety functions. The topside structural integrity shall be documented for all governing conditions and phases during the platform lifetime, i.e. from prefabrication, assembly, weighing, site moves, barge transportation and installation to offshore hook-up, operation and abandonment. The jacket and topside structure shall be designed to withstand the Dimensioning Accidental Loads (DAL) associated with the following Major Accident Hazards (MAH) where relevant: Fire, Explosion, Dropped objects, Extreme Weather and Ship collisions. Recognized models/methods and competent personnel shall be used to determine the corresponding design accidental loads.Role and Need for Barrier Reference Systems for consequence reduction and evacuation • Evacuation of personnel • ESD - platform shutdownRole and Need for Barrier Reference C274-RA-N-FD-01001 - - Structural Design Brief (Topside) Dimensioning accidental loads and environmental loads shall not cause the loss of main safety function(s). Ship collision It is not considered practical to design for impact energies associated with a passing merchant vessel collision. This hazard shall be addressed by preventive measures (ref. PS19). The OSS shall be designed to withstand a collision of a service operation vessel up to 6000t displacement. For ALS, a ship impact speed of minimum 2.0 m/s shall be used with added mass as per requirements in DNV-ST-0145. Energy absorbed by striking vessel may be taken according to DNV-RP-C204. Some structural damage is considered acceptable under the above circumstances provided the overall structural integrity of the platform is not compromised. Collision with vessel superstructure shall be considered in design of the topside. Safety critical equipment or equipment that could cause environmental harm in case of a collision shall not be positioned at the outer faces of the topside. Layout around the OSS gangway landing areas shall prevent SOV DP failure (drive-off/drift-off) with inward movement of the gangway leading to an escalating event, e.g. by causing damage to safety critical equipment. Extreme weather Airgap requirements given in DNV-ST-0145 shall be fulfilled. The topside shall have positive air gap in all conditions, reference is made to the Offshore Substation Substructure technical specification for details.Role and Need for Barrier Reference TR 4031 Automation technology -Offshore wind TR4036 Operator station HMI – Offshore Wind Power EN 62682 Management of alarms systems for the process industries EEMUA Publication 191 Alarm systems - a guide to design, management and procurement EN ISO 11064 Ergonomic design of control centers Part 1: Principles for the design of control centres Human machine interface (HMI) in central control room (CCR) shall provide system information presentation and means for operator interactions. HMI provides the physical interface between systems and facility operator, maintenance technicians and other personnel operating and monitoring the facilities. The HMI shall present safety-related information for all systems, including: • Status of wind turbine generators (start-stop, trip/shutdown), substations, transmission system and grid connections • Status of navigational aids on the wind turbine generators and substations • Electrical overview, including status/position of high voltage switches and breakers, local isolations etc. • Weather monitoring/forecast, including lightning, sea state etc. • Fire detection on wind turbine generators and in substations • Location of vessels (service operating vessels, CTVs as well as other vessels) • Location of helicopters (where relevant) • Location of personnel • Status of work permits / work releases • For offshore structures: External CCTV monitoring. Internal CCTV monitoring to be considered. Night vision to be considered for external cameras. • Intruder detection for all wind turbine generators, substations • Natural ventilation and heating, ventilation, and air conditioning • Shutdown hierarchy overview and status • Fire & gas overview, e.g.., per main fire area and/or fire detection area The HMI shall include a main operating interface in CCR and allow for manual activation of critical safety functions.Role and Need for Barrier Reference All systems and HMI designated critical for safety or production shall be designed such that easy, fast recovery methods can be employed to regain control of the system. This includes management of software backups and system components as well as documentation to facilitate recovery. The system shall be designed for continuous operation, such that system function is always maintained. The HMI shall be designed to prevent inadvertent operations due to operator misperception and unintended actions. EN 62682 and EEMUA 191 shall be used as basis for design of alarm functions. TR1494 and EEMUA Guideline 191 should be used for guidance. Failure to execute safety functions on demand shall initiate an alarm in CCR. The HMI facilities shall include detailed safety system information such as input and output status, alarms, status of inhibit, override and suppression and safety system fault indication. Number of visual display units shall depend on the result of the function and work task analysis. Failure to execute safety functions shall initiate an alarm in CCR. HMI control functions • Initiate shutdowns (ESD / process level) • ESD level reset • F&G reset (e.g., per fire detection area) • F&G common reset of inhibits and overrides (e.g., per fire detection area) • ESD common reset of inhibits and overrides • Firefighting release Requirements in EN ISO 11064 “Ergonomic design of control centers Part 1: Principles for the design of control centres” shall be adhered toAIS Automatic identification system ALARP As low as reasonably practical (term is related to reducing risk level) ALS Accidental limit state CAP Critical action panel CCR Central control room CCTV Closed-circuit television CTV Crew transfer vessel DNV Det norske Veritas DP Dynamic positioning EER Escape, evacuation and rescue ESD Emergency shutdown ESI Electrical System Infrastructure F&G Fire and gas GA General alarm GIS Gas insulated switchboard GWP Global-warming potential HMI Human-machine interface HVAC Heating, ventilation and air conditioning IP Internet Protocol IR Infra-red MCP Manual call points MFW Morska Farma Wiatrowa MOB Man overboard boat ONS Onshore substation OSS Offshore substation PA Public address P&C Process and Control POB People on board PRV Pressure release valve SAR Search and Rescue SCADA Supervisory Control and Data Acquisition SF6 Sulfur Hexafluoride SOV Service operation vessel TETRA Terrestrial Trunked Radio UHF Ultra-high frequency UPS Uninterrupted power supply UV Ultraviolet VHF Very high frequency VRLA Valve regulated lead–acid WTG Wind turbine generatorFire division class A Fire rated physical division between two fire areas. A division made of non-combustible materials fulfilling the following criteria: 1. it shall be sufficiently braced 2. it shall prevent the propagation of flames and smoke for a minimum of one hour of the standardized fire test following the temperature-time curve defined in ISO 834-1, 3. it is designed so that the average temperature and the temperature at any single point on the unexposed side does not exceed 140 degrees C and 180 degrees C respectively above the initial temperature within the time limits stated below: Class A-60: 60 minutes Class A-30: 30 minutes Class A-15: 15 minutes Class A- 0: 0 minutes Fire division class H Fire rated physical division between two fire areas. A division made of non-combustible materials fulfilling the following criteria: 1. it shall be sufficiently braced, 2. it shall prevent the propagation of flames and smoke for a minimum of two hours of the standardized fire test following the described time- temperature curve defined in EN 1363-2, 3. it is designed so that the average temperature and the temperature at any single point on the unexposed side does not exceed 140 degrees C and 180 degrees C respectively above the initial temperature within the time limits stated below: Class H- 120: 120 minutes Class H-60: 60 minutes Class H-0: 0 minutes Offshore substation Offshore installation which receives the electrical power produced at the wind turbine generators, transform the voltage to a higher level suited for export to shore and export the power to onshore. Offshore windfarm The offshore area where the wind turbine generators are located. Offshore substation is located within the offshore wind farm.