Thunder Horse's high pressure and temperature environment, added to equipment size and enclosed volume, made pressure testing potentially hazardous and failure consequences far-reaching. The industry does have a fairly good safety record; however, near misses are still prevalent. Though few and far between, when incidents happen, they tend to be spectacular. Evaluating ballistic potential of objects flying off the equipment demonstrated how exposed we would be, given a sudden catastrophic failure. This led to a major re-assessment both in mitigation methods and test facilities.
Pressure testing from a design engineer's perspective is a validation of his or her analyses work. The design meets requirements and after assembly, a pressure test confirms that everything was built properly. When looking at Safety, a different set of criteria must be considered and many 'what if' questions must be answered to satisfy requirements. These must seriously consider a 'train wreck scenario', for whatever multitude of cumulative errors, and review the risk of exposure to people and to assets. This paper focuses on problems associated with high pressure products with an emphasis on highlighting that design cannot end with product manufacture, but must continue beyond, to the physical testing.
The Thunder Horse project requirements of high pressure and temperature with large bore piping made it imperative to check the ballistic potential of pressure caps and anything else that could possibly be unintentionally released, in a failure situation. The ballistics analyses demonstrated a number of interesting points. Firstly that existing facilities may need to be upgraded, not only for Thunder Horse, but also for less onerous work, for which we thought we were already qualified. The distances that objects could reach was surprising and in many cases would exceed the boundaries of the building or outside test site. Testing would be impractical unless mitigation methods could be employed to reduce these projectile distances.
Obviously with high pressure, a large volume will tend to increase ballistic potential and could be mitigated by using volume reducers. This is true up to a point after which the energy transfer to the 'projectile' remains constant. This phenomenon is referred to as the 'small plug case', where the plug is ejected before the system stored energy can be fully converted to kinetic energy in the plug. The plug outlet effectively acts to choke the flow from the vessel. The mass of the projectile will also determine distance of flight; the heavier it is; the more energy is required to move it. This presents further methods of mitigation; by adding weight, using a mass in the way of the object or using an independent locking mechanism as an extra retention device. These would be used in conjunction with an exclusion zone where all personnel would be kept far enough back, to avoid any missiles, should the unthinkable happen.
All of the above mitigation tools were strategically employed based on the ballistic results. This was done singularly or in combination as circumstance dictated.
