The following preliminary hazards have beenidentified (to be evaluated and further detailed in next phase/revision), ref Table 4.Table 4 Hazard identification5 Risk and consequence descriptionThis section provides a description of the risks and consequencesrelated to the hazards identified in section 4.Techn. responsible (Organisation unit / Name):Safety strategy for offshore substationsDistribution date: Rev.no.: Copy no.:Doc. No. C256-EQ-S-FD-00003 Rev. no. 01 Valid from:2.3.2 WAVES... oo.e ce ceecceeee ce ece ce eeceeeceeeecauececeeeceeneceececeeeceececeeecsenececeeeeueceaeecececeeuececeeeeeeceeeececeseeeeeeeeeeeeeees= = : . - O DOAN DADO Aa wan2.6 Third partyaactivities 1snearbyththe 1e devebpmert ceccececaeseseceecececcesuseesececeesuseeseseceececaeaeaeaeceecesseseaeereseeeseees5 Risk and consequence, description.6.1 Containment (PS Novsctessttesttecetneistisiiisititiiisnienen6.2 Natural ventilation and HVAC (PS 2) 0.0.0... e ce eeeee cee ceeee cece ene ce cece ececenseececeuececaueaecaeeeeseeeeeeeeeeaeeeeeeneeeesRREB!oo O OD WABAODwWNHN NN DN DN6.5 OpenDrain system (PS 5) ............. ccc ceeeeeeeeeeceeeeeeee eee eee eeeeeeeeeeeeeeeeeesseeseseeseeseesestereeseeseceeceeceeeeeets6.9 Passive Fire Protection (PS 10) -.............. co.cc eee ee cece ee cee cee cee ce cee cee cee ceececeeceecaeeeecueaueeeeaesueeeeaeeaeeeeeeeaeees2. Systems as barriersSafety strategy for offshore substations MFW BaitykIl & MFW Doc. No. C256-EQ-S-FD-00003 BaitykIll Rev. no. 01Safety strategy for offshore substations MFW Battyk Il & MFW Doc. No. C256-EQ-S-FD-00003 BattykIII Rev. no. 011 Objective and Target groupThis documentdescribes the safety strategy for the offshore substation. The safety strategy is input to developmentof the concept andshall be further detailed during the engineering phase to document conclusions on safety aspects relevant for the developmentof the offshore substation and interface with the wind farm.The safety strategy describes howrisks are to be managed based on the outcomeof a systematic identification and evaluation of the hazards and effects which mayarise on the specific installation.The aim of developing the specific safety strategy is to identify installation specific philosophies, strategies and requirements. This information shall outline the design principles for layout, configuration, arrangement, the selection and role of safety barriers to managerisk on theinstallation. Further the safety strategy shall defineinitial performance requirements and design requirements.In general, requirements in DNV-ST-0145 Offshore Substations shall apply, but this Safety Strategy provides supplementary requirements andclarification of safety barrier strategies applicable to the BaltykIl and Baltyk III Wind project. In case of conflicting requirements, the requirements in this safety strategy shall prevail.The documentshall be used as specification for safety related aspects including detection and mitigation hazardous situations and events. This documentshall however notrestrict designers in developing the most optimized design. The safety strategy shall be updated by Company during the engineering phases. Contractors who perform design of the OSS shall contribute with input to the strategy document, addressing specifics related to their proposed concept. If solutions chosen proposed by Contractor conflicts with this document, Company shall be consulted.The safety strategy is structured according to the Companydefined barrier systems, with the objectiveto: ° Describe the need for and role of barriers that are established to manage risk related to major accidents. ° Visualize the connection betweenrisk and hazard evaluations specific to the offshore substation and the wind farm hazards ° Establish adequate understandingof the barriers in order to make correct decisions and understandtheir role. ° Form a basis which can be used as a managementtool to keep the integrity of the barriers intact during operation and modifications.The safety strategy is a lifecycle document and shall follow the installations into the operation as documentation of the safety barriers and for follow-up of the safety barriers. This safety strategy is established for the project phase intended to suite engineering and construction work.This document describes Company minimum requirements. However,if national authority requirementsare stricter these shall prevail.This safety strategy covers the offshore substation (structures, equipment and control of the OSS) and subsea installations within the scour protection area around thejacket.Target groupfor this document is the Company project organization, Companyoperations organization and project engineering, design Contractors and authorities. Furthermore, the document can be used as supporting documentation toThe offshore substation (OSS) will be normally unmanned andvisited for inspection and maintenanceactivities. The control of the substation and the wind farm will be from a permanently manned control room within the maintenance base located onshore. Emergencyoffshore shelter at OSS shall be designed for 12 persons onboard (PoB) during normal operation. During offshore hook-up and commissioning and planned maintenance operationsit should be possible to temporarily support up to 24 PoB whenbasedon the vessel spread used to support the installation and commissioning The OSS will be supported bya jacket structure and is envisaged to be comprised of a cellar/cable deck (lowerlevel), main deck, utility deck and a rooflevel.Safety strategy for offshore substations MFW BaltykIl & MFW Doc. No. C256-EQ-S-FD-00003 Battyk III Rev. no. 01All-year waverosefor Baltyk Il and Baltyk Ill are shownin Figure 5 and Figure 6 respectively.BaltykIll - All yearSafety strategy for offshoresubstations Doc. No. C256-EQ-S-FD-00003The current rose at surfacefor Baltyk Il and Baltyk IIl are shown in Figure 7 and Figure 8 respectively.Baltyk Il-O m-All year current speed(cm/s)Figure 7 - Current rose at surface at Baltyk IlBaltyk Ill - 0 m - All yearFigure 8 -Current rose at surface at BaltykIIISafety strategy for offshore substations MFW Battyk Il & MFW Doc. No. C256-EQ-S-FD-00003 BaitykIII Rev. no. 01Wet snow may accumulate on surfaces and vertical structures, e.g. communication mast. Atmospheric icing is possible. Estimatedice thickness (data for 50 yrs available) at 100 meters on cylinders and non-rotating structure elements is approx. 30 mm. Specific assessment atmospheric icing on OSSis not performed. Sea sprayicing is caused by freezing sea spray. Sea spray icing can be expected up to 25 meters above sea level and with the thickestice layer of up to 80 mm (100 yrs) between 5-10 meter. There will also be ice accumulation below 5m but not during extreme storm whenlarge waveswill transport heat to the lower region of the structure and theiceis exposed to thermal and mechanical deterioration. These values are equalfoBEST 1. Inherent safe design Elimination of hazard - designit out Substitution — use something less hazardousSea ice can occurat BaltykII & Ill and an average ice seasonis in range of 10-20 days while maximum duration is about 40 days. Expected frequency of occurrenceofice is 5 times per 50 years. The sea ice thicknessat 100 years return period is estimated in ref /C256-EQ-Z-CA-00001_02/ to be 0,37 m for Baltyk Il and 0,40m for Baltyk III.2.6 Third party activities nearby the developmentThere are fishing activities within both wind farms and along the route for the export powercables. Within the wind farms the type offishing gear used is bottom nets. There are also fishing vessels passing through the wind farmsasthere is an area for trawl fishing north of the wind farm areas.There are ship navigation routes both south of and north of the wind farms. AIS data show very low density ofship traffic in the vicinity of the wind farms as per today. When WTGsarepresentin the future and the sea maps are marked, the ship traffic is expected to be even lower. The OSSis located within the windfarm surrounded by the WTGs.Referenceis given to Appendix E of the Contract.3.1 Safety in design principlesIn general, systemsthat are easy to design, operate and maintain will be safer than more complex designs. This is also valid for design of safety systems. In priority it is recommended to develop our plant designsin the following order, ref Figure 9:Engineering controls — isolation and guardingAdministrative controls — training and work scheduling Design for operation with low complexity4. Personal Protective Equipment - last resortFigure 9 - Safety in design principles3.2 Risk tolerance criteriaPersonneland assetrisk shall meet the risk tolerancecriteria provided by s risk matrix shown in Figure 10. The consequence categories are described in Table 1. The interpretation of colours is described in Table 2.Figure 10 - a. Risk Tolerance Criteria, 9x8 matrix for activities with major accident potential outcome(internal9 reference R-105890, RM100)“ for offshore substations] Doc. No. C256-EQ-S-FD-00003Rev. no. 01 Valid from:Table 2 Interpretation of colours in design phase(internaloo reference R-11452, RM100)Safety strategy for offshore substationsbo Doc. No. C256-EQ-S-FD-00003 oo Rew. no.04Based on a perceived well known and controllable risk picture, these quantitative criteria may be assumed complied with by using the following minimum designcriteria:Safety strategy for offshore substationsf Doc. No. C256-EQ-S-FD-00003[ Rev. no. 01NORMAL FAULT, HAZARD AND CONSEQUENSES,OPERATION ACCIDENTSITUATIONS UNWANTEDEVENT LOSS, DAMAGEReduce probability offault, Identify conditions Reduce possibility of Limit possible hazard and accident that can lead to fault, hazard and consequence, damage situations fault, hazard and accident situations accident situations developing into unwanted eventFigure 11 - Barrier diagram indicating barrier functions (shown in red) to prevent unwanted events and consequencesCompany has,based on systematic review of different hazard and accident scenarios, intemal and extemal requirements, intemational standards and bestpractices, established company requirementsto barriers for O&Gfacilities classified as performance requirements and sorted by performance standards (PS). The company performance standards for O&G offshorefacilities are provided in TR1055. Relevant performance standard definitions are used in this safety strategy for the OSSin order to provide a comparable basis towards the standardized barrierdefinitions within the Company, see Table 3. The role and need for barriers accordingto this structure are provided in chapter 6.Table 3 Performance Standards (PS) for the offshore substation5.1 Ship collision and vesselloss of positionCollision may happen during vessel approachto transfer people via walk to work bridge, boat landing or for cargo handling. Reasonfor collision may be operatorfailure, failure of dynamic position system, vessel steering system or propulsion system, e.g. black-out of machinery.Safety strategy for offshore substationsMis Doc. No. C256-EQ-S-FD-00003|| Rev. no. 016 Offshore substation - Safety strategiesRole and Need Tor Gari [ReferenceThe containmentfunction shall prevent release of flammable fluids or harmfulfluids TR1803 Hoses and couplingsRelevant hazards Transformeroil leaks DNV-ST-0145 Offshore Diesel leaks (machinery, storage and bunkering system) substations - Rules and Hydraulic leaks (e.g. from crane and winch) standards Insulation gas (SF6) used on gasinsulated electrical equipmentAllpiping,tanks, valves, connections, pumps,rotating machinery, instruments and other components in systems handling flammable fluids and/or harmful fluids (chemicals, toxic gases, etc.) shall be designed, constructed, maintained and operated with the aim to avoid leaks to occur.Piping and other componentsshall be tagged and marked to identify fluids and prevent operational errors. (e.g. gas insulated equipment)Casingof oil filled transformers and shunt reactors shall be of robust design. Ref. PS12 for details on transformer safety system requirements.All components and systemsshall be designed to enable necessary inspection, testing and correction in compliance with established inspection program.Materials and connections used in piping systems shall as minimum meetthe requirements in DNV-ST-0145Diesel bunkering system. All hoses and connections (hose assemblies) shall comply with TR1803.Safety strategy for offshore substations MFW Battyk Il & MFW Doc. No. C256-EQ-S-FD-00003Battyk Ill Rev. no. 01 Valid from:6.2 Natural ventilation and HVAC (PS 2)=fl for offshoresubstations Doc. No. C256-EQ-S-FD-00003Rev. no. 01 Valid from:Safety strategy for offshore substationsPo Doc. No. C256-EQ-S-FD-00003Ls ev. no. 06.4 Emergency Shutdownsystem (PS 4)Safety strategy for offshore substationsti‘“i‘~S@S Doc. No. C256-EQ-S-FD-00003 Rev. no. 01Safety strategy for offshore substationsiP Doc. No. C256-EQ-S-FD-00003 Rev. no. 01Safety strategy for offshore substations[ Doc. No. C256-EQ-S-FD-000036.5 OpenDrain system (PS 5)Safety strategy for offshoresubstations Doc. No. C256-EQ-S-FD-00003Safety strategy for offshoresubstations Doc. No. C256-EQ-S-FD-000036.6 Ignition source control (PS 6)Rev. no. 01 Valid from:- Release of flammable dieseloil mistinside diesel engine generator skid exposing hot surfacesBattery rooms: Battery type shall be VRLA orothersimilar low hydrogen emission type. Boost charging of batteries shall not be used. The HVACextractfans from battery roomsshall be certified for operation in zone 2. For further control of risk of hydrogen accumulation,it is referred to requirements to battery rooms in PS 2HVACand PS 3 Leak Detection.Barriers to detect and shutdownelectrical equipment and transformers uponelectrical faults are described in PS 12 Process safety. Natural ventilation is preferred to minimize potential gas clouds, ref. PS 2 HVACHot surfacesinside generator skids that can potentially be exposed to dieseloil leaks shall be thermally insulated , e.g. internal exhaust ducting and turbochargRole an Nood for BareAreas requiring fire detectionFire detectors shall be provided in all areas where fires may occur and where ingress of smoke is to be prevented.Fire detector arrangementsshould be implemented in accordancewith the following:Oil filled Transformer area and areaswith Flame Be flammableliquids/ gases ame, heat or Detector selection dependentuponfire smoke characteristics Instrumentrooms, Control room,LV electrical High sensitive type for early warning and rooms (rooms containing panels, cubicles, manual shutdown. distribution boards) Standard smokedetectors for automaticHV Electrical rooms moke and/or gh energyfiresgasfor fire suppression system) flame in addition to high sensitive type. Flame detectors to be evaluated for detection of HV arcSPe em heat materialsManualcall points shall be located strategically, and in locations such as e Along escape ways e Embarkation areas, such as SOV/CTV landing area,etc.RecommendedPractice forFire Protection forElectric Generating Plants and High Voltage Direct Current Converter StationsDoc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:The following active fire protection strategies are envisaged, but shall be further assessed and developed based onrisk assessment:Role and Need for BarrierSafety strategy for offshore substationsti‘“‘i‘C Doc. No. C256-EQ-S-FD-00003Safety strategy for offshore substations Valid from:Role and Need for Barier Reference e F&Gsensorloopincluding accessories (e.g. air supply branch-off and powerfuses) shall be separate from other functions, directly connected to F&G system unit. e F&G final element shall be operated directly from F&G system unit unless actions are executed through the ESD system.Possible use of common SASdata network and operator stations are addressed in automation discipline requirements. Same reference will apply to siqnalex hnangec between aiierentsalety svstems.6.8 Active Fire Protection (PS 9)Role and Need for BarierThe main purposeofthe firefighting systemsis to provide quick and reliable meansforfirefighting in addition to cooling of equipment and structures.Relevant hazards e Fires inoilfilled transformers e Dieselfires (e.g. related to diesel storage or auxiliary generator) e Electrical firesOffshore substations -Rules and standardsActive fire protection strategyFixed fire-fighting systems shall be installed in areas representing a fire risk, and particularly for equipment containing significant quantities of hydrocarbonsor other flammable materials. The fire protection strategies shall take into consideration that manual intervention normallyis notavailable at the unmanned substation. Asset protection shall hence be part of the considerations.Area /room Active fire protection Oil filled transformers Fixed expanding foam systemDiesel engine Water mist room/enclosure Electrical rooms, / Inert gas suppression systaTI instrument rooms (e.g. Argonite, inergen etc.)Comment In combination with certified fire protection grating solution within bunding around transformers(ref. PS 10). Foam system extinguish and prevent pool fire on top of the fire protection grating. The qualities of the grating prevent fire within the bound underneath the grating. In combination with remote operated or automatic isolation valve on diesel fuel line Fixed CO2 extinguishing systems shall not be used.The active fire protection systems shall have possibility of remote (onshore) and local activation. For automatically initiated systems, a manual release station shall be provided and conveniently located outside the area.The inert gas suppression system shall be one central system with valve-<:ontrolled distribution system to direct the suppression gas to the intended room. The inert gas system shall have 2x100% capacity to provide back-up coverage e.g. l the system is unintentionally released.IEEE 979 - Guide for Substation Fire ProtectionNFPA 11 Standard for Low, Medium, and High-Expansion Foam, Chapter 7 Compressed Air Foam SystemsNFPA 750 Standard on Water Mist Fire Protection SystemsNFPA 2001 Standard for Clean Agent Fire Extinguishing SystemsRefer to Appendix A in this document for specifications for active fire protection systems.Manual fire fighting Fire extinguishers shall be provided in line with the fire assessment of the rooms and areas. The location shall be clearly identified with photo-luminescent sig nag e in addition to all statutory signage.Any outdoor fire extinguisher and emergency equipment shall be located in a cabinet.Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:actual structural design and utilization can be compared with the solutions described in GL0644. In most cases coat back can be avoided and it is not expected that the coat back distance in any case needs to be more than 150 mm.Cables for emergency services/sa'ety services required to be operable under fire conditions shall be of a fire-resistant type, especially when they pass through high fire risk areas other than those which they serve. All other cables shall be minimum flame retardant as per IEC 60332.Containment around oil filled transformers shall be provided with certified passive fire-protecting grating (restricting air to the burning liquids and quenching of fire) to minimize risk of long-lasting pool fire, ref. PS 5.Safety strategy for offshore substation Doc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Safety strategy for offshore subs tationsDoc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Radio system shall also provide marine communication to allow for co-ordination of active fire protection, response to marine pollution and emergency assistance.Equipment for communication shall be powered from dedicated battery supplies and/ or powered from the facility's UPS system.Safety strategy for offshore substationsDoc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Safety strategy for offshore subs tationsDoc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Role and Need for Barrier ReferenceThere shall be at least two exits to escape routes from areas that are permanently or intermittently manned during inspection or maintenance visits, lead ing in different escape drections and situated as far apart from each other as possible. Internal room arrangement shall be considered for possible blocking of exits follcming an accidentLayout shall accommodate that escape from one area to another area with higher risk level is not required. Escape from a HV room may be through another HV room of same or lcmer risk level.All doors shall be constructed so that one person can easily open them from either side. They shall open in the direction of escape without blocking the outside escape route and be self-closing. This requirement should consider the effect of wind (1-year condition).If analysis shows that a door can be used from both directions during escape/evacuation, e.g. due to tV1.0 separate incidents, a sliding door should be used. Doors that are normally locked can be accepted with opening in either direction in such cases.Corridors and dead ends shall not exceed 7 meters unless provided with at least tV1.0 exits, one at each endSurvivability of escape routes Escape routes outside the area for the initial event shall be designed and protected so that at least one route of escape is available for the required period of time during a dirnensionng accidental event.Personnel shall be ab le to use the escape routes without being exposed to excessive toxic fumes, smoke nor unacceptable heat loads, hot liquids or falling objects.Signs and markings A sufficient number of safety signs and markings shall be provided to convey necessary information to guide personnel in emergency situations and give clear information regarding directionsAocations of various functions, areas and exits.Safety strategy for offshore substa tions Doc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Doc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Safety strategy for offshore substations Doc. No. C256-EQ-S-FD-00003 Rev. no.01 Valid from:Date/Signature: Date/Signature: Responsible (Organisation unit/ Name): WencheKristin Rettedal/Offshore Substation Structural Lead Date/Signature: Recommended (Organisation unit/ Name): Jens Olav Rundsag/Engineering Manager Vigdis Iren Birkedal/SSU Manager Date/Signature: Approved by (Organisation unit/ Name): Lars G. Trodal/Facilities Manager Meindert Jan van der Velde/Project Manager OperationSubjects: Context, Hazards, Safety in design, Barrier functions, Performance standards, safety strategies Updated: Valid from: 18/03/2022 Responsible publisher: Authority to approve deviations:Classification: fem Distribution: fem Status peim Expiry date: peimSafety strategy for offshore substations MFW BattykII & MFW BattykIII Contract no.: Document no: C256-EQ-S-FD-00003 Project: MFWBattykII & MFW BattykIIIProbabilty catego! —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ —1___2_}_a__|_s_{s/e7s_ <0.0019 <10-5/yr .001-0.019 0°-10%/ 1-0.19 0*.10°%, 1-19 0°-107/ 25% 25- 50% ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaa ieeeeaeaeaaea Mitigation and sharing of risk Single red risk is generally intolerable and far beyond the Group'srisk tolerance criteria. Mitigating actions mustbe implemented as soonaspossible. Single orange risk is generally intolerable, and mitigating actions mustbe implemented. YELLOW Mitigating actions shall be identified based on the ALARP (As LowAs Reasonably Practicable) BAT (Best Available Technology) principle or other applicable principles subject to relevantjurisdiction(s). Risks in the green zone are generally tolerable and actions are normally notrequired. GREEN|#[BaresBaris |#[BaresBaris |#[BaresBaris |#[BaresBaris [PS2_[NatualventiationandPSt4_|Rescue Alarm and Communication System for usein Emergency Situations [PS2_[NatualventiationandPSt4_|Rescue [PS2_[NatualventiationandPSt4_|Rescue fPStContainmentPSS [PS2_[NatualventiationandPSt4_|Rescue [PS2_[NatualventiationandPSt4_|Rescue fPStContainmentPSS [PS2_[NatualventiationandPSt4_|Rescue fPStContainmentPSS [PS2_[NatualventiationandPSt4_|Rescue [PS2_[NatualventiationandPSt4_|Rescue [PS3_|Leakdetections&PS15,_| [PS3_|Leakdetections&PS15,_| [PS3_|Leakdetections&PS15,_| Layout Design Principles and Explosion Barriers lps4 Emergency Shut Down (ESD PS16A Offshore cranes |PS5_|Opendrain——C~C~CSC*diCRSBINA |PS5_|Opendrain——C~C~CSC*diCRSBINA |PS5_|Opendrain——C~C~CSC*diCRSBINA |PS5_|Opendrain——C~C~CSC*diCRSBINA [PS6__|sourcecontroalPSITA[NA [PS6__|sourcecontroalPSITA[NA [PS6__|sourcecontroalPSITA[NA [PS6__|sourcecontroalPSITA[NA [PS7__|FireDetectionFSPSI7BINA [PS7__|FireDetectionFSPSI7BINA [PS7__|FireDetectionFSPSI7BINA [PS7__|FireDetectionFSPSI7BINA psp[WAstsINA psp[WAstsINA psp[WAstsINA psp[WAstsINA [PS9ProtectionPS19_|ofvesselcolisions [PS9ProtectionPS19_|ofvesselcolisions ActiveFire [PS9ProtectionPS19_|ofvesselcolisions [PS9ProtectionPS19_|ofvesselcolisions [es20[sinetualteat [es20[sinetualteat Passive Fire Protection |PS11_|Powerand Lightning |PS11_|Powerand PS22_|Interface PS22_|Interface [Psi2sdS23system [Psi2sdS23system [Psi2sdS23system [Psi2sdS23system18.20 Ship collision with Service Operation Vessel (SOV), Crew Transfer Vessel (CTV), fishing vessel or merchantvessel - - angway impactto critical equipment/structures or personnel 15,19 gas and oil mist personnel 14.15 exposure to personnel 14,15 Fire in hydrocarbon systems (Hydraulic Oils, diesel engine, etc.). Heat or toxic smoke exposure to personnel 5, 7, 10, 12,15 YT Oxygendeprivation / asphyxia and greenhouse gasrelease due to leaks of SF6 from gas-insulated ° d gas-insulated busbars (GIB), e.g inert gas for fire suppression YT Handling / exposure to SF6 decomposition products after internal arc fault. rm /10_| i411 |Manoverboard |Manoverboard 12 ofcontainment/spillstoenvironment ofcontainment/spillstoenvironment 143 14 [2 (15 |Securityincidents23 |Securityincidents23 16 |Globalstructuralfailure |Globalstructuralfailure 7 Personnelinjury due to electric shock [14 Personnelinjury due to material handling 18 15 D jano Q (19Role and Need for Barrier DNV-ST-0145 Offshore substations Natural ventilation shall: e Dilute gas concentrations and reduce the size of flammable gas clouds e Dilute harmful concentrations of smoke or toxic gases e Ensure acceptable working and equipment environment HVAC shall, with respect to accidental events: e Provide smokeventilation for internal fire conditions if active smoke ventilation philosophy is chosento facilitate safe escape from manned areas e Ensure acceptable equp ment environment e Dilute and remove concentrations of flammable or toxic gas Relevant hazards Smoke generation from fire in diesel engine or transformer area exposing HVACinlets to spaces with safety critical functions Electrical fires within electrical rooms creating toxic atmosphere Hydrogen gas accumulation in battery rooms resulting in explosive atmosphere Flammable gas accumulation / oil mist in transformerarea in the event of internal arch fault and gas leakage from transformer casing Requirements:Hosereel station: The hose shall be equipped with quick release auto close connection on the CTV end. The diesel bunkering system shall have integrity towards the maximum shut-in pressure of the pump at CTV/SOV. Diesel lines between bunded areas of hose reel station and diesel storage tanks shall be weldedTheleak detection system shall continuously monitor for the presence of flammableor toxic gases,to alert personnel and allow control actions to be initiated manually or automatically to minimize the probability of explosion,fire and acute effects of personnel exposure.Role and Nood Tor Bare Transformer area Natural ventilation is the preferred solution for the transformer areas. Battery rooms: Battery roomsshall be provided with sufficient ventilation to maintain non-hazardous status, forced or natural, according to DNV-ST-0145. Ventilation inlets and outlets Ventilation air inlets serving shelter area and emergency equipment roomsshall be located such that they are minimally affected by smoke from on-board incidents. Measuresshall be taken to avoid accumulation of ice and snow. Dampers Dampers shall provide quick, reliable and effective means to prevent ingress or spreading of gas or smoke. If smoke is detected at ventilation air inlets, the ventilation fan in question shall be stopped andall inlet and outlet dampers closed. Dampers and fansshall be interlocked to avoid abnormalpressure configurations Fire dampers shall be closed automatically by signal from the F&G-system orby “fusible link” where specified.Role and Nood for Bare DNV-ST-0145 Offshore substations The purposeof the emergency shutdown system (ESD)is to prevent escalation of abnormal conditions into a major hazardousevent and to limit the extent and duration of any such events that do occur. In addition, ESD initiations will activate (direct or indirect) other safety systems/functions such as HVAC (PS 2), Emergency powerand lighting (PS 11), Alarm and communication system for use in emergencysituations (PS 13). Relevant hazards - Abnormal condition on ONS, OSS or a WTG not detected and controlled by the Protection & Control system, e.g. high hydrogen concentration, smoke or flame detection, ship collision/ship on collision course etc. Abnormal condition / loss of communication situation requiring local manual shutdown at ONS, OSS or WTGto ensure safety of personnel, environment or asset. Requirements: A shutdownsystem, with logic solvers independentfrom the Protection & Control system, shall be available to perform necessary actions to protect personnel, environment and assets (ONS, OSS and WTGs)from abnormal conditions. A separate Emergency Shutdown System maybe omitted if shutdownactions are included in the F&G logic solver. The shutdownactions maybe initiated manually and automatically. Onceinitiated, actions shal be automatically executed. The shutdown functions shall be arranged in a tree-structured level hierarchy, reflecting different levels of facility or wind farm shutdown.The higherlevels in the hierarchy shall initiate lower levels. A signal on a certain level shall notinitiate actions on higher ESD levels. Shutdown levels for the OSS shall include: - Total substation shutdown (A and B system), including UPS battery trip - Total substation shutdown (A and B systemRole and Nood for Bari - System shutdown (e.g. A or B system) - Equipment shutdown A total shutdown canberequired in case of catastrophic criticality of an incident, e.g. - HV transformer explosion situations - Ship collision / ship on collision course A system shutdown(e.g. of the A electrical production system) of the ONS or OSS maynot haveto affect all the other operations (e.g. the B electrical production system). Equipmentshutdown is individual stop of a componentor subsystem.This is typically local emergency stop buttons andlocal protection schemesfor rotating machinery and mechanical equipment, such as HVACrefrigeration systems and diesel transfer systems. Where relevant, remote equipment emergency shutdownshall be available through ESI SCADAand be available in ESD HMI. A CAPpanel with “Total shutdown” and “System A” and “System B” shutdown included as minimum shall be located in a strategic location on the OSS. Cascading effects shall be avoided. This implies that in some situations, a larger part of the facility or wind farm than directly affected by the incidentin the first stage should be shut down Depending on the shutdown levels attributed to particular accidental event, ESD actions or their combinations shall include Shutdown of HV equipment Stop of auxiliary generator Prevent start-up of equipment as required during an emergency situation, e.g. inhibiting the start-up of auxiliary generators during the shutdown of HV system Opening of UPS battery breaker Disconnection of the substation from the grid Start-up of auxiliary supply, load transfer of emergency servicesfrom transitional / emergency source of power Activation of diesel shut-off valvesRole and Neod for Bare Shutdown of powerventilation Stopbattery charging Closure of doors and ventilation openings - Initiation of audible siren signal Any shutdown, spurious or intended, shall require a manual reset from onshore control room after normalization and systems have been confirmed OKto restart (e.g. by system status reporting / CCTV). ESD alam annunciation Shutdown status shall continuously be available in the control room, and the system shall raise alarms in the control room for operator awarenessor actions, considering: - Level of shutdown initiated - Shutdown function failure to execute actions upon demand - Shutdown function (sensor, logic solveror final element) defector failure Personnelshall be warned to ensure safe escape and evacuation, ref. PS13. Upon shutdown (automatic or manual), general alarm shall be automaticaly initiated. AnESDalam shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon ESDalarm. Logic solver The logic solver including I/O, logic and communication interfaces, shall comply with prevailing reg ulations and practices for normal operation, test and emergencysituations. The logic solver compliance with the intended use and safety integrity requirements shall be demonstrated, i-e.: - Logic solver(firmware, as standard manufacturer provision) compliance with IEC 61508/ IEC 61511 shall be documented and certified / type approved (note: also valid for system software revisions). Use of existing non-certified equipment may be accepted subject to particular safety assessmentand“prior use” characteristics.Role an Nood TorBae The purposeof the open drain system is to provide measures for containment and proper disposal of flammable or environmentally hazardous liquid spills, as well as handling wash-down, rainwater andfire water. The open drain system consists of equipment such as drip trays and bunding, drain pots and liquid seals, piping and pumping arrangement, collection and treatment tanks necessary to collect and handk spillage of hydrocarbonliquids, wash down water,fire water and rainwater. Relevant hazards: Releasewith potential damage to environmentor prolonged fire from: e Transformers and shunt reactors with mineraloil e Coolers containing mineraloil e Diesel leaks (machinery, storage and bunkering system) e Hydraulic leaks (e.g. from crane and winch) RequirementsRole an Nood Tor Bare - Logic solver (hardware and software, according to user requirements) arrangement and application configuration shall be subject to acceptance based on independent verifications. System safety manual shall provide guidance to applications and application program development ESDsystem units (logic solver) shall not be used for non-safety related systems. Logic solver shall include measures that prohbit unauthorized and avoid unintentional changesof system parameters, i.e. key-lock, password or software configuration.Role and Nood Tor Bare Open drain systems shal be provided to contain and collect spils and leaksin all areas that have a sourceof flammable or environmentally hazardous liquid so as to minimize therisk of fires and personnel exposure to hazardous materials and avoid damageto the environment. Tanks and vessels containing flammable or environmental hazardousliquids shall have a bunding covering the tank perimeter to control the spread of spills. There shall be adequate drainage within the bunding. Guidance Dedicated bunding per tank or vessel may be exempted if part of a larger containmentarea provided with fire protection grating (restricting air to buming liquids and extinguishfire) and containment basin. End of guidance Open drain systems shal be designed with adequate slope to control spills Cooler areas Open drain from the external cooler areas shall be connected to the oily water packageincluding tank. Transformer areas: Leak containmentcriteria: The transformerareas shall be provided withfire protection grating and containment basins with minimum combined capacity for the largest transformeroil inventory in the area + firewater/foam liquid volumes +10%. The containment basins shall be provided with overflow to sea, such that rainwater can be discharged in all conditions. There shall be meansof continuous measuring of hydrocarbon contentin the liquid to stop unwanted release to sea. National / local requirements to the system shall be observed and adhered to. The drain system needsto consider operability in cold climate. The overflow system shall: e control the liquid level in the containment basins such that the leak containment criteria is met. e bedesigned such thatliquid is removed froma lower section with continuous water phaseof the containment basins e have sufficient capacity to handle the heaviest rainfall of 1-hour duration overa 10-year recurrence period.Role an Nood Tor Bare DNV-ST-0145 Offshore substations - Rules and standards The ignition probability of flammable liquids and explosive gas atmospheresshall be minimized by rendering the sources of ignition harmless or reducingthelikelihood ofoccurrence ofeffective ignition sources. Relevant hazards: - Hydrogen gas accumulationin battery rooms resulting in explosive atmosphere - Electrical fault in transformers or shunt reactors resulting in arc flash and flammable gas and oil mist released to atmosphereRole and Need for Barrier Auxiliary diesel engine skid The auxiliary diesel engine skid and storage shall preferably be self-contained with capacity for the maximum potential diesel leak inventory, or alternatively be connected to open drain system on theinstallation. Hosereel station The hosereel station is envisaged to bein infrequent use and located at low levelon the installation. Diesel bunkering will be a manned operation. The hose reel station shall be provided with bunding with capacity to minimum contain possible flow back diesel inventory in piping or hoses and credible pressurized leak before SOV/CTV supply pump is stopped. In case of a diesel leakage, removing the diesel from the bundingwill be an operation requiring temporary pumpandsuitable tote tank to pump thedieselto. Segregation betweenareas The containment basins for TransformerA and B area shall be separated according to thefire division betweenthe areas. The open drain system shall provide effective means, e.g., liquid seals if relevant, to preventliquids, vap ors and gasesto spreadto otherfire areas via the drain system The drain system, such as drain box and piping, shall not impair the integrity of fire partitions.Role an Nood Tor Bare Thefire detection system shall continuously monitor for the presence ofa fire to alert personnel and allow control actionsto be initiated manually or automatically to minimize the likelihood of fire escalation and probability of personnel exposure. Thefire detection system shall, relevant to specific equipment and areas, monitor continuously for the presence of an incipient fire condition to alert personnel and allow control actionsto beinitiated manually to minimize the probability of a fire condition to develop. Relevant hazards: e Electrical fires (e.g. in electrical rooms) e Fires in oil filled transformers (mineraloil) EN 54 all parts DNV-ST-0145 Offshore substations - Rules and standards IEC 61508 Functional safety ofRole and Nood for Bare electrical/electronic/progr ammableelectronic safety-related systems -The Part 1: General requirements e Diesel fires (Auxiliary diesel engine, diesel storage & supply) Requirements: fire detection function shall provide reliable and fast detection of a fire by adequate type, numberandlocation of fire detectors and shall ensure timely alarm and initiation of control actions. Sufficient fire detection redundancy shall be implemented to ensurethat thefire detection will be maintained if defect fire detectors are not repaired or changed immediately. Possibility for manual reset from onshore control room after normalization and systems have been confirmed OKto restart (e.g. by system status reporting / CCTV), to disable detectors etc. Detectors shall be provided based on an assessmentoffire scenarios within each area considering potential fire sources and characteristics, consequences,area and equipment arrangement and environmental conditions. Design premisesfor determination offire detection coverage shall ap ply flame size, smoke characteristics and temperature (heat)rise, established for eacharea, as basis (sensor numberanddistribution). The basis and assumptions used for detector selection and location shall be documented. Smokedispersion studies may be performed forverification and optimization of location of detectors. The location of smoke detectors shall be confirmed by smoke dispersion tests for actual conditions inside rooms with and withoutventilation A mix of standard and high-sensitive smoke detectors shall be given preferencefor use as general detection in rooms containing P&C panels, automation/instrument/telecom panels and low voltage distribution boards and switchgears. Access to perform maintenance of detectors shall be planned for and documented.It shall be able to test detectors from deck level, test equipmentshall be included aspart of special tools.Role and Neod for Bare e Atdoor(inside) for every exit to outside deck The maximum walking distance between two Manual Call Points outdoor shall not exceed 30 meters. ManualCall points shall be protected against inadvertent activation and easily recognized by signs and color coding. Fire detector characteristics and calibration Fire detectors shall be self-monitoring. Detector safety characteristics should be optimized through preferences and adoption of best available technology including provisions of sef-diagnostic. detectors shall comply with actualfire potential and envronmentconditions within the relevant area, e.g-: e IR orUV where flame is predominating and according to flame waveradiation characteristic e Sensor range and coneofvision. Based ona typical flame detector characteristic, the distance between flame detectors and targets monitored shall be in accordance with current technology e Sensor direction and angle e Sensitivity to extemal impact such as arc welding point (electrical) characteristics shall comply with actualfire potential and environmental conditions within the relevant area, e.g.: e Normally limited use,ie. specific high-risk areas and where otherdetection principles are not suitable. e Maximum coveragein naturally ventilated area approximate 24 m?, maximum distance between sensors 7 m and maximum distancefrom wall 4.5m and minimum 0.5 meters away from outside wall or dividing partition. e Maximum coveragein mechanically ventilated area approximate 37 m?, maximum distance between sensors 9 m and maximum distance from wall 4.5 m. detectorscharacteristics shall comply with actual fire potential and environmental conditions within the relevant area,e.g.: e Optical detectors used for smoldering fires. e Detectors, e.g., ionic type, suitable for energy intensive smoke generatingfires, e.g., fire in high voltage switchgear caus ed by short circuit. e Smoke detectors mounted in areas such as suspended ceilings and raised floors shall have their location indicated byvisible tag-plate. e Early warning sensorspecified with higher sensitivity than norm recommendation.Role and Neod for Bare e Maximum distance between sensors 11 meters, maximum distance from sensor to bulkhead 5.5 meters and minimum 0.5 meters away from outsidewall or dividing partition. Fire detection actions Automaticinitiation of actions shall include ESD (confirmed fire) HVACandfire damper shutdown, exceptfor areas subject to smoke control (confirmed fire) Activation of Fire Fighting Equipment (confirmed fire) Generalinstallation alarm (confirmed fire) MCP activation shall initiate alarm in central control room. Central control room to verify and initiate further actions and alarm oninstallation as required Guidance Early smoke detection may be subject to manualinitiation of actionsonly. End of guidance A fire alarm shall be presented in CCR on an OSS layout to easily identify location. Confirmed fire shall be based on voting between two or morefire detectors in alarm. Voting shall includeall fire detectors within a defined area (any type of detectors) and exposed to the same fire scenario. The voting logic shall be arranged such that confirmed fire can be achieved with faulty detectors, and also including inhibited det ectors unless safe detector inhibitis achieved by established operating procedures. The following voting principles should apply (for automatic actions only): Smoke (except areas such as accommodationoroffices with manual intervention): e 2ooNdetectors to reach specified alarm limit when N2 3 Note: Smoke detectors arelesslikely to be used togetherwith other typesoffire detectors, and applications that require voting are not common. Smoke detectors covering enclosures and HVACinlets shall not be voted together with otherfire detectors in the samearea.e 1ooNdetectors to reach specified alarm limit when N 2 2. 100N voting with highly reliable heat detectors to be approved by Company Fire detection alarms Detection of fire, failure to execute actions upon demand and system defects shall be presented as alarmsin Central Control Room (see also PS 22). F&G system status shall be continuously available in CCR, and the system shall raise alarms in CCR for operator awarenessoraction, considering: e Detection of fire or activation of Manual Call Point e Failure to execute action upon demand e Function (sensor,logic solver, final element) defect or failure. Status/alarm parameters for each individualfire detector shall be identifiable in the CCR. An F&G alarm condition shall be alerted in other strategic locations, i.e. the onshore control room shall alert SOV/CTV upon F&Galarm. CCTV coverage CCTV camerasshall be installed in order to help the control room operators evaluate appropriate actions following an alarm event on the unmanned substation. Evaluation shall be performed to identify relevant locations, but CCTV cameras shall as minimum beinstalled with sufficient coverage of transformer containment area and high voltage switchgear / GIS areas Independence The F&Gsafety related functions shall fulfil their intended role independently of other control - and safety related control systems, Prerequisites to fulfil the independence requirementsare: Logic solver(fimware, as standard manufacturerprovision) shall be certified / type approved to relevant standard (i.e. IEC 61508). Use of existing non-certified equipment may be accepted subject to particular safety assessment and “prior use” characteristics. F&G safety related functions shall be realized in addition to and independentof installation basic control systems. F&G system units (logic solver) shall not be used for non-safety related systems.Role and Need for Barrier Reference DNV-ST-0145 Offshore substations IEC 60332 Test on electrical cables under fire condlions GL0644 Guideline Coat back on Steel Structure Passive fire protection (PFP) shall ensure that relevant structures and equipment components have adequate fire resistance with regard to load bearing properties, integrity and insulation properties during a dimensioning fire, and contribute in reducing the consequences in general. Relevant hazards: • Escalation of fire between equipment (e.g. between adjacent transformers in one area) • Escalation of fire between rooms or areas (e.g. from transformer A to transformer area B or adjacent electrical rooms) • Escalation of fire to sa'ety critical elements before the equipment has performed its intended duty in a fire scenario (e.g. UPS or control systems, muster area) Requirements: All rooms shall have bulkheads with rating A-0 or stricter, acoording to DNV-ST-0145. Bulkheads between Transformer A and B areas and between transformer areas and adjacent spaces shall be H-rated. The fire divisions shall be capable of resisting dimensioning fire and explosion loads. Penetrations, e.g. for ventilation duds, piping, cables, beams as well as doors in fire divisions, shall not reduce the fire and explosion integrity of the divisions . Doors in fire divisions shall be of a self-<:losing type. Load bearing structures/ important elements shall have adequate fire protection to prevent unacceptable deformations or collapse during a dimensioning fire. Ho wever, contractor shall strive to reduce fire insulation to a minimum. Need for fire insulation of structure, piping etc. shall be assessed and justified. Coat back of attachments to main structures: If the contact area including the cross-sectional area inside hollcm sections of an unprotected structural element is equal or larger than 1000 mm 2 per square meter of fireproofed structural elements, the need for coat back must be evaluated. To do this, theRole and Need for Barrier Reference DNV-GL-ST0145 Offshore substations EN 1838:2013, Lig hting applications - Emergency lighting C256-EQ-Z-SP-00009 offshore Substation (OSS) The purpose of the Emergency Power and Lighting is to provide the following: Electrical power when main power generation or supply is being shut down. Emergency electrical power supply for a specific period of time for systems required to be in operation during or after a major hazard incident. Sufficient lighting for evacuation and escape in an emergency situation. Requirements Emergency power supply Two redundant and independent UPS systems with three (3) hours capacity each (2x100%) serving both emergency and non-emergency consumers shall be provided. Each emergency consumer is fed from each of the two UPS systems with local change over to ensure ava ilability of the emergency services for minimum three (3) hours.Role and Need for Barrier Reference Topside Technical Specification The available UPS capacity shall, at any time when needed, ensure that sa'ety systems will be kept operational during periods of accidental events, evacuation and escape. Emergency consumers to be supplied by the UPS shall include: • Emergency and escape lighting • Active fire protection (when firefighting equipment is dependent on emergency source of electrical power) • Control and communication systems required in an abnormal situation (incl. HV P&C) • Alarm systems • HV AC systems required to prevent overheating of rooms with sa'ety critical or essential functions. Consumers supplied from the UPS shall also enable personnel to perform corrective actions to restore main power, this includes but not limited to: • Sufficient lighting at key areas • Strategically located sockets Separate UPS system(s) with 96-hour capacity shal be provided for: • navigation lights • aviation warning lights • structure marking Shut down of ventilation shall not cause temperatures above vulnerable components' tolerance within the required operating time of the relevant installation safety systems. Minimum required operating time in this scenario is 30 minutes, to ensure availability of safety critical functions until escape and evacuation is completed. Guidance: Room temperature may exceed the maximum allowed continuous ambient temperature for a short section at the end of the period, provided that lifetime consequence is evaluated and found acce12tabl�e=·�------------------------------------Role and Need for Barrier Reference End guidance. The emergency power system shall be monitored and raise critical status alarms in Control r0001. Emergency lighting: Emergency and escape lighting shall be provided in order to allow escape during emergency situations and provide sufficient I ighting in areas which are manned during such events. This includes Escape routes, muster areas, SOV/CTV access gates, escape chute areas, helicopterwinch area, sea illumination of boat landing and escape-to-sea systems The emergency lighting shall be minimum 30% of the normal lighting level and ensure sufficient illumination for safe work in areas required to be manned during emergency situations. Escape lighting levels shall be minimum 15 lux at high risk task areas and evacuation stations and 1 lux on escape routes. Emergency exit signs shall either have an illuminated or fluorescent type of design . Survivability requirements UPS shall be located in protected area Cables to emerg ency consumers shall be fire resistant Emergency light fixtures without internal batteries, shall be arranged in A and B system, each supplied from separate redundant power sources.Role and Need for Barrier Reference Process safety means of protection, incorporating electrical and mechanical protection devices and safety instrumented functions, shall ensure that the process conditions do not exceed specified process safety limits. The main process for wind farms is understood as generation and transmission of electrical energy. The aim is to control any abnormal process operating condiions to prevent and/or minimize possible accidental events or releases. Typical actions, by means of protection devices include: • Process shutdown by tripping of Circuit Breakers(CBs) • Pressure relief The extent of a shutdown situation will depend on type of abnormality and may vary from shutdown of process sections with minimum effect on the production, to a total shutdcmn. Relevant hazards • Electrical faults resulting in short circuits/ arcing events and subsequent fire or explosion scenarios Requirements: Electrical faults are detected and cleared by protection relays without operator intervention. A SCAD A system will be installed for monitoring and control of the wind farm plant. If abnormal condition is detected in the electrical systems, the operator in onshore central control room shall evaluate and consider appropriate act ions. There will also be automatic acti:> ns based on p redefned levelsAimits. The contro l room shall be manned 24/7. High system reliability shall be ensured by: - Autonomous protection relays will clear any electrical fault in the system .Reference Role and Need for Barrier GA, Alarm and communication systems for use in emergency sluations shall: • Alert and inform personnel as quickly as possible in the event of a hazardous or emergency situation • Provide two-way communication of information regarding em erg ency events to the Control Room • Allow the co-ordination of rescue, recovery and emergency assistance .Role and Need for Barrier Reference - Primary protection relays are backed up by seoondary back up relays if fault is not cleared by primary. Redundant protection relays are as minimum provided for main HV eq uipment and cables (e.g. transformers and export cables). - Relays from different vendors/models All relays onshore and offshore shall be communicating on redundant fiber networks (IEC61850). Transformer and shunt reactor safety (electrical oil fi/led equipment) Each oil filled transformer shall be protected by redundant protection systems aimed to detect internal failures and quench an internal arc by the feeding circuit breaker. As minimum the following shall be provided as part of the short circuit protection: - Buchholz Relay (not redundant detection but redundant tripping) - Differential protection relay Earth Fault protection The Transformers shall be eq upped with a Pressure Release Valve (PRV) to protect the transformer tank in scenarios with gradual pressure build-up and low-energy arching faults (as result of fire exposure, oil filling operation or other maintenance operations or transformer malfunction scenarios). PRV shall be equipped with an external duct to guide the ruptured oil dcmn below the deck grating instead of spreading to the surroundings. The PRV shall be designed to not limit the free flow of oil in any way.Role and Need for Barrier Reference SOLAS Chapter Ill - Life Saving Appliances and arrangements I DNV-ST-0145 Of fshore Substations CAP 437 Standards for offshore helioopter landing areas ISO 3864 Graphical symbols -Safety colors and safetysigns Escape and evacuation route and exits In the case of a hazardous incident, the purpose of escape and evacuation routes is to: • Ensure that personnel can leave the area(s) in question by at least one safe route • Enable personnel to sa'ely reach the assigned mustering area from any position on the installation they are likely to occupy (and hence the designated embarkation area). • Enable rescue/medical teams to safely bring injured personnel to areas where medical treatment can be given Temporary refuges and embarkation areas (Muster area) The purpose of refuges embarkation(mustering) areas is to. • Provide sa'e refuge on the installation as long as required for a controlled evacuation to be carried out. • Ensure easy, fast and safe entering of the evacuation systems in question Evacuation systems The purpose of the evacuation system(s) is to ensure safe means of evacuating the maximum POB. Rescue and safety equipment The purpose of rescue and safety equipment is to: • Provide personnel with necessary equipment to ensure safe EERRole and Need for Barrier Reference ISO 7010 Graphical symb ols - Safety colors and safety signs -Registered safety signs C256-EQ-Z-SP-00009 Offshore Substation (OSS) Topside Technical Specification • Ensure that injured personnel are given adequate first aid treatment and a professional follow up, thus minimizing the effects from possible injuries Requirements Escape and evacuation routes and exits Escape routes and muster area shall be provided enabling all personnel to safely leave the affected area(s) in case of a hazardous incident A minimum of two independent escape routes leading from any area to muster area shall be provided. The muster area(s) shall be positioned in lower deck with cbse access to escape chutes, boat landing ladders and SOV gangway connection points. Survival suits shall be stored nearby or at muster areas Escape routes shall preferably be provided on the outside, along the periphery of the installation, and be designed to be passable by position rather than by special protection Escape and evacuation routes leading to a higher or lower level shall be provided by stairways. They shall be located nearly diagonally opposite each other as practicable. Hatches shall not be part of escape routes. Ladders can be used as part of escape routes in areas where the work is of such a nature that only a few persons (3 or less) are in the area on a short time basis when the platform is manned. The length of a stair flight or a ladder shall be as low as possible. The sub station shall be designed for stretcher transport to embarkation points at the lower deck and to helioopter hoist area. It shall be demonstrated in all cases that equipment used for transportation of injured personnel can be turned at corners and in the staircases. Required width of main access/ escape routes shall emphasize easy transport of injured personnel on a stretcher. The dimensions shall minimum be 1 m in width (0.9 m for doors) and 2.3 min height (2050 mm for doors).Role and Need for Barrier Reference Safety signs and markings shall conform with regional requirements and with reference to international industry standards, e.g. ISO 3864 and ISO 7010. Signs and markings shall be consistent throughout the plant, and the color code used shall be specific and not used for other purposes. A descriptive text shall be added to the sign if symbols are not easily understood. Text shall however be kept to a minimum. All signs/markings and their supports shall be constructed from robust material; durable and suitable for the intended use, the environmental forces and cleaning methods to which they will be subjected. Escape routes shall have signs/markings showing the preferred direction of escape. Escape and evacuation routes on plated decks shall be provided with a non-skid, oil resistant coating in yellow (RAL 1023), unless local requirements regulate the color coding. On deck grating, two parallel 100 mm wide yellow(RAL 1023 if no other requirements are given) lines shall be painted indicating the width of the escape route. Escape and evacuation routes inside rooms with other floor finish than plated deck or grating, e.g. multipurpose and control room, shall be provided with low level fluorescent arrows showing correct escape direction. Ot her enclosed spaces shall be oonsidered separately. Safety plans shall be strategically located/ posted on the premises with high degree of accessbility. Such a plan shall include: • Locations of safety, rescue and firefighting equipment • Emergency exits, escape and evacuation routes • Evacuation instructions and legends Muster area The muster area is a safe place where personnel normally muster while emergency response are undertaken. Muster area shall be safe by position rather than by protection. Two easily accessible muster areas (primary and secondary) shall be clearly defined and separated from each other as widely as practicable. The muster areas shall be located in protected area at lower deck with easy access to the escape chutes, boat landing ladders and SOV gangway connection points. The muster areas, and the evacuation routes from muster area to the embarkation area in g uestion, shall be arranged and protected in order to ensure theRole and Need for Barrier Reference safety of all personnel during the period required for the evac uation process to be completed in an organized and efficient way. The primary Muster Area shall remain unimpaired by excessive toxic fumes, smoke, unacceptable heat load, hot liquids and falling objects for minimum 30 minutes Additional functions for the muster area are to provide first aid, information and communication. The size of the muster areas shall as minimum correspond to N*0.4 m 2 , where N denotes maximum personnel at the substation. Emergency communication systems (e.g. telephone and UHF radios) shall be available at the muster station. At escape chutes waterproof portable VHF shall be available and adapted for use in life rafts. Evacuation systems Primary method of evacuation is to SOVvia gangway connection orto ClV via the boat landing ladders, i.e. the normal method of getting to and from the installation. Secondary method of evacuation is helicopter winching from up per level of the OSS (medevac or no n-emergency scenario) Tertiary method of evacuation is evacuation to sea by escape chutes with life rafts. Evacuation by SOV SOV will not be permanently connected when personnel are on-board the OSS. The SOV shall be able to react and conna::t with gangway to the OSS within 30 minutes upon request The SOV walk-to-work system shall as minimum be operational for wave heights up to 2.5 m Hs.Role and Need for Barrier Reference Weather conditions shall be monitored and personnel onboard the OSS shall be transferred to SOV prior to the critical weather condition is reached. The SOV shall be equipped with fast rescue craft and have emergency medical facility. Evacuation via CTV Minimum two boat landings shall be av ailable for ClV access. Helicopter winching area A helicopter winching area shall be provided on the top deck. The winching area is for emergency scenarios when not requiring immediate evacuation. It is not intended for normal crew transfer nor norrnal goods logistics but may be used in exceptional cases for personnel transfer and/or goods logistics. Desig n and obstacle restrictions and visual aids marking shall be acoording to requirements for helicopter winching areas in CAP 437 and relevant local codes and standards. There shall be no obstructions such as antennas, masts or other equipment preventing helicopter access above the winching area. The maximum helicopter rotor diameter size shall correspond to type of SAR helicopters to be used in Polish waters. Escape chutes with life rafts Escape chutes with life rafts shall be provided on tV1.0 separate locations of the installation arranged such as to maximize av ailabilitywith respect to sea conditions. Each escape chute location shall have capacity for maximum POB. The escape chutes shall comply with air-gap requirements as specified in the OSS Topside Technical Specfication and be located such that they are unimpaired by excessive toxic fumes, smoke, unacceptable heat loads, hot liquids and falling objects for minimum 30 minutes after all reasonably foreseeable incidents begin. The chute system's life rafts and boarding raft shall be lowered together with the chute, and the boarding raft shall automatically inflate.Role and Need for Barrier Reference The escape chute system shall be readily available and easy to operate with clear operating instructions located on an appropriate place, e.g. on the wall inside container. Winch for recovery should be fed by main power. Removal of rafts for re-<:ertification shall be possible without affecting the suspension system including lifting wire. Location and arrangement shall ensure easy lifting, installation and removal of the chutes. The evacuation-to-sea-equipment shall be type approved and tested acoording to IMO/SOLAS/LSA , code and national maritime regulatory requirements. Rescue and safety equipment Suits and life jackets Permanent cabinets for storage of survival suits (with floating and thermal protection abilities) shall be located at or close to the primary muster station, corresponding to the maximum POB on the OSS. The survival suit is personal safety equipmen� meaning that each person on the installation shall have their own suit that is brought onboard and temporarily stored in the permanent cabinets. There shall be sufficient space around the cabinets to ensure quick dress up for the maximum number of POB. Additional storage of survival suits correspond ng to the maximum POB shall be available at the muster station. Survival suits shall as a minimum be type approved accordng to IMO/SOLAS/ LSA Code, but additional requirements may come out of the EER analysis. The following applies: • Design should minimize impact to the neck of the wearer in case of jumping from a high level • Be of a color which is easily visible at sea (yellow, orange, etc.) • Have reflecting and/or fluorescent markings to facilitate rescue in the dark Lifebuoys Life buoys shall be installed at regular intervals on lower deck perimeter along the walkway, for guidance see DNV-ST-0145. Safety showers and eyebathsRole and Need for Barrier Reference The layout and arrangement shall reduce the probability and the consequences of accidents through location, separation and orientation of areas, equipment and functions. The explosion barriers shall reduce the consequences of the pressure loads from an ignited cloud of released gas or oil mist to prevent the accident to spread to other areas and/or critical equipment lR3021 Electrical system design, offshore units DNV-ST-0145 Offshore SubstationsRole and Need for Barrier Reference Need for safety showers or eyebaths and strategic locations shall be identified through a separate evaluation considering the chemicals handled and sp illage that may occur or risk for burns orexposure of hot fluids to personnel. Potable water quality shall be used for safety showers and eyebaths First aid kits and equipment An adequate number of first aid kls shall be provided at suitable locations and shall as minimum be provided at the Multipurpose room. The muster station / locker room shall further accommodate storage/space for first aid equipment such as medication, rigged stretcher and defibrillation equipment. Search and rescue equipment Breathing masks/smoke hoods for escape through areas exp osed to toxic fumes or smoke shall be evaluated. Electrical rescue kits shall be available and easily accessible for personnel performing tasks in electrical rooms.Role and Need for Barrier Reference Relevant hazards • Safety critical functions impaired by accidental loads • Security incidents or accidents caused by third party entry to the installation • Explosion e.g. due to fault in oil filled transformers resulting in escalation between equipmentorareas • Asphyxiation risk related to leaks from pressurized bottles (inert gas, SF6, N2) Requirements Areas or equipment of high-risk potential (e.g. oil filled transformer area) shall be segregated by slificient distance or barriers from areas required to be of low risk potential, and from areas containing important safety functions. Incident escalation between areas shall be avoided. Muster and embarkation areas and rooms with safety critical functions shall be located at lower deck level, separated and protected by plated deck towards areas and spaces with higher risk potential which shall be located above (e.g. transformer areas, cooler areas). Physical security Access to boat landing and ladder up to lcmer deck level may be available for third party, but access to deck shall be controlled and locked for third party, e.g. by mariner cage or simiar. The lock design on the mariner cage entrance door must facilitate escape from the platform. Ladder entry and boat landings shall be part of CCTV coverage. All rooms on the installation shall be locked as default. High voltage rooms locked with dedicated keys. High Voltage cabinets locked with pad locks. Ref high voltage (HV) safety rules. Explosion design principles for rooms for major electrical equipment The rooms shall withstand without any damage the highest blast pressure caused by a short circuit. As a general rule it is not necessary to do any calculations to document this requirement for short circuit levels up to the levels listed below (indicated as the maximum symmetrical root mean square (RMS) value of the sub transient fault current): - 11 16,613,3 kV: 40 kA RMS - 690 V: 50 kA RMSReference Role and Need for Barrier The crane barrier shall reduce the probability that errors and hazards will arise during crane operation and reduce the possibility of boom or load fall. Relevant hazards TR1727 Substitution to TR1727 ver 5, Unmanna::l installationsRole and Need for Barrier Reference 400/230 V: 30 kA RMS - Main distribution board; 400/230 V: 10 kA RMS -Sub-distribution board For higher short circuit levels, the room integrity towards blast pressure caused by a short circuit shall be documented. Explosion design principles - Oil filled transformer areas The am ount of venting available, the degree of blockage and congestion in the area significantly influence the severity of an explosion and shall be optimized to reduce explosion risk. Oil filled transformers should be located in natural ventilated area. Dimensioning explosion loads shall be established and implemented in design for structures and equipment Explosion panels sh all be provided in walls facing sea (if partially enclosed) in order to reduoo explosion load potential. Storage of pressurized bottles (Inert gas, SF!i, N2) Storage of pressurized bottles should be in naturally ventilated area. If gas bottles are stored in enclosed spaces, introducing risk of asphyxiation, adequate ventilation shall be provided, and leak detection evallated.Role and Need for Barrier Reference DNV-ST-0145 Offshore Substations • Dropped objects impacting e.g. personnel, critical equipment, ClV or SOV, subsea cables etc. Requirements The offshore crane and davits shall complywith lR1727 Substitution for unmanned installations The likelihood of crane boom or load fall as well as hanging loads hitting personnel or critical equipment shall be reduced as far as practicably possible. Crane coverage and laydown areas shall be arranged to promote safe operations of the cranes and free, unobstructed visibility to lay down and lifting zones for operator of the crane There shall be no lifting zones above unprotected equipment or piping, containing flammable or toxic gasAiquid. Lifting zones to SOV/CTV shall be located such that lifting operations to the SOV/CTV can be done leeward of the predomnant weather conditions. The lifting zones should be located away from cables to or from the OSS if practical. The cable protection system (CPS) shall be capable of handling relevant dropped object loads. The lifting zones shall be defined and available as a lifting map. Deck load limitation chart shall be established. A sign indicating maximum weight and loading rating shall be displayed at each laydown area. The cranes shall be equipped with necessary fire protecti on means, The crane shall be op erable to a safe position in the event of an accident. The davit crane shall be capable and certfied to lower injured personnel to CTV. Swinging load protection shall be implemented on lay down areas as required to prevent impact to critical equipment and critical damage to load bearing structures. This is also relevant in all foreseeable lifting zones from cranes on the OSS and use of SO/ gangway and gangway associated SOVRole and Need for Barrier Reference International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) Recommendation 0-139, The marking of man-made offshore structures (2013) The Vessel Collision Avoidance System shall reduce the risk of vessel collisions. The surveillance of the sector around the installation may be performed by a central surveillance unit, a local surveillance unit (a unit or vessel responsible for more than one installatim), a dedicated standby vessel or the installation itself. Hazards • Ship collision with infield vessels in transit (powered collision), e.g. Service Operation Vessel (SOV) or Crew Transf er Vessel (ClV), • Ship collision with SOV during approach ("drift on" or "drift otr) • Ship collision whilst in position nextto the OSS ("drift on" or "driftotr) • Collision with fishing vessel or passng merchant vessel Requirements The unmanned OSS will not be equipped with a radar system. The collision avoidance strategy is based on surveillance by ClV/SOVwhen personnel is on the OSS, in combination with requirements to aids to navigational, wind farm layout and procedures for infield vessel movement. The OSS design shall incorporate AIS. CCR shall be able to survey the area around the OSS in all d rections by CClV. Field layoutRole and Need for Barrier Reference associated crane (if equipped). The boat landing, including ladders and platforms, shall be designed with respect to impact / swinging loads from material handling.Role and Need for Barrier Reference The OSS shall be located minimum 500 meter behind the straight line of wind turbines defining the No1U:1east perimeter of the wind far m (towards parallel navigational route). Wind farm internal transit routes shall allcm infield vessels to pass the OSS with minimum 500 m clearance. SOV requirements (in the event SOV should be used on the windfarms) The SOV shall have minimum DP class 2 design. Operational procedure shall be in place for the SOV to approach and connect to the OSS on the leeward side of the installation with respect to the dominating environmental forces, such that SO/ will drft away from installation if incapable of maintaining target position and/or heading. Aids to navigation (AtoN) The following AtoN measures shall as minimum be implemented on the OSS, each with an availablity of no less than 99.0% (IALA Availability Category 2). • AIS base station • Foghorn • Marking of the substatio n in acoordance international and national requirements. • DP laser reflectors Communication system System shall be in place for communication with vessel on colision course. SOV and CTV shal l be equipped with necessary equipment to get attention from vessel on collision course, e.g.: • Signal lamps with intensity of minimum 1000 candelas • Megaphone with sound intensity of 80 dB Fast rescue craft on the SOV shall be equipped with approved maritime VHFRole and Need for Barrier Reference DNV-ST-0145 Of fshore substations DNV-RP.C204 Structural design against accidental loads C256-EQ-Z-SP-00012 OSS Substructure Technical Specification Load bearing strucbJre shall withstand all loading situations under normal operation and also ensure structural integrity after a dimensioning accidental event. Main design principles Load bearing structures shall be sufficiently robust to ensure that local damage or f ailure will not result in unacceptable consequences. • Slender, main load bearing structural elements shall be demonstrated to be redundant. • Main load bearing structures shall be designed so that water penetration through outer walls facing the sea cannot lead to loss of main s.tety functions The topside structural integrity shall be documented for all governing conditions and phases during the platform lifetime, i.e. from prefabrication, assembly, weighing, site moves, barge transportation and installation to offshore hook-up, operation and abandonment The jacket and topsides structure shall be designed to withstand the Dimensioning Accidental Loads (DAL) associated with the following Major Accid ent Hazards (MAH) where relev ant: Fire, Explosion, Dropped objects, Extreme Weather and Ship collisions. Recognized models/methods and competent personnel shall be used to determine the corresponding design accidental loads.Role and Need for Barrier Reference Systems for consequence reductbn and evacuation • Ev acuation of personnel • ESD - platform shutdownRole and Need for Barrier Reference Dimensioning accidental loads and environmental loads shall not cause the loss of main safety function(s ). Ship collision It is not considered practical to design for impact energies associated with a passing merchant vessel collision. This hazard shall be addressed by preventive measures (ref. PS19). The OSS shall be designed to withstand a collision of a service operation vessel up to 6000t displ acement. For ALS, a ship impact speed of minimum 2.0 mis shall be used with added mass as per requirements in DNV-ST-0145. Energy absorbed by striking vessel may be taken according to DNV-RP-C204. Some structural damage is considered acceptable under the above circumstances provided the overall structural integrity of the platform is not compromised. Collision with vessel superstructure shall be considered in design of the topside. Safety critical equipment or equipment that could cause environmental harm in case of a collision shall not be positioned at the outer faces of the topside. Layout around the OSS gangway landing areas shall prevent SOV DP failure (drive-off/drift-off) with inward movement of the gangway leading to an escalating event, e.g. by causing damage to safety critical equipment. Extreme weather Airgap requirements given in DNV-ST-0145 shall be fulfilled. The topside shall have positive air gap in all conditions, reference is made to the Offshore Substation Substructure technical specification for details.Role and Need for Barrier Reference lR 4031 Automation technology-Offshore wind (HOLD not yet issued) EN 62682 Management of alarms systems for the process industries EEMUA Publication 191 Alarm systems - a guide to design, management and procurement EN ISO 11064 Ergonomic design of control centers Part 1: Principles for the design of control centres Human machine interface (HMI) in central control room (CCR) shall provide system information presentation and means for operator interactions. HMI provides the physical interface between systems and facility operator, maintenance technicians and other personnel operating and monitoring the facilities. The HMI shall present safety-related information for all systems, including: • Status of wind turbine generators (start-stop, trip/shutdcmn), substations, transmission system and grid connections • Status of navigational aids on the wind turbine generators and substations • Electrical overview, including status/position of high voltage switches and breakers, local isolations etc • Weather monitoring/forecas� induding lightning, sea state etc • Fire detection on wind turbine generators and in substations • Lo cation of vessels (service operating vessels, ClVs as well as other vessels) • Lo cation of helicopters (where relevant) • Location of personnel • Status of personnel • For offshore structures: External CClV monitoring. Internal CClV monitoring to be considered. Night vision to be consi::lered for external cameras. • Intruder detection for all wind turbine generators, substations • Natural ventilation and heating, ventilation, and air conditioning • Shutdown hierarchy overview and status • Fire & gas overview, e.g .. , per main fire area and/o r fire detecti on area The HMI shall include a main operating interface in CCR and allo w for manual activation of critical safety fundi:>ns.Role and Need for Barrier Reference All systems and HMI designated critical for safety or production shall be designed sudl that easy, fast recovery methods can be employed to regain control of the system. This includes management of software backups and system components as well as documentation to facilitate recovery. The system shall be desg ned for continuous operation, such that system function is maintained at all times. The HMI shall be designed to prevent inadvertent operations due to operatormisperception and unintended actions. EN 62682 and EEMUA 191 shall be used as basis for design of alarm functions. TR1494 and EEMUA Guideline 191 should be used for guidance. Failure to execute safety functions on demand shall initiate an alarm in CCR. The HMI facilities shall indude detailed safety system information such as input and output status, alarms, status of inhibi� override and suppression and safety system fault indication. HMI control functions • Initiate shutdowns (ESD / process level) • ESD level reset • F&G reset (e.g., per fire detection area) • F&G common reset of inhibits and overrides (e.g., per fire detecti::>n area) • ESD common reset of inhibits and overrides • Firefighting release Requirements in EN ISO 11064 "Ergonomi:: design of control centers Part 1: Principles for the design of control centres" shall be adhered toRole and Need for Barrier Reference The Safety- and Automation Systems, including other control and monitoring facilities, shall be protected against threats such as unauthorized access and malware that may be introduced due to external data communication and information exchange, i.e., by application of security measures of the technical networks Barriers shall be installed to prevent intruders to access the topside deck levels of the OSS. CClV surveillance of lower deck/top of jacket where unauthorized personnel may access shall be installed. lR1658 Information Security of Industrial Automation and Control Systems IEC 62443 Netw ork and system security for industrial-process measurement and controlre equinor *<* | EE potenerciaBaltyk Il - All year Wind speed (mis) Baltyk Ill - All year ior re equinor *<* | EE potenerciare equinor *<* | EE potenerciare equinor *<* | EE potenerciare equinor *<* | EE potenerciaVISUAN310d | 2% 4ouInbe