DNV-OS-E402 Topside Facilities: Process Safety

DNV-OS-E402 governs the design of topside facilities on offshore installations — the process, utility, and safety systems above the hull or jacket structure. It covers the layout principles, hazardous area classification, HVAC and pressurisation, fire and gas detection, and electrical system design that together protect personnel and asset integrity on FPSOs, semi-submersibles, jack-ups, and fixed platforms.

OS-E402 sits within the DNV offshore safety framework alongside DNV-OS-A101 (safety principles), DNV-OS-D101 (marine and machinery systems), and DNV-RP-A203 (risk management). The ALARP risk acceptance criteria established in OS-A101/RP-A203 drive the topside layout and hazardous area classification decisions governed by OS-E402.

1. Scope and Facility Types

DNV-OS-E402 applies to topside facilities on:

• Production platforms (fixed jacket, GBS, TLP, FPSO, FLNG, FSO)
• Drilling units (semi-submersible, jack-up, drillship) — the drilling-specific process equipment
• Accommodation vessels with process or utility facilities
• Offshore wind service vessels with significant electrical generation infrastructure

The standard covers topside systems including:

• Oil and gas processing train (separators, compressors, pumps, export metering)
• Utility systems (power generation, seawater lift, cooling water, instrument air)
• Safety systems (ESD, F&G detection, deluge, blowdown, emergency power)
• Accommodation and HVAC where integrated with process areas
• Flare and relief systems

2. Layout Principles and Area Separation

Topside layout is the most cost-effective risk-reduction measure available — separating ignition sources from hydrocarbon inventories before design is frozen is far cheaper than adding barriers after layout is fixed. DNV-OS-E402 requires the layout to be informed by the QRA (per DNV-RP-A203) at FEED stage.

Area Classification Zones

Separation Distances

OS-E402 does not prescribe fixed separation distances (those are derived from the QRA gas dispersion and explosion analysis), but it requires that the layout demonstrate:

• The control room and TR are outside the 10⁻⁴ per year ignition probability contour for major HC releases
• Ignition sources (electrical equipment, hot surfaces, engines) are separated from flammable vent exits and pressure safety valve outlets by at least the dispersion distance for the worst credible release scenario
• At least two escape routes from each process deck to lifeboat stations, with routes on opposite sides of the facility

3. Hazardous Area Classification

Hazardous area classification identifies zones where flammable gas/vapour may be present and restricts the electrical and non-electrical equipment that can be installed there. DNV-OS-E402 references IEC 60079-10-1 (gas) and IEC 60079-10-2 (dust) for the classification methodology.

4. HVAC and Pressurisation Levels

HVAC on offshore topsides serves a dual purpose: thermal comfort for personnel, and maintaining safe (non-hazardous) conditions in enclosed areas. OS-E402 defines three pressurisation strategies:

HVAC Supply Air Intake Requirements

• Safe-area intakes must be located upwind of the process area, at a safe distance from flare stacks, vent outlets, and Zone 1 areas
• Two independent supply fans required for TR and control room (duty/standby); automatic changeover on primary fan failure
• HVAC system must be capable of automatic isolation (ESD activation) when gas detected in supply air
• CO₂/CO detectors required on accommodation supply air intakes where diesel engines exhaust is present

5. Fire and Gas Detection

Fire and gas detection on offshore topsides is a Safety Critical Element (SCE) per DNV-OS-A101 and is subject to barrier performance standards. OS-E402 provides the system design requirements:

Gas Detection Coverage

Detection Thresholds and Actions

• Low alarm (typically 20% LEL): alert to control room; increase ventilation; restrict hot work; investigate
• High alarm (typically 60% LEL): ESD Level 2 initiation — shut-in production, depressure if required, activate deluge in affected zone, isolate ignition sources
• Fire detection (smoke, heat, or flame): ESD Level 3 — full platform shutdown, evacuation alarm, activate fixed suppression
• Voting logic: 2-out-of-3 gas detector voting recommended for ESD to avoid spurious shutdown; 1-out-of-2 acceptable for non-critical zones

6. Electrical Equipment Selection (ATEX/IECEx)

All electrical equipment in classified areas must carry appropriate certification. DNV-OS-E402 requires compliance with IEC 60079 series; for equipment on the European market, ATEX Directive 2014/34/EU certification is also required.

Earthing and Bonding

• All metallic process equipment in classified areas shall be earthed and bonded to prevent electrostatic discharge — a potential ignition source in Zone 1/2
• Cathodic protection current interference with offshore earthing requires coordinated earthing design (typically isolated from the CP system)
• Intrinsically safe instrument loops require a separate earthing bar with isolation barrier verified by the system designer

7. Process Safety Systems

OS-E402 requires that process safety systems (ESD, high-integrity pressure protection systems, blowdown) be designed as safety instrumented systems (SIS) per IEC 61511, with SIL verification where required by the SIL assessment.

Emergency Shutdown (ESD) Levels

• ESD Level 0 (manual, total shutdown): from dedicated pushbuttons at muster stations; full shutdown of all production and utilities; activates all deluge and blowdown
• ESD Level 1 (process shutdown): shut-in of all wells and export; isolate production equipment from utility systems; flare routing; does not shut down power generation
• ESD Level 2 (area shutdown): isolate and depressurise the affected process module; maintain other modules in operation if safe
• ESD Level 3 (unit shutdown): individual equipment shutdown (e.g. single compressor); fault-tolerant, does not cascade

Blowdown and Depressurisation

Where a major HC inventory cannot be allowed to burn, rapid depressurisation via the blowdown valve to flare reduces the gas mass available for an explosion or prolonged fire. DNV-OS-E402 (and OS-A101) requires:

• Blowdown rate: reduce pressure from 100% SITP to 50% SITP in ≤ 15 minutes for most segments (major segments with large inventory may use ≤ 30 minutes)
• Minimum heat flux to structure assessed for fire duration after blowdown (passive fire protection dimensioning)
• All blowdown valves to be fail-open (spring-open) and ESD-activated

8. Common Pitfalls

• Classifying the control room as Zone 2 rather than safe area because it has instrument connections to process — a properly pressurised control room with safe-area air supply is a safe area; Zone 2 classification requires Ex-rated equipment unnecessarily and increases capital and maintenance cost
• Installing only point gas detectors in open process areas — point detectors have very limited coverage on open deck; open-path detectors across the likely gas cloud path are required for adequate coverage
• Voting logic 1-out-of-1 for ESD-Level-2 (area shutdown) activation — a single failed detector can trigger spurious platform shutdown; 2-out-of-3 voting for ESD-Level-2 reduces spurious trips without compromising safety response time
• Taking HVAC supply air from the leeward side of the process module — HVAC supply intakes must be on the safe side of the facility regardless of the prevailing wind direction; use a rose analysis covering all wind directions
• Designing HVAC systems without documenting the source of the safe-area classification for each intake — if a Zone 1 area expands during detailed design, the impact on HVAC safe-area intake locations must be re-evaluated; undocumented assumptions create gaps at HAZOP
• Treating the flare as always-safe to use for venting during emergency — flare tip failures or flare line liquid slugs can cause flashback or ground-level flame; verify flare hydraulics for emergency blowdown scenarios
• Involving the HVAC, F&G, and hazardous area teams in the HAZOP — most HVAC/F&G gaps are discovered in HAZOP when process deviations (e.g. high gas flow to atmosphere via PSV) are traced to their ignition-source consequences; having these specialists in the room catches interface gaps that multi-discipline coordination reviews miss
• Using the ATEX/IECEx equipment list as a living document during construction — re-issuing the classified equipment list at each design milestone (FEED → detailed design → construction) catches late-stage changes that place non-Ex equipment in classified areas