Distribution date: Rev. no.: Copy no.: 08/09/2023 02Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:This document describes the safety strategy for the offshore substation. The safety strategy is input to the development of the substation and shall be further detailed during the engineering phase to document conclusions on safety aspects relevant for the development of the offshore substation and interface with the wind farm.• Visualize the connection between risk and hazard evaluations specific to the offshore substation and the wind farm hazardsThe safety strategy describes how risks are to be managed based on the outcome of a systematic identification and evaluation of the hazards and effects which may arise on the specific installation.The aim of developing the specific safety strategy is to identify installation specific philosophies, strategies and requirements. This information shall outline the design principles for layout, configuration, arrangement, the selection and role of safety barriers to manage risk on the installation. Further the safety strategy shall define initial performance requirements and design requirements.In general, requirements in DNV-ST-0145 Offshore Substations shall apply, but this Safety Strategy provides supplementary requirements and clarification of safety barrier strategies applicable to the Wind project. In case of conflicting requirements, the requirements in this safety strategy shall prevail.The document shall be used as specification for safety related aspects including detection and mitigation hazardous situations and events. This document shall however not restrict designers in developing the most optimized design. The safety strategy shall be updated by Company during the engineering phases. Contractors who perform design of the OSS shall contribute with input to the strategy document, addressing specifics related to their proposed concept. If solutions chosen / proposed by Contractor conflicts with this document, Company shall be consulted.The safety strategy is structured according to the Company defined barrier systems, with the objective to:• Describe the need for and role of barriers that are established to manage risk related to major accidents.• Establish adequate understanding of the barriers in order to make correct decisions and understand their role.• Form a basis which can be used as a management tool to keep the integrity of the barriers intact during operation and modifications.The safety strategy is a lifecycle document and shall follow the installations into the operation as documentation of the safety barriers and for follow-up of the safety barriers. This safety strategy is established for the project phase intended to suite engineering and construction work.This document describes Company minimum requirements. However, if national authority requirements are stricter these shall prevail.This safety strategy covers the offshore substation (structures, equipment and control of the OSS) and subsea installations within the scour protection area around the jacket.Both project´s cable arrays shall have a dedicated Offshore Sub Station (OSS), centrally located in each park, directing export cables through a single route to shore.Target group for this document is the Company project organization, Company operations organization and project engineering, design Contractors and authorities. Furthermore, the document can be used as supporting documentation to Authority submissions.FEED documents with document number type C274-RA-x-xx-nnnnn added as reference document in section 6 represent the status of the FEED phase and shall be considered as guidance only. The solutions presented in the referred FEED documentation shall not prevent Contractors from further improvements and development of the proposed design.The areas of interest are in the southwestern Baltic Sea within Polish waters with water depths ranging from 20m to 45m. The total area of is 122 km 2 and the total area of is 117 km 2 .are located 55 and 60 km respectively from the windfarm boundary to the landfall location near Ustka, and a further 10 km from the landfall point to the Onshore Sub Station (ONS) at Slupsk (distances calculated along the export cable corridor). Closest straight-line distance to shore is 36 km from the perimeter of and 22 km for .Potential future wind farms are being developed around and between the area of as shown in FigureOffshore Wind Law, Phase 1 Areas Wind Farms, other possible future areas Bird Migration Corridors Protection Areas (Natura 2000)Figure 1 - Neighbouring future offshore wind farmsThe scope of the wind farm development encompasses wind turbines (WTGs), their foundations, inter-array cabling, one offshore substation per wind farm, an export cable system, a landfall, two separate substations in one common area and the connection to a transmission grid substation where the electricity will be exported to the Polish power grid. The two projects have according to the Polish regulatory requirements a combined maximum capacity of 1440 MW, 720 MW per wind farm. A schematic visualization of the project scope is shown in Figure 2.The offshore substation (OSS) will be normally unmanned and visited for inspection and maintenance activities. The control of the substation and the wind farm will be from a permanently manned control room within the maintenance base located onshore. Emergency offshore shelter at OSS shall be designed for 12 persons onboard (PoB) during normal operation. During offshore hook-up and commissioning and planned maintenance operations it should be possible to temporarily support up to 36 PoB when based on the vessel spread used to support the installation and commissioning The OSS will be supported by a jacket structure and is envisaged to be comprised of a cellar/cable deck (lower level), main deck, utility deck and a roof level.• C275-EQ-Z-SP-00001_05 (MAD RE2019-007 rev 4) - Metocean Design Basis.Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:The power production from the WTG’s is split into two separate power production trains, A and B train. The two trains are physical segregated from each other to avoid accidents in one train to influence the other train.• Roof with possibility for Heli hoist (medevac or special lifts)Base case for access to the OSS is by CTV during the operations phase via access ladders from sea level. In addition, landing areas for use of service offshore vessel (SOV) and walk to work bridge shall be installed. The SOV size can be up to 6000 tons displacement. The SOV or the CTV will not stay connected when personnel are onboard but located in the field at a distance outside the safety zone. The OSS will be visited approximately once a year for routine inspection and maintenance activities and every three years for a planned outage maintenance campaign.• C274-EQ-Z-SP-00001_05 (MAD RE2019-006 rev 4) - Metocean Design BasisSafety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:All-year wind rose 10 m above sea level are shown in Figure 3 for and figure 3 forFigure 3 - All-year wind rose for for the period 1980-2018 Baltyk 111 - All yearBIBIBBDDDEJDBBBB ? s i ssisK e its aFigure 4 - All-year wind rose for for the period 1980-2018Figure 5 - All-year wave rose for for the period 1979-2018Figure 6- All-year wave rose for for the period 1979-2018Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:All-year wave rose for are shown in Figure 5 and Figure 6 respectively.The current rose at surface for are shown in Figure 7 and Figure 8 respectively.$ S 2 o - 8 7 7 S 8 8 £ 8 S ? R £ © t M??8g£3SSRSsZFigure 8 - Current rose at surface atWet snow may accumulate on surfaces and vertical structures, e.g. communication mast. Atmospheric icing is possible. Estimated ice thickness (data for 50 yrs available) at 100 meters on cylinders and non-rotating structure elements is approx. 30 mm. Specific assessment atmospheric icing on OSS is not performed. Sea spray icing is caused by freezing sea spray. Sea spray icing can be expected up to 25 meters above sea level and with the thickest ice layer of up to 80 mm (100 yrs) between 5-10 meter. There will also be ice accumulation below 5 m but not during extreme storm when large waves will transport heat to the lower region of the structure and the ice is exposed to thermal and mechanical deterioration. These values are equal for .Sea ice can occur at and an average ice season is in range of 10-20 days while maximum duration is about 40 days. Expected annual probability of occurrence of ice is approximately 10 -1 . The sea ice thickness at 100 years return period is estimated in ref /C256-EQ-Z-CA-00001_05 / to be 0,38 m for and 0,39m for .There are fishing activities within both wind farms and along the route for the export power cables. Within the wind farms the type of fishing gear used is bottom nets. There are also fishing vessels passing through the wind farms as there is an area for trawl fishing north of the wind farm areas.There are ship navigation routes both south of and north of the wind farms. AIS data show very low density of ship traffic in the vicinity of the wind farms as per today. When WTGs are present in the future and the sea maps are marked, the ship traffic is expected to be even lower. The OSS is located within the windfarm surrounded by the WTGs.Reference is given to Appendix E of the Contract.In general, systems that are easy to design, operate and maintain will be safer than more complex designs. This is also valid for design of safety systems. In priority it is recommended to develop our plant designs in the following order, ref Figure 9:Elimination of hazard - design it out Substitution - use something less hazardous2. Systems as barriers Engineering controls - isolation and guarding3. Manuel procedures Administrative controls - training and work scheduling Design for operation with low complexityPersonnel and asset risk shall meet the risk tolerance criteria provided by s risk matrix shown in Figure 10. The consequence categories are described in Table 1. The interpretation of colours is described in Table 2.Probability category 1 2 3 4 5 6 7 8(<10 -5 /yr) (10 -5 -10 -4 /yr) (10 -4 -10 -3 /yr) (10 -3 -10 -2 /yr)Figure 10 - Risk Tolerance Criteria, 9x8 matrix for activities with major accident potential outcome (internal reference R-105890, RM100)Table 1 Description of consequence (impact) categories (Internal reference R-24383, RM100)* Consequence category 7, 8 and 9 are considered major accidents inSafety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:Table 2 Interpretation of colours in design phase (internal reference R-11452, RM100)The following main safety functions are further defined for the OSS:• The main load carrying capacity (structure) shall be intact until the installation has been evacuated (in manned scenarios), which means that there must not be extensive deformation or collapse of the whole or considerable parts of the installation before evacuation.• Installation parts with functions that are vital to combat accidents and/or ensure safe shutdown shall be intact until the emergency activity has been completed or the facility has been evacuated.• Mustering areas, evacuation means, and other areas defined as “safe areas” shall be protected so that they remain intact until the facility has been evacuated.• At least one escape route for personnel in other areas than the area(s) exposed to the initial accidental event shall be intact until all personnel have escaped to safe area.The annual probability of loss of the main safety functions shall be lower than 1 x 10 -4 for each of the following accidental loads:• Heat loads (e.g. due to fires in combustible materials such as transformer oil, diesel etc.)• Smoke and toxic loads (e.g. due fires in combustible materials such as transformer oil, diesel etc.)• Explosion loads (e.g. related to transformer failure)• Impact loads (e.g. collision loads from vessels, dropped object loads from lifting operations, etc.)• Extreme environmental loads, such as o Wind, wave, current o Sea ice o Icing o EarthquakeBased on a perceived well known and controllable risk picture, these quantitative criteria may be assumed complied with by using the following minimum design criteria:• Platform structural integrity and robust layout shall secure safe escape from all areas of the platform during an incident, maintaining the main safety functions• The fire protection design shall ensure that a fire or explosion in the equipment is contained and will not lead to escalation to other areas or parts of the electrical system. Segregation of transformers and other criticalequipment shall be ensured so that a fire or explosion in one transformer does not lead to complete loss of production• A fire- and explosion analysis is required to document the design and ALARP evaluations shall be made. o Transformer Fire: The dimensioning fire load for oil-filled transformers are determined by the pool fire subsequent to a transformer explosion scenario (an explosion will rupture the transformer resulting in loss of transformer oil to the surroundings). The size of the pool is determined by the size of the bunding, or containment area and a typical heat flux can be of the order of 150 kW/m2. The duration of the pool fire will be determined by the evaporation rate (typical 50 g/m2/s) and the drain capacity in the area. o Transformer Explosion: The dimensioning explosion load for oil-filled* transformers are determined by an internal electrical arc, leading to a transformer rupture resulting in an ignited gas cloud (containing both oil mist and pyrolysis reaction products). The energy involved (for gas cloud size) is determined by the circuit breaker time and the transformer rating.• Impact loads - vessels: The structure shall be designed to withstand a collision from SOV with displacement of 6000 t and vessel speed minimum 2 m/s as per requirements in DNV-ST-0145.• Extreme Weather: The installation is designed to as minimum withstand the 100-year return period storm conditions without experiencing any impairment of the safety functions or integrity of the installation. The installation is unmanned in extreme weather, but it shall as minimum be designed for a 1000-year return period ALS event.If the above points are adhered to, further quantification is deemed unnecessary. Otherwise, normal quantitative risk analysis shall be performed.Barriers shall be in place to prevent a single event to developing into major accidents. A traditional barrier diagram illustrating the principle of barrier functions to prevent unwanted events and consequences are shown in Figure 11Reduce possibility of fault, hazard and accident situations developing into unwanted eventReduce probability of fault, hazard and accident situationsIdentify conditions that can lead to fault, hazard and accident situationsFigure 11 - Barrier diagram indicating barrier functions (shown in red) to prevent unwanted events and consequences.Company has, based on systematic review of different hazard and accident scenarios, internal and external requirements, international standards and best practices, established company requirements to barriers for O&G facilities classified as performance requirements and sorted by performance standards (PS). The company performance standards for O&G offshore facilities are provided in TR1055. Relevant performance standard definitions are used in this safety strategy for the OSS in order to provide a comparable basis towards the standardized barrier definitions within the Company, see Table 3. The role and need for barriers according to this structure are provided in chapter 6.Table 3 Performance Standards (PS) for the offshore substationThe following hazards have been identified at current stage of the project, ref Table 4. The hazards are further detailed and evaluated in doc.ref. C274-RA-S-RA-01002 – FEED HAZID report. The hazards in the FEED report are referenced to as “FEED [n]” in table 4 hazard description.4 Fire in or around oil filled transformers. Heat or toxic smoke exposure to personnel – FEED [1, 29,exposure to personnel - FEED [7, 10, 11, 12, 22, 29, 30, 39, 40, 41]6 Fire in hydrocarbon systems (Hydraulic Oils, diesel engine, etc.). Heat or toxic smoke exposure toSafety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:Safety strategy for offshore substations III Doc. No. C256-EQ-S-FD-00003 Rev. no. 02 Valid from:Techn. responsible (Organisation unit / Name): Responsible (Organisation unit/ Name): Recommended (Organisation unit/ Name): Approved by (Organisation unit/ Name):Author(s)/Source(s): Subjects: Context, Hazards, Safety in design, Barrier functions, Performance standards, safety strategies Remarks: Updated: Valid from: 08/09/2023 Responsible publisher: Authority to approve deviations:Distribution: Classification: Internal Expiry date: Status FinalTitle: Safety strategy for offshore substations Contract no.: Project: Document no: C256-EQ-S-FD-00003Environment People’s health and safety 1 – 3 / Minor Very limited impacts (restitution time < 1 month) on populations (local), ecosystems or environmentally sensitive areas of local importance. Local impact on individual organism level Medical treatment, injury, event or work-related illness with need for treatment or with temporary health effect 4 / Moderate Short term impacts (restitution time <1 year) on populations (local), ecosystems or environmentally sensitive areas of local importance Injury, event or work- related illness that result in brief absence or restricted / substitute work or some functional impairment. Medically manageable 5 / Serious -Short term impacts (restitution time <1 year) on populations (national or regional), ecosystems or environmentally sensitive areas of national or regional importance -Medium term impacts (restitution time 1-3 years) on populations (local), ecosystems or environmentally sensitive areas of local importance Serious injury, event or work-related illness with absence from work, restricted work or permanent health effects. High level of medical treatment, serious functional impairment 6 / Severe 1-3 fatalities or work- related illness / exposure with significant life shortening effects -Medium term impacts (restitution time 1-3 years) on populations (national or regional), ecosystems or environmentally sensitive areas of national or regional importance -Long term impacts (restitution time 3-10 years) on populations (local), ecosystems or environmentally sensitive areas of national importance 7* / Major 4-20 fatalities or illness/ exposure cases with significant life shortening effects and/ or larger parts of installation/ plant/ office. -Large oil spill in populated area -Long term impacts (restitution time 3-10 years) on populations (national or global), ecosystems or environmentally sensitive areas of global or national importance -Very long or permanent impacts (restitution time > 10 years) on populations (regional), ecosystems or environmentally sensitive areas of regional importance 8* / Catastrophic -Large oil spill in densely populated area -Very long or permanent impacts (restitution time >10 years) on populations (national or global), ecosystems or environmentally sensitive areas of global or national importance 20-200 fatalities or illness/ exposure cases with significant life shortening effects and/ or main part of installation/ plant/ office. 9* / Extreme -Large and long-lasting oil spill close to densely populated shoreline. More than 200 fatalities illness/ exposure cases with significant life shortening effects and/or loss of installation/plant/officeMitigation and sharing of risk Risk level RED Single red risk is generally intolerable and far beyond the Group's risk tolerance criteria. Mitigating actions must be implemented as soon as possible. ORANGE Single orange risk is generally intolerable, and mitigating actions must be implemented. YELLOW Mitigating actions shall be identified based on the ALARP (As Low As Reasonably Practicable)/ BAT (Best Available Technology) principle or other applicable principles subject to relevant jurisdiction(s). Risks in the green zone are generally tolerable and actions are normally not required. GREEN# Barriers # Barriers Alarm and Communication System for use in Emergency Situations PS2 Natural ventilation and HVAC PS14 Escape, Evacuation and Rescue (EER) PS3 Leak detection PS15 Layout Design Principles and Explosion Barriers PS4 Emergency Shut Down (ESD) PS16A Offshore cranes PS5 Open drain PS16B N/A PS6 Ignition source control PS17A N/A PS7 Fire Detection PS17B N/A PS8 N/A PS18 N/A PS9 Active Fire Protection PS19 Avoidance of vessel collisions PS10 Passive Fire Protection PS20 Structural integrity PS11 Emergency Power and Lightning PS22 Human Machine Interface and Alarm Management PS12 Process Safety PS23 Safety & automation system security