ISA TR84.00.07 2010 ED

ISA-TR84.00.07-2010 Technical Report

Guidance on the Evaluation of Fire,

Combustible Gas and Toxic Gas System Effectiveness

Approved 15 January 2010

Copyright International Society of Automation Provided by IHS under license with ISA Licensee=Inelectra -Venezuela site/9990084001, User=GutiÃ©rrez Capriles, Glenda

Not for Resale, 05/28/2014 09:51:12 MDTNo reproduction or networking permitted without license from IHS

--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 — Guidance on the Evaluation of Fire and Gas System Effectiveness

ISBN: 978-1-936007-43-1

Copyright © 2010 by ISA. All rights reserved. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without the prior written permission of the Publisher.

ISA 67 Alexander Drive P.O. Box 12277 Research Triangle Park, North Carolina 27709



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 3 - ISA-TR84.00.07-2010

Copyright 2010 ISA. All rights reserved.

Preface

This preface is included for information purposes and is not part of ISA–TR84.00.07.

This technical report has been prepared as part of the service of ISA, the International Society of Automation. To be of real value, this document should not be static but should be subject to periodic review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards and Practices Board; ISA, 67 Alexander Drive; P.O. Box 12277; Research Triangle Park, NC 277099; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: [email protected].

This ISA Standards and Practices Department is aware of the growing need for attention to the metric system of units in general, and the International System of Units (SI) in particular, in the preparation of instrumentation standards, recommended practices, and technical reports. The Department is further aware of the benefits to users of ISA standards documents of incorporating suitable references to the SI (and the metric system) in their business and professional dealings with other countries. Toward this end, the Department will endeavor to introduce SI and acceptable metric units in all new and revised standards documents to the greatest extent possible. The Metric Practice Guide, which has been published by the Institute of Electrical and Electronics Engineers (IEEE) as ANSI/IEEE Std. 268-1992, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors.

It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the development of ISA standards. Participation in the ISA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA, or of any of the standards, recommended practices, and technical reports that ISA develops.

CAUTION — ISA DOES NOT TAKE ANY POSITION WITH RESPECT TO THE EXISTENCE OR VALIDITY OF ANY PATENT RIGHTS ASSERTED IN CONNECTION WITH THIS DOCUMENT, AND ISA DISCLAIMS LIABILITY FOR THE INFRINGEMENT OF ANY PATENT RESULTING FROM THE USE OF THIS DOCUMENT. USERS ARE ADVISED THAT DETERMINATION OF THE VALIDITY OF ANY PATENT RIGHTS, AND THE RISK OF INFRINGEMENT OF SUCH RIGHTS, IS ENTIRELY THEIR OWN RESPONSIBILITY. PURSUANT TO ISA’S PATENT POLICY, ONE OR MORE PATENT HOLDERS OR PATENT APPLICANTS MAY HAVE DISCLOSED PATENTS THAT COULD BE INFRINGED BY USE OF THIS DOCUMENT AND EXECUTED A LETTER OF ASSURANCE COMMITTING TO THE GRANTING OF A LICENSE ON A WORLDWIDE, NON-DISCRIMINATORY BASIS, WITH A FAIR AND REASONABLE ROYALTY RATE AND FAIR AND REASONABLE TERMS AND CONDITIONS. FOR MORE INFORMATION ON SUCH DISCLOSURES AND LETTERS OF ASSURANCE, CONTACT ISA OR VISIT: www.isa.org/StandardsPatents. OTHER PATENTS OR PATENT CLAIMS MAY EXIST FOR WHICH A DISCLOSURE OR LETTER OF ASSURANCE HAS NOT BEEN RECEIVED. ISA IS NOT RESPONSIBLE FOR IDENTIFYING PATENTS OR PATENT APPLICATIONS FOR WHICH A LICENSE MAY BE REQUIRED, FOR CONDUCTING INQUIRIES INTO THE LEGAL VALIDITY OR SCOPE OF PATENTS, OR DETERMINING WHETHER ANY LICENSING TERMS OR CONDITIONS PROVIDED IN CONNECTION WITH SUBMISSION OF A LETTER OF ASSURANCE, IF ANY, OR IN ANY LICENSING AGREEMENTS ARE REASONABLE OR NON-DISCRIMINATORY.

ISA REQUESTS THAT ANYONE REVIEWING THIS DOCUMENT WHO IS AWARE OF ANY PATENTS THAT MAY IMPACT IMPLEMENTATION OF THE DOCUMENT NOTIFY THE ISA STANDARDS AND PRACTICES DEPARTMENT OF THE PATENT AND ITS OWNER.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 4 -


ADDITIONALLY, THE USE OF THIS DOCUMENT MAY INVOLVE HAZARDOUS MATERIALS, OPERATIONS OR EQUIPMENT. THE DOCUMENT CANNOT ANTICIPATE ALL POSSIBLE APPLICATIONS OR ADDRESS ALL POSSIBLE SAFETY ISSUES ASSOCIATED WITH USE IN HAZARDOUS CONDITIONS. THE USER OF THIS DOCUMENT MUST EXERCISE SOUND PROFESSIONAL JUDGMENT CONCERNING ITS USE AND APPLICABILITY UNDER THE USER’S PARTICULAR CIRCUMSTANCES. THE USER MUST ALSO CONSIDER THE APPLICABILITY OF ANY GOVERNMENTAL REGULATORY LIMITATIONS AND ESTABLISHED SAFETY AND HEALTH PRACTICES BEFORE IMPLEMENTING THIS DOCUMENT.

THE USER OF THIS DOCUMENT SHOULD BE AWARE THAT THIS DOCUMENT MAY BE IMPACTED BY ELECTRONIC SECURITY ISSUES. THE COMMITTEE HAS NOT YET ADDRESSED THE POTENTIAL ISSUES IN THIS VERSION.

The following served as members of ISA84 in developing this technical report:

NAME COMPANY

W. Johnson, Chair E I du Pont V. Maggioli, Managing Director Feltronics Corp R. Adamski RA Safety Consulting LLC T. Ando Yokogawa Electric Co R. Avali Westinghouse Electric Corp L. Beckman Safeplex Systems Inc J. Campbell ConocoPhillips I. Chen Aramco R. Chittilapilly Oil & Natural Gas Corp M. Coppler Ametek Inc M. Corbo ExxonMobil K. Dejmek Baker Engineering & Risk Consultants P. Early Langdon Coffman Services K. Gandhi KBR J. Gilman JFG Technology Transfer LLC W. Goble Exida P. Gruhn ICS Triplex B. Hampshire BP J. Harris UOP A Honeywell Company J. Jamison EnCana Corporation Ltd R. Johnson Dow Process Automation K. Klein Celanese Corp T. Layer Emerson Process Management E. Marszal Kenexis Consulting Corp N. McLeod ARKEMA R. Peterson Lyondell Chemical Company G. Ramachandran Shell Global Solutions US M. Scott, FGS Co-Chair AE Solutions R. Seitz, FGS Co-Chair Artech Engineering D. Sniezek Lockheed Martin Federal Services C. Sossman CLS Tech-Reg Consultants R. Strube Strube Industries A. Summers SIS-TECH Solutions LP L. Suttinger Savannah River Nuclear Solutions R. Taubert Consultant H. Thomas Air Products & Chemicals Inc T. Walczak Conversions Inc M. Weber System Safety Inc A. Woltman Shell Global Solutions P. Wright BHP Engineering & Construction Inc D. Zetterberg Chevron Energy Technology Company



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 5 - ISA-TR84.00.07-2010


The following served as members of the ISA Standards and Practices board and approved this technical report:

NAME COMPANY

J. Tatera, VP Tatera & Associates Inc. D. Dunn, VP Elect Aramco Services Co P. Brett Honeywell, Inc M. Coppler Ametek, Inc E. Cosman The Dow Chemical Co B. Dumortier Schneider Electric R. Dunn DuPont Engineering J. Gilsinn NIST/MEL E. Icayan ACES Inc J. Jamison EnCana Corporation Ltd D. Kaufman Honeywell International Inc K. Lindner Endress+Hauser Process Solutions AG V. Maggioli Feltronics Corp T. McAvinew Jacobs Engineering A. McCauley Chagrin Valley Controls Inc. G. McFarland Emerson Process Mgmt Power & Water Sol R. Reimer Rockwell Automation N. Sands DuPont H. Sasajima Yamatake Corp T. Schnaare Rosemount Inc I. Verhappen Industrial Automation Networks Inc. R. Webb ICS Secure LLC W. Weidman Consultant J. Weiss Applied Control Solutions LLC M. Widmeyer Kahler Engineering Inc. M. Wilkins Yokogawa IA Global Marketing (USMK) M. Zielinski Emerson Process Management



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

This page intentionally left blank.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 7 - ISA-TR84.00.07-2010


Contents

1 Scope ..................................................................................................................- 13 -

2 References............................................................................................................- 13 -

3 Abbreviations and Acronyms .....................................................................................- 13 -

4 Definitions .............................................................................................................- 15 -

5 Risk Concepts in FGS..............................................................................................- 16 -

6 Performance-based FGS Lifecycle Process..................................................................- 19 -

Annex A – Application Example Problems ...........................................................................- 27 -

Annex B - Detector Coverage Assessment Techniques ..........................................................- 49 -



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---




--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 9 - ISA-TR84.00.07-2009


Foreword

ISA-TR84.00.07-2010 is intended for use in evaluating the effectiveness of fire & gas systems (FGS) in process industry applications. It addresses the implementation of FGS to reduce the risk of hazardous releases involving safety impact.

NOTE Users may choose to apply the concepts in this technical report to environmental and / or operational loss scenarios.

ISA-TR84.00.07-2010 is provided for information purposes only and is not part of ANSI/ISA-84.00.01-2004 (IEC 61511 Modified) (ref 2.1).

ANSI/ISA-84.00.01-2004 and IEC 61511 are performance-based standards that provide the minimum requirements for designing and managing a safety instrumented system (SIS). As part of the safety lifecycle, the functional and integrity requirements are established for safety functions that reduce the risk of hazardous events identified using a hazard and risk analysis. Guidance is provided in Part 3 of either ANSI/ISA-84.00.01-2004 or IEC 61511 on the various methods used to evaluate risk and allocate risk reduction to identified safety functions. An underlying assumption in all of the methods is that the identified safety functions are capable of achieving the allocated risk reduction in the operating environment.

The scope of ISA84 covers “programmable electronic system (PES) for use in safety applications.” Accordingly, ISA84 develops standards and technical reports to provide guidelines for the implementation of automated (or instrumented) systems in safety applications. The purpose of ISA-TR84.00.07 is to provide guidance on how to establish and verify the functional and integrity requirements for identified FGS functions. FGS functions that are identified as Safety Instrumented Functions may be implemented according to the requirements of either ANSI/ISA-84.00.01-2004 or IEC 61511.

THE EXAMPLE RISK ANALYSIS METHODS AND RISK CRITERIA CONTAINED IN THIS TECHNICAL REPORT HAVE BEEN PROVIDED SOLELY AS EXPLANATORY MATERIAL AND SHOULD NOT BE INTERPRETED AS RECOMMENDATIONS.

ALSO, THE EXAMPLE FGS ARCHITECTURES, DETECTOR COVERAGES, AND MITIGATION EFFECTIVENESS REPRESENT POSSIBLE SYSTEM CONFIGURATIONS AND SHOULD NOT BE INTERPRETED AS RECOMMENDATIONS. THE CONFIGURATIONS USED IN ACTUAL APPLICATIONS ARE SPECIFIC TO THE OPERATING ENVIRONMENT AND PROCESS CONDITIONS IN WHICH THEY ARE USED. AS SUCH, NO GENERAL RECOMMENDATIONS CAN BE PROVIDED THAT ARE APPLICABLE IN ALL SITUATIONS.

THE USER OF THIS TECHNICAL REPORT IS CAUTIONED TO CLEARLY UNDERSTAND THE ASSUMPTIONS AND DATA ASSOCIATED WITH THE METHODOLOGIES IN THIS DOCUMENT BEFORE ATTEMPTING TO UTILIZE THE METHODS PRESENTED HEREIN.

Users of ISA-TR84.00.07 will include:

a) Manufacturers who are applying the performance-based concepts to FGS functions, in addition to other applicable good engineering practices.

b) Hazards and risk analysis teams that are allocating risk reduction to FGS functions.

c) FGS designers who want to understand the impact of detector coverage and mitigation effectiveness on the integrity of FGS functions.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---




--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 11 - ISA-TR84.00.07-2010


Introduction

The ISA84 standards committee formed a working group to study the analysis and design processes that are commonly used in the process industry for Fire & Gas Systems (FGS) and to provide guidance on how these processes can be adapted to incorporate performance-based concepts.

FGS are a subset of industrial automation and control systems that are employed in the process industries for the purpose of detecting loss of containment of hazardous materials from the process and initiating response to mitigate the release impact. Loss of containment can be a small leak or a catastrophic release. It may be detected directly by measuring the presence of the released materials (e.g., gas concentration) or inferred from the effects of the release (e.g., thermal radiation from a fire).

Detection may include combustible gas, toxic gas, smoke, flame, acoustic emission, or rapid heat rise in areas adjacent to the process itself and in critical areas, such as occupied buildings or buildings with unrated electrical equipment. Detector coverage and associated detection capability varies substantially depending on the hazard scenario.

Actions taken by the FGS may be manually or automatically initiated and may affect a wide variety of systems, such as audible and visual alarm indications, water deluge, fire suppressant initiation, chemical deluge activation, manipulation of heating, ventilation, and air conditioning (HVAC) system equipment, process isolation, or process de-pressurization. Similar to detection capability, mitigation effectiveness is highly scenario-dependent.

Use of performance-based design is not currently the norm for FGS within the process industries. FGS have traditionally been designed and implemented according to various good engineering practices, such as NFPA 72 (ref 2.2), and EN 54 (ref 2.3). These prescriptive practices do not require evaluation of the risk reduction capability of the FGS as measured by its safety integrity and probability of failure on demand (PFD). Some users in specific applications, such as life safety systems, electronics manufacturing and off-shore facilities, have started applying performance-based design and management concepts, similar to those presented in either ANSI/ISA-84.00.01-2004 or IEC 61511, to FGS functions. For example, these users assess loss-of-containment scenarios during the hazards and risk analysis where an FGS can reduce the scenario risk. The identified FGS are then designed and managed to achieve the allocated risk reduction.

A performance-based approach is difficult to apply to FGS due to three factors:

1) Traditional techniques are suited for hazards related to process deviations from normal operation, which can easily be identified using a hazards and risk analysis. These process hazards have known initiating causes and consequences, allowing the Safety Instrumented Function (SIF) to be specifically designed to detect the event and to respond by achieving or maintaining a safe state of the process. FGS are generally implemented to reduce the risk from losing containment, such as leaks from equipment seals, flanges, and piping. These hazards may be difficult to define and analyze without using advanced risk analysis techniques, such as gas dispersion modeling or fire modeling associated with a given scenario.

2) FGS do not prevent a hazardous situation, but rather minimize the effects of an event that has already occurred. FGS typically reduce the magnitude and severity of the consequence instead of eliminating it. Typical hazards and risk analysis assumes that the identified safety function eliminates the consequence. Consequently, it is important to understand and evaluate the hazard scenario resulting from FGS operation to ensure that the residual risk is acceptable.

3) Even properly designed and managed FGS can provide poor risk reduction in the operating environment due to inadequate detector coverage and mitigation effectiveness. An analysis by Health and Safety Executive (HSE) of eight years of hydrocarbon release data (ref 2.4) showed



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 12 -


that regardless of the type of FGS design, the effective detection rate was about 60%. The detection of many releases was significantly delayed, leading to higher consequences than expected. Even if very high integrity can be achieved by the hardware design and testing (e.g., low average probability of failure on demand), sufficient reduction in risk will not occur unless the detector coverage is also very high. For FGS functions, detector coverage should be analyzed with the same quantitative rigor as the verification of the average probability of failure on demand for the hardware design.

FGS ineffectiveness is also related to the inability of the mitigation elements (e.g., fire water system, ventilation system) to perform their functions with high probability of success. Mitigation may include stopping the process, diverting the hazardous material, applying fire water with the appropriate flow and spray characteristics, or simply activating alarms notifying personnel to shelter-in-place or evacuate to designated safe areas. Initiating an FGS’s action does not necessarily mean that the consequence can be fully mitigated. As in the case of detector coverage, mitigation effectiveness is dependent on many situational or scenario-specific factors.

As a result of these factors, it is difficult to develop a sound technical justification for allocating risk reduction to FGS functions in a simplified risk assessment process, such as layer of protection analysis (LOPA) (ref 2.5). The identification of FGS functions and allocation of risk reduction to them requires detailed release scenario development and residual risk considerations that are beyond simplified risk-assessment tools. Further, FGS performance verification requires evaluation of the detector coverage and mitigation effectiveness, as well as hardware and software design.

This ISA technical report describes the analysis that should be undertaken and the effectiveness criteria that should be specified when an FGS is implemented. The report follows a safety lifecycle similar to that of either ANSI/ISA-84.00.01-2004 or IEC 61511 to discuss the development of detector-coverage criteria applicable to each FGS function and to support a series of application examples (Annex A) that illustrate the techniques used to develop and verify the detector coverage.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 13 - ISA-TR84.00.07-2010


1 Scope

1.1 This technical report is informative and does not contain any mandatory requirements.

1.2 This technical report is intended to be used in conjunction with other good engineering practices applicable to FGS installations. It is not intended to stand alone or be a replacement for application-specific practices.

1.3 This technical report acknowledges but does not address mitigative effectiveness associated with notification appliances and personnel response requirements.

1.4 This technical report is intended to:

• Be used by those with a thorough understanding of ANSI/ISA-84.00.01-2004.

• Clarify the additional information that should be considered when developing a performance-based FGS design. This includes development of a safety lifecycle model for FGS design and management.

• Clarify how to define FGS functions within typical FGS designs where automatic action is taken as a result of detection of a fire or gas event.

• Provide example scenario assessments to demonstrate the application of performance-based concepts to the analysis and design of FGS.

2 References

2.1 ANSI/ISA-84.00.01-2004 (IEC 61511 Mod), Functional Safety: Safety Instrumented Systems for the Process Industry Sector, Parts 1, 2 & 3, International Society of Automation, Research Triangle Park, NC, 2004.

2.2 NFPA 72, National Fire Alarm Code, National Fire Protection Association, 2007.

2.3 EN 54-2: 1997 Fire Detection and Fire Alarm Systems Part 2: Control and Indicating Equipment.

2.4 HSE Offshore Fire and Explosion Strategy – Issue 1; http://www.hse.gov.uk/offshore/strategy/fgdetect.htm.

2.5 CCPS/AIChE, Layer of Protection Analysis: Simplified Process Risk Assessment, First Edition, New York, 2001.

2.6 CCPS/AIChE, Guidelines for Chemical Process Quantitative Risk Analysis, Second Edition, New York, 2000.

2.7 ANSI/ISA-TR84.00.02, Safety Instrumented Systems (SIS) – Safety Integrity Level (SIL) Evaluation Techniques, International Society of Automation, Research Triangle Park, NC, 2002.

2.8 IEC 61511 Functional Safety: Safety Instrumented Systems for the Process Industry Sector, Parts 1, 2 & 3.

3 Abbreviations and Acronyms

1ooN – One out of N Voting



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 14 -


1oo2 – One out of Two Voting

2oo2 - Two out of Two Voting

2oo3 – Two out of Three Voting

MooN – M out of N Voting

AIChE – American Institute of Chemical Engineers

ANSI – American National Standards Institute

BPCS – Basic Process Control System

CCPS – Center for Chemical Process Safety

CWA – Weighed Average Consequence

E/E/PE – Electrical/Electronic/Programmable Electronic

ERPG – Emergency Response Planning Guideline

ESD – Emergency Shutdown

IEC – International Electrotechnical Commission

IDLH – Immediately Dangerous to Life and Health

IPL – Independent Protection Layer

ISA – International Society of Automation

FGS – Fire & Gas Systems

LEL / LFL – Lower Explosive Limit / Lower Flammability Limit

LOPA – Layers of Protection Analysis

NFPA – National Fire Protection Association

OEM – Original Equipment Manufacturer

PFDavg – Probability of Failure on Demand Average

PHA – Process Hazards Analysis

PPM – Parts Per Million

QRA – Quantitative Risk Assessment

TNT – Trinitrotoluene

SIF – Safety Instrumented Function

SIL – Safety Integrity Level



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 15 - ISA-TR84.00.07-2010


SIS – Safety Instrumented System

VCE – Vapor Cloud Explosion

4 Definitions

4.1 FGS Effectiveness - The ability of the FGS to perform its intended safety actions in a demand condition. It is dependent on a number of factors associated with design, installation, site-specific operating conditions, and maintenance. FGS effectiveness is the product of detector coverage, FGS safety availability, and mitigation effectiveness.

4.2 Detector Geographic Coverage - The fraction of the geometric area (at a given elevation of analysis) of a defined monitored process area that, if a release were to occur in a given geographic location, would be detected by the release detection equipment considering the defined voting arrangement.

4.3 Detector (Scenario) Coverage - The fraction of the release scenarios that would occur as a result of the loss of containment from items of equipment of a defined and monitored process area that can be detected by release detection equipment considering the frequency and magnitude of the release scenarios and the defined voting arrangement.

4.4 FGS Safety Availability - The availability of the fire and gas function designed to automatically mitigate the consequences of hazards. FGS Availability is equal to one minus the probability of failure on demand (PFDavg) for the FGS function.

4.5 Mitigation Effectiveness – The probability that the results of activating the final element(s) will mitigate the consequence of a defined hazard as expected (e.g., prevents a small fire or gas accumulation from escalating to a large fire or accumulation). The FGS must be activated in a sufficiently timely fashion to reduce the event severity. An FGS function may be ineffective such that the outcome of the event is not significantly different than if no detection/activation occurred. For example:

− The extinguishing system does not adequately control the fire.

− Isolation and/or bleed of pressure from the system does not occur fast enough to prevent a gas accumulation from reaching the catastrophic cloud size.

− Notification appliances are not energized soon enough to allow evacuation of personnel.

− Personnel do not evacuate or cannot evacuate a facility as planned.

The mitigation effectiveness of the FGS may be accounted for in different ways, depending on the risk analysis technique being used. For simplified analysis, many users do not consider the FGS as an independent protection layer (IPL) if the FGS effectiveness is expected to be less than 90% (ref 2.5). In these cases, the risk reduction strategy is based on potential impact of loss of containment without consideration of any FGS. When FGS is considered as an IPL, the user evaluates the consequence severity resulting from the FGS operation to ensure that the event outcome is acceptable. Mitigation effectiveness is an important consideration in the assessment of this secondary consequence. For instance, by the time a deluge system operates, some damage has already occurred. A simplified analysis would consider the mitigative effectiveness in the assessment of the secondary consequence severity. For advanced analysis, the mitigation effectiveness would be explicitly included in the event trees.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 16 -


4.6 1ooN Voting Arrangement – Implementation of 1ooN (where N > 1) voting in an FGS is such that upon activation of any single detector in a monitored area with multiple detectors, the logic solver commands specified safety action(s) to occur.

Note: This arrangement tends to provide a higher level of safety in that a dangerous undetected failure of a single detector will not inhibit the required safety action once the hazard is detected by any second non-failed detector. This arrangement also provides a relatively higher level of exposure to spurious activation of the FGS because a false alarm signal generated by any single detector will cause safety action(s) to occur when no hazard is present.

4.7 MooN Voting Arrangement - Implementation of MooN (where N > 1) voting in an FGS is such that only upon activation of any M or more detectors in a monitored area, the logic solver commands specified safety action(s) to occur.

5 Risk Concepts in FGS

This technical report is not intended to address hazards and risk analysis in detail. Such analysis could use qualitative, semi-quantitative, and quantitative methods to estimate risk. Hazards and risk analyses are often used to identify loss-of-containment events due to process deviation from normal operation. In contrast, most FGS functions are specified to address the risk of loss of containment due to equipment mechanical integrity problems. Consequently, many FGS functions are identified through studies focusing on fire protection and control of hazardous environments rather than process hazards analysis. Regardless of how the need for these functions are identified, an FGS is important to an overall risk management strategy and may be required by insurers or governing authorities.

Risk analysis evaluates risk of identified hazardous events and allocates risk reduction to safety functions that are specifically designed to address these events. Although a variety of methods are used with the process industries, an increasingly common method is Layer of Protection Analysis (LOPA). LOPA is an established method for evaluating hazardous event propagation and assessing the capability of safety functions in reducing event risk. An important objective of LOPA is to ensure adequate independence and separation of the initiating causes from independent protection layers to minimize common cause, common mode, and systematic failures.

However, LOPA does have limitations, which become clear when examining FGS functions. LOPA typically considers only two possible states for a candidate protection layer: success or failure. If the protection layer fails, a hazard could occur. If the protection layer succeeds, the propagation of the hazardous event is halted and no hazard results. While this is an appropriate assumption for many independent protection layers, it is not suitable for FGS since they typically do not stop the hazardous event from occurring. Instead, a successful FGS function prevents an already bad situation from getting worse.

This technical report presents a simple risk model to address the analysis of detector coverage and FGS safety availability, allowing these factors to be explicitly considered in the risk assessment. This report also presents a two-step evaluation of consequence: i) the consequence without FGS installed and ii) the consequence reduction with FGS installed. This model uses an event tree to illustrate the risk analysis of identified initiating events from the initiating cause(s) to final outcome(s). For FGS, the event tree (Figure 1) considers three aspects of FGS effectiveness: detector coverage, FGS safety availability, and mitigation effectiveness. The event tree branches represent the probability of success and the probability of failure of these aspects -- the mathematical complements.

The event tree begins with a hazard scenario based on loss of containment within an area of concern and follows the propagation of the scenario through the success (yes) / failure (no) of each aspect contributing to effectiveness. Quantitative analysis is then used to report the relative likelihood of each potential outcome. Risk assessment determines the tolerability of the potential outcomes based on consequence severity and the likelihood by comparing the outcome frequency and consequence severity to the user



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 17 - ISA-TR84.00.07-2010


risk criteria. Part 3 of ANSI/ISA-84.00.01-2004 and IEC 61511 provide examples of different types of risk criteria that can be used to support various hazards and risk analysis methods.

Detector Coverage

FGS Safety Availability

Mitigation Effectiveness Likelihood

Safety Consequence Contribution

Yes 1 7.20E-01 1 0.72Yes 0.9

0.8 0 0.00E+00 3 0.00Loss of Containment No

1 0.1 8.00E-02 3 0.24

No0.2 2.00E-01 3 0.60

Weighted Average Consequence 1.56

Figure 1 FGS Effectiveness Model

The first aspect of FGS effectiveness is the probability that the release is detectable given the detector layout and chosen voting arrangement. For example, if action is taken upon activation of two or more gas detectors, the release is detectable only if the scenario involves a gas cloud that covers at least two detectors in the array. Loss of containment places a demand on the FGS, requiring its sensor array to detect the hazardous condition and to initiate required action. Failed detection allows the hazardous condition to escalate to a larger magnitude event. This escalated hazard may or may not be detectable by other detectors in the FGS; and if detectable, the FGS may or may not be effective in mitigating the larger hazard. This complexity has not been incorporated into the risk model in this technical report. For the sake of simplicity, it is assumed that a hazardous event that is not detected due to inadequate detector coverage results in an unmitigated hazard that is beyond the capability of the FGS to effectively mitigate.

The second aspect of FGS effectiveness represents the probability of successful FGS activation upon a detected release. FGS functions are comprised of sensor(s), logic solver(s), and final element(s). Successful activation is assumed to result in a successfully mitigated hazard. Failure of the FGS function to operate on demand results in escalation of hazard. Quantification of the probability of failure on demand can be performed using the techniques presented in ISA-TR84.00.02 (ref 2.7).

The third aspect is the mitigation effectiveness, which has a significant impact on the event outcome and should be carefully considered when evaluating FGS effectiveness. The design intent of an FGS is typically not to prevent a hazardous condition from initially occurring, but rather to reduce (or mitigate) the consequences to a lower level. A small fire is prevented from becoming a large fire that can escalate into a catastrophic consequence. A small gas release that presents a toxic and/or fire hazard is prevented from becoming a large gas accumulation that could result in a catastrophic consequence. Therefore, the residual risk associated with successful FGS operation needs to be considered in the overall determination of risk acceptability, as well as the probability of FGS failure leading to larger consequences.

There will be situations in which a detected fire or gas release with successful activation of the FGS function will not result in complete or effective mitigation. The success or failure of the mitigation system is related to magnitude of the event being mitigated and the limitations of the mitigation strategy itself. Mitigation effectiveness is high when detection of the loss of containment occurs soon enough to allow the desired safety action to be taken prior to escalation of the hazard. Late activation of the FGS (possibly



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 18 -


due to inadequate detector coverage or one or more FGS component failures) would likely result in a hazard magnitude beyond that for which the FGS was designed.

Mitigation effectiveness may be accounted for in different ways depending on the risk analysis method being used. For simplified analysis, many users choose to exclude FGS from consideration as a protection layer due to the uncertain or unpredictable outcome of FGS action. When an FGS is considered a protection layer, users often consider mitigation effectiveness in assessing the residual or secondary consequence of successful FGS action. For instance, when a deluge system operates, it may not completely mitigate the fire to a tolerable consequence severity. In this case, the risk analysis would estimate the consequence severity, taking into account the mitigative effectiveness of the deluge system. This consequence severity may not be significantly different from the consequence without the deluge system, depending on the mitigation effectiveness.

For advanced analysis, the mitigation effectiveness would be explicitly included. However, the scope of this technical report is limited to assessing the impact of detector coverage in situations in which the FGS action is considered effective in limiting the hazardous event severity. Consequently, the mitigation effectiveness has a PFD = 0 for the success state in Figure 1. Detailed guidance on assessing mitigation effectiveness is not included in this report.

The event-tree model can also be used to assess the overall potential risk associated with the hazard scenario by determining the weighted average consequence (Figure 1). This is accomplished by multiplying the likelihood of each outcome by its consequence severity ranking and then summing each outcome’s contribution. The weighted average consequence and the hazard scenario likelihood yield the overall scenario risk, which can be compared to the user’s risk criteria. For example, the risk can be described by:

Risk = CWA x Funmitigated x PFD(IPL1) x PFD(IPL2) ... x PFD(IPLn)

Where:

CWA = Weighed average consequence

Funmitigated = Frequency of hazard in events per year

PFD(IPLn) = Probability of Failure of Independent Protection Layer

Once the risk is understood, means can be identified to reduce this risk if necessary, such as taking steps to reduce the frequency of the unmitigated event, to improve the independent protection layers that prevent the event, or to improve the FGS effectiveness to reduce the weighted average consequence.

Alternatively, a quantitative risk analysis (QRA) can be used to make decisions about the risk reduction strategy (ref 2.6). The QRA should be based on a comprehensive risk analysis and consequence modeling for the hazardous event under consideration. However, the application of QRA is beyond the scope of this technical report, so further discussions will focus on the use of simplified risk analysis.

Where possible and practical, other instrumented safety systems, such as safety instrumented functions, should be designed to prevent loss of containment. The development of a methodology to allow the allocation and verification of the risk reduction capability of an FGS function should not be construed as an endorsement of the use of an FGS function in lieu of a properly designed safety instrumented function. Thus, if risk analysis determines that two orders of magnitude of risk reduction is required to address a high pressure scenario in a vessel, a safety instrumented function closing inlet feed to the vessel upon detection of high pressure with a risk reduction of two orders of magnitude is preferable.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 19 - ISA-TR84.00.07-2010


This technical report does not endorse addressing the above hazardous event with a safety instrumented function achieving one order of magnitude in combination with an FGS function providing the remaining one order of magnitude in risk reduction. This technical report focuses on the implementation of FGS to protect people and the environment when the process is operating normally, but loss of containment has occurred due to such factors as corrosion, erosion, leaking gasket, and tubing failure. Thus, consider a different scenario where the pressure in the vessel is within tolerable limits (e.g., not high) and loss of containment has occurred. In this scenario, an FGS function is an appropriate choice for reducing the risk, because there is no potential for implementing a safety instrumented function to prevent loss of containment.

It is advisable to use an approach that ensures:

• Loss of containment is minimized through implementation of preventive systems and an equipment mechanical integrity program; and.

• FGSs are designed and managed to be effective in reducing the impact of loss-of-containment events.

6 Performance-based FGS Lifecycle Process

Design and implementation of an FGS can be performed in a manner that is consistent with the underlying principles of both ANSI/ISA-84.00.01-2004 and IEC 61511. The safety lifecycle (Figure 2) can form the basis for the FGS design and management process. Prescriptive approaches for the design of some/all components of an FGS are provided in recognized and generally accepted good engineering practices (ref 2.2 and 2.3). In complex release scenarios, especially those involving high-risk exposure (e.g., offshore oil & gas installations), supplementing these practices with performance-based analysis can result in an improved design with more effective coverage and lower probability of FGS failure. It is ultimately the user’s decision on when to apply performance-based approaches. Nothing in this technical report suggests the prescriptive practices are invalid or that they should not be followed as required by local jurisdictional authorities. The concepts underlying a performance-based approach are suitable to the analysis and design of FGS, and these principles can be used effectively in conjunction with other good engineering practices.

Figure 2. FGS Safety Lifecycle Steps



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 20 -


Step 1 – Identify Areas of Concern

FGS installations in the process industries are typically designed to address hazards associated with loss-of-containment events caused by such factors as leaks, corrosion, and erosion. In many cases, FGSs are only expected to provide general process area coverage. Under these circumstances, the FGS design is based on simple prescriptive practices (e.g., references 2.2 and 2.3).

Screening can be used to identify areas of concerns within the process unit where performance-based design may be beneficial. A screening analysis is used to determine whether there are flammability or toxicity issues associated with the process equipment under consideration. Screening may be conducted using a variety of techniques, including, but not limited to process hazards analyses, fire risk assessments, and/or fire hazard analyses. The intent of the screening analysis is to quickly qualify those areas that may require additional risk reduction through an FGS prior to conducting the more detailed risk analysis described in subsequent sections of this technical report.

The screening analysis should proceed by considering each potential leak source, as well as occupied areas, ignition sources, and high-value assets. The leak sources include any vessels and equipment within the area of concern that contain the flammable or toxic material. Ignition sources could include any buildings containing general-purpose electrical devices, open flames, and/or hot surfaces.

The screening analysis should consider various parameters that affect risk on a source basis to determine if FGS should be considered:

• Leaked material flammability/toxicity

• Leaked material flash point

• Leaked material temperature

• Leaked material pressure

• Source leak frequency

• Source leak size

• Ignition sources distance to occupied areas and high value assets

• Likelihood of accumulation reaching occupied areas or areas of high-value assets

• Environmental conditions

Optimally, the screening analysis should be performed using checklist criteria, and the analysis should be formally documented. The result of the screening analysis should be a listing of all sources, the risk parameters considered for those sources, and judgment as to whether further FGS analysis is required or is not required (screened out). Once the need for an FGS has been identified by the screening analysis, a more detailed analysis of the risk in each area of concern is conducted.

Step 2 – Identify Risk Scenarios

Focused studies are generally used to identify global release scenarios for which FGS functions are designed. A risk analysis to determine effectiveness requirements for the FGS design begins with identifying one or more risk scenarios that the system is intended to protect against. This should include scenarios identified in risk assessment techniques of the process along with a checklist review of leak sources and sensitive areas. This step may identify sources of flammable gas, such as corrosion-initiated leaks, flange gasket leaks, and small diameter tubing failures. The FGS analysis should identify the leak



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 21 - ISA-TR84.00.07-2010


size, flow rate, and location in sufficient detail to determine the potential physical effects of the release, such as fire size or gas dispersion characteristics. Since many potential scenarios will be similar, generic scenarios are often developed that are representative of more than one equipment location. Factors considered during the analysis include but are not limited to:

• Material flammability

• Toxicity

• Phase

• Flash point

• Temperature

• Pressure

• Location/elevation of process equipment

• Release orientation

• Likelihood of a release

• Environmental conditions

• Occupancy levels

When identifying scenarios to establish FGS design requirements, it is important to consider the design limitations of any automatic FGS activation. Ensure that the scenarios are appropriate given the limitations of the system. For example, detector location/placement for a fire suppression system designed to extinguish an incipient fire will need to be designed with detector location and placement sufficient to detect fire scenarios. This effort results in a list of scenarios requiring further consequence severity and likelihood analysis.

Step 3 – Analyze Consequences

Once a fire and gas scenario is identified, consequence analysis should be undertaken to determine the extent of the hazard. This usually takes the form of a model that predicts the physical effects of the release, but could also be based on qualitative (e.g., PHA-team judgment) or semi-quantitative techniques. The application of consequence modeling is not addressed in detail in this technical report. Refer to CCPS ref 2.6 for more guidance.

Fire

This procedure is predicated on the principal that detection of a turbulent diffusion fire should be such that action can be taken, if required, during the incipient stages of the fire to maximize safety and prevent commercial losses. For fire scenarios, the extent of fire and thermal radiation effects are usually required to determine detector layout requirements. Fire detectors using optical or visual detection means will be sensitive to the amount of radiant heat output from the fire but limited by a threshold amount of radiation received at the detector below which a fire cannot be detected. Consequence models predict these physical effects as a function of orientation and distance from the fire. Results of fire models provide the basis to determine the number and location of fire detectors necessary to detect a given fire scenario.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 22 -


The fire analysis should identify a threshold amount of radiant heat output that can result in a potential hazard or escalation of a hazard based on the type of processing equipment and layout. The criteria should be used as the end-point for the fire consequence analysis.

Gas

For a gas release the dispersion of the release in unconfined or semi-confined areas is required to understand the extent of combustible gas concentrations. Gas concentration profiles are required to determine optimal detector location and placement strategy.

Dispersion analysis using similarity models is usually adequate for most locations in which dispersion is only affected by momentum jet effects as well as atmospheric effects. Dispersion modeling results should be generated for concentrations at or below the threshold for alarm for gas detectors. Similarity models and other simplified empirical models can be misleading when studying gas dispersion. Simplified models can yield vastly different concentration profiles than full Computational Fluid Dynamics models. In most cases, ventilation and geometry dominate the dispersion, so most simplified/empirical models cannot accurately capture this information to a sufficient resolution. Further, simplified models frequently do not account for turbulence or the interaction with solid surfaces. These play a significant role in the shape, size, and concentration of the vapor cloud and thus need to be evaluated with sufficient resolution. It cannot be assumed that the worse case scenario has been evaluated when in many cases it has not. Gas dispersion in confined spaces or enclosed volumes may require special consequence analysis methods to examine concentration profiles under the influence of forced ventilation systems rather than atmospheric effects.

For flammable/combustible gas hazards, the gas concentration is the primary means of potential hazard detection; however, the actual hazard may include one or more of the following:

- Vapor cloud explosion (confined or semi-confined)

- Fire

- Toxic inhalation exposure

The hazard is a function of volume of hazardous material, concentration, and level of confinement in the case of vapor-cloud explosion. As the volume increases, the likelihood of a greater severity hazard increases. Therefore, the detector placement is predicated on criteria to detect the gas concentration early enough that action can be taken prior to the release becoming a larger gas cloud of potentially higher concentration. With earlier activation, the hazard potential may be lowered (e.g., maximum explosion overpressure that could be tolerated without severe damage or loss of life). The development of these criteria is addressed in Ref 2.6 but is outside the scope of this technical report.

In the case of vapor-cloud explosions, care needs to be taken when specifying and determining the potential maximum overpressures. Most models have been shown to be limited in application. TNT equivalency methods are not transferable to vapor-cloud explosions, yet many frequently do this in error. Physics-based models are preferred. Damage estimates should not be based upon TNT explosion overpressure data in the near field because the TNT model assumes detonation while the vapor cloud ignition generally results in deflagration. Use of the TNT model for vapor clouds may result in significant error in the damage estimate.

Escalation

The design intent of fire and gas detection is usually to mitigate an already hazardous situation. This is typically accomplished by limiting the extent of the hazard or providing for additional time before escalation. The additional time will allow for effective emergency response including containment, evacuation of personnel to a safe location, or other actions appropriate to the specific situation.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 23 - ISA-TR84.00.07-2010


In addition to an incipient fire or gas release scenario, the gas consequence analysis should include an assessment of the potential outcome when the FGS does not work when required. This scenario would consider whether it is possible for the hazardous event to escalate into a larger, more severe consequence than the FGS is intended to protect against. This severe consequence is the potential outcome of FGS failure due to lack of coverage or lack of FGS availability.

Toxicity

For process units, especially those that deal with large quantities of highly toxic substances, the worst credible scenario may be uncontrolled release to the atmosphere of a toxic cloud. Facilities which deal with these substances generally invest in equipment to handle the substance such as vents to flares, scrubbers, incinerators, or other containment vessels. The failure of this equipment, its controls, or the piping system itself (leaks, erosion, and corrosion), can lead to a potential release. Gas-detection systems are often utilized to help mitigate this potential hazard.

It is common practice for companies dealing with toxic gas releases to conduct dispersion modeling of credible scenarios to determine the potential effect of a given release. This should be done by competent individuals and is beyond the scope of this document. Dispersion modeling of a toxic cloud and a flammable cloud is similar. Typically, it will require plant and surrounding-area topography information, leak rate information, plant-weather data for at least one year if not more, and toxicity information. Toxicity concentrations are analogous to Lower Explosive Limit (LEL). Each user must decide what criteria it will use to determine potential hazards. ERPG numbers (Emergency Response Planning Guidelines) or IDLH numbers (Immediately Dangerous to Life and Health) have been used by some, but other criteria may be applied.

It should be recognized that a cloud of some toxic substances (for example, chlorine) has the potential for doing harm at a much greater distance than most flammable clouds. Many facilities will use “green buffer zones” around them to help protect the communities from releases. Dispersion modeling typically calculates concentrations at unit perimeters, plant fence lines, and the end of “green buffer zones.” It should be noted that encroachment of business or communities on these “green buffer zones” or the sale of a unit in the plant to another business has a high potential for impacting the conclusions of given dispersion models.

This technical report does not provide any examples or detailed guidance on the detection of toxic gas. This is not intended to indicate that toxic gas detection should be excluded from the application of performance-based design, but rather that the unique issues and factors associated with toxic gas detection are not addressed in this technical report.

Other Consequence Modification Factors

Occupancy, time at risk, and ignition probability are other factors that could be considered when assessing risk to personnel safety. These factors should be justified through scenario-specific analysis that ensures these factors are reasonable and appropriate for the scenario under consideration. For example, occupancy likely changes as plant personnel respond to potential or realized loss of containment. In contrast, the likelihood that a release is flammable is dependent on the chemical properties, release size and location, and dispersion potential. When flammable liquids or gases are involved in the scenario, it is possible to estimate the potential for a fire or explosion using qualitative, semi-quantitative, or quantitative methods. Ignition probability data for combustible liquids, flammable liquids, and flammable gases is provided by CCPS (ref 2.6). Guidance on determining appropriate values for these factors is outside the scope of this technical report.

Step 4 – Analyze Hazard Frequency

Prior to considering the benefit of an FGS or establishing its design requirements, a decision can be made about the tolerability of the unmitigated fire and gas risk. This requires information about the



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 24 -


frequency of the release that causes the hazard. Release frequency can be determined by application of databases of equipment failure rates to the identified scenario, but could also be based on qualitative (e.g., PHA-team judgment) or semi-quantitative techniques.

In many cases, a risk scenario arises from equipment damage and failure mechanisms, such as general corrosion, that are well-understood. In these cases application of industry failure rate data should be considered. For example, such databases include leak frequencies for components, such as piping, flanges, pressure vessels, and compressor seals. Methods for adjusting industry-failure data based on site-specific inspection and maintenance histories are also available.

In some cases, the hazard scenario may arise as a result of unique factors that may require a scenario-specific analysis. An example is an uncontrolled release of a flammable gas in gas production wells due to produced sand causing erosive damage to flowlines. In this case, industry failure rate databases are of limited value. Prior experience of the site and a considerable amount of judgment may be required to establish the frequency of the release scenario.

Cumulative Frequency

It is often the case that fire & gas detection is provided in an area to detect release from multiple sources of potential release. In these cases, there should be some effort taken to aggregate the frequency of potential hazard scenarios in the area of concern. This is accomplished by accounting for a number of equipment leak scenarios with similar consequences and generating sum-total or cumulative frequency of release. This aids in minimizing the number of scenarios that need to be individually analyzed.

Step 5 – Perform Unmitigated Risk Assessment

The most conservative approach to risk analysis is to assume that the FGS is unavailable in the event of a release. The unmitigated consequences of the release scenario with the frequency of the scenario should be compared against user risk criteria. This can be accomplished through application of a risk matrix with sufficiently quantitative information regarding consequence severity and likelihood categories. Alternatively, quantitative risk criteria can be stated such as maximum individual fatality or societal risk. If the risk criteria indicate that the unmitigated risk scenario is tolerable, there is no need for additional risk reduction unless otherwise mandated by local legal requirements.

If this is the outcome of this step, additional analysis of performance-based requirements for FGS design is optional. Design of fire- and gas-system components as well as sensor placement should be based on existing methods for system design, such as the applicable national standard/industry guidelines and relying solely on judgment of a qualified fire protection engineer for subjective items such as sensor placement.

Step 6 – Identify FGS Risk-Reduction Requirements

If the scenario poses risk that is higher than the risk criteria, additional risk reduction should be considered. The required risk reduction may be defined in various ways, such as a risk reduction factor (RRF), the number of orders of magnitude in required risk reduction, or the maximum probability of failure on demand. Achieving risk reduction significantly beyond approximately one order of magnitude may not be practical for many FGSs, because the achieved risk reduction is usually limited by detector placement, achieved coverage and/or mitigation effectiveness rather than FGS safety availability. Ensuring FGS effectiveness requires consideration of the detector coverage, FGS safety availability, and mitigation effectiveness.

Note: The risk of the mitigated hazard assuming 100% detector coverage, FGS availability and mitigation effectiveness (i.e., perfect FGS operation) may still be intolerable. This could occur if the frequency of the initiating event or the mitigated consequence severity is high. In these cases, other risk reduction means should be utilized to meet the risk criteria.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 25 - ISA-TR84.00.07-2010


Step 7 – Develop Initial FGS Design

Initial design of the fire and gas system components as well as sensor placement should be based on existing methods for system design such as the applicable national standard/industry guidelines and on the judgment of a qualified fire protection engineer. Initial FGS design is outside the scope of this technical report.

Step 8 - Assess Detector Coverage

The proposed location of fire detectors and/or gas detectors is assessed to determine how effective the proposed array of detectors with a given voting arrangement will be in detecting the hazard at a level that will initiate a specified safety action. An assessment of detector coverage involves analysis of the potential sources of fire and gas within a given monitored process area. There are (at least) two possible approaches that can be used: geographic coverage and detector (scenario) coverage. In either case, the analytical method to determine coverage could range from simple lookup tables to rigorous computer modeling of physical phenomena. Each has advantages and disadvantages as discussed in Annex B.

The result of this step provides detector coverage factors that can be applied during the risk analysis developed in Step 10 and to determine, in part, the benefit of the FGS function in reducing risk.

Step 9 - Assess FGS Safety Availability

Verification of the FGS safety availability requires a summation of the sensor PFDavg + logic solver PFDavg + final element PFDavg, where the PFDavg is a function of the dangerous undetected failure rate of each device, the voting architecture of each device grouping, and the proof test interval of the devices. Verification can be accomplished using the techniques presented in ISA-TR84.00.02 for analysis of safety instrumented functions (SIFs). However, three significant differences between SIFs and FGS functions should be noted to ensure an accurate assessment of FGS safety availability.

First, proper definition of the FGS function is critical to determining an accurate assessment of the FGS safety availability. The quantity of detectors and possible voting schemes of the FGS function are directly related to the detector design basis, which specifies the gas cloud or flame size that the detector array can detect with the goal of mitigating further accumulation such that the gas cloud or flame size cannot escalate to a catastrophic event. Detector voting schemes cannot be determined until a detector design basis is established (e.g., sensor array should be designed to detect an accumulation of combustible gas with a maximum diameter of 5 meters). If an area of concern contains three detectors, the ability of the detectors to detect the event within the required time will determine whether the voting scheme is 1oo1, 1oo2, 1oo3, or 2oo3. Thus, if the postulated 5-meter gas accumulation is moved throughout the area of concern and, at any one time, only one detector can “see” the accumulation, the voting scheme is 1oo1. The other two detectors cannot “see” the accumulation volume in question and thus should not be considered as redundant measurements for the hazard scenario.

FGS applications can be designed to take action when a single sensor goes into alarm. However, most systems implement some form of voting of multiple sensors in an area of concern to reduce the likelihood of system activation due to a single sensor failure. Typically, two or more sensors in an area of concern must go into alarm before automatic action is taken. While this reduces the probability of nuisance trips due to a single sensor failure, it also reduces the probability of successfully responding to a hazardous event. It is less likely for two or more detectors to be in the area of concern, assuming the layout of detectors has not been changed with the implementation of voting.

Second, one should consider the source of the failure rate data being used in the PFDavg calculation itself. Failure-rate data is readily available from a variety of data sources (vendor data, industry data, site specific data). However, if one looks closely, this failure-rate data as presented typically includes an assumption that the device will operate in a fail-safe, de-energize-to-trip mode. Most FGSs operate in an energize-to-trip arrangement. Consider a failure mode in which a logic solver is unable to energize its



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 26 -


output. In a de-energize-to-trip scheme, this type of failure will prevent one from initially opening a fail-closed valve during startup. Thus, it would be classified as a safe failure by the manufacturer. However, in an energize-to-trip scheme, this type of failure will prevent one from opening a suppression valve during a demand. Therefore, it would be classified as a dangerous failure. Thus, one needs to carefully review the failure rate data being considered for use in the calculations.

Lastly, FGS designs typically involve actuation of final elements that might be controlled by other systems, such as isolation valves controlled by the safety instrumented system logic solver. Any equipment that is required for FGS operation should be included in the PFDavg calculation.

Step 10 - Perform Mitigated Risk Assessment

The event-tree model (Figure 1) is used to determine the overall FGS effectiveness considering detector coverage and FGS safety availability. Coverage factors from Step 8 and safety availability factors from Step 9 are required as an input to the model as well as the overall frequency of the initiating event for the scenario under evaluation. Application of the event tree will result in the estimation of the likelihood and consequence severity for each potential outcome, allowing comparison of the scenario risk to the user risk criteria.

Step 11 – Modify FGS Design

The design is modified as required to reduce scenario risk. Changes to consider include increasing detector coverage by adding sensors, repositioning sensors,, or making changes that improve FGS safety availability, including hardware changes or increasing functional testing.

The number of detectors, detector types (point vs. line of sight), and voting schemes can be modified in combination with FGS logic-solver arrangements to improve integrity. In addition to achieving required availability, FGS could also be designed to optimize cost of ownership over the installation lifetime. While cost of ownership is a very important issue, it is outside the scope of this technical report.

After design modifications are proposed, the analyst should iterate Steps 8 through 10 until the fire and gas risk in the monitored area is reduced below the risk criteria.

Although spurious trip calculations are beyond the scope of this technical report, final voting schemes should be selected to minimize spurious trips. Typical solutions include designs with 2ooN voting of detectors. However, as noted in Step 9, the use of voting schemes can negatively impact detector coverage and mitigation effectiveness. So, careful consideration of effectiveness is essential when optimizing the FGS design to address spurious trip potential.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 27 - ISA-TR84.00.07-2010


Annex A – Application Example Problems

This Annex contains example problems along with worked solutions from a few typical process-industry applications of FGS.

A.1 Application Example – Fire Detection and Suppression in Oil and Gas Wellbay Module

This example involves fire detection in a process module of an integrated offshore oil and gas production platform. The fully enclosed module handles flammable hydrocarbon liquids and gases under high pressure. An ignited release of flammable material potentially presents a significant hazard to personnel located on the platform.

Module Information

The module is a fully enclosed rectangular shape. It is 40 feet long, 12 feet wide, and 12 feet high (12.2m by 3.7m by 3.7m). The module includes one well-head assembly (i.e., ‘Christmas tree’) located as shown in Figure A.1 in the middle of the module on the short dimension and 10 feet from one wall in the long dimension. For simplification of this analysis for illustrative purposes, other equipment including piping has been disregarded.

Figure A.1 Example - Offshore Wellbay Module

Step 1 – Identify areas of concern

The screening process employed by the operator of this facility includes an evaluation of each process area, including the following factors:

• Type of material processed

• Process pressure and temperature

• Equipment potentially involved in a fire

• Occupancy of the facility

• Electrical area classification

Because this is a process module containing flammable gases processed at high pressure with high-value processing equipment and the potential presence of personnel on the platform, the screening criteria determined the need for fire detection.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 28 -


Step 2 - Identify Risk Scenarios

The hazard analysis identified the potential for leaks from the wellhead. A range of release sizes are considered credible scenarios. For simplification of this analysis for illustrative purposes, the analysis of only one risk scenario is included here. The scenario involves a pinhole leak from the wellhead resulting in a potential turbulent jet fire in the module. The cause could be corrosion, erosion, or mechanical failure of equipment. Although there are no strong sources of ignition located in the module (e.g., open flames or unclassified electrical equipment), the possibility of ignition could not be discounted. This is the most likely release scenario that will place a demand on the fire-detection system. Other scenarios (not analyzed in this example) include a large leak (e.g., flange failure), and a rupture of a process connection to the wellhead.

The leak to be analyzed is a ¼-inch (6 mm) equivalent hole diameter releasing flammable gas (approx. as methane) at 1200 psi and 100°F (8300 kPa and 38°C). The assumed orientation of the fire is a horizontal jet flame.

Step 3 - Analyze Consequences

In this example a range of consequence analysis options was considered, including: qualitative estimates, simplified hazard correlation tables, and turbulent diffusion fire modeling. In this case a fire model was selected to analyze the consequence of this fire. An example jet fire model is provided in ref 2.6.

Results of the jet fire model show the potential for a jet flame envelope of dimensions 6 feet long and approximately 1 foot wide (2 m by 0.3 m). Figure A.2 illustrates the output of the fire model, including the flame envelope. The orientation of the fire in this figure is arbitrary, and it was recognized that the actual hazard would extend outward from the wellhead and could be oriented in any direction.

The credible consequence of this scenario is a potential life-threatening injury to a single person if present in the wellbay module at the time of the release. Based on the expected personnel staffing philosophy and historical data, the occupancy of the wellbay module is considered no more than 10%.

Wellbay Module

Wellhead

Figure A.2 Fire-Model Results


In this example a range of frequency analysis options was considered including: qualitative estimates, simplified frequency lookup tables for generic situations, and quantitative analysis of industry failure and leak data for specific equipment items. In this case, the offshore industry maintains databases of equipment leak frequencies, and this database was queried for an appropriate leak frequency. Site-specific failure mechanisms were considered (e.g., erosive failure due to sand production), and the failure mechanisms were deemed consistent with typical, industry-average equipment.

The likelihood of a pinhole leak in a single wellhead producing oil and gas in the identified temperature and pressure range was found to be 5E-3 per wellhead-year. A probability of ignition of 30% for high-



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 29 - ISA-TR84.00.07-2010


pressure gas releases was used based on recommended practices for offshore hazard and risk analysis. The frequency of a fire event is therefore 1.5E-3 per year for a single wellhead. No other protection layers were identified that would reduce the frequency of the hazard.

Funmitigated = 1.5E-3 per year


Based on the user’s risk criteria, the likelihood of this consequence severity should be reduced to less than 1 chance in 10,000 per year (10E-4 per year individual risk of fatality), and the target likelihood has been adjusted based on the occupancy of the module.

The frequency of the hazard scenario without benefit of a fire detection system was calculated as 1.5E-3 per year (1.5 chance in 1,000 per year). Application of the FGS risk model is shown below.

Detection Coverage




Yes 0 0.00E+00 0 0.00Yes 0

0 1 0.00E+00 1 0.00Hazard Scenario No

1 1 0.00E+00 1 0.00

No1 1.00E+00 1 1.00



= 1.5E-3 per year

The risk of the scenario is a factor of 15 higher than the tolerable risk level of 1E-4. Therefore, the risk criterion has not been satisfied for the unmitigated situation.

Step 6 – Identify FGS Risk Reduction Requirements

Based on the results of Step 5, a recommendation was made to design a fire-detection and automatic-suppression system that would reduce the risk by a factor of 15. Initial targets for fire-detector coverage were set at 97% and fire-detection/suppression system safety availability of greater than 98%. Note: This is a simplified example problem using multiple detectors with limited obstructions that yielded a high detector coverage percentage. Use of this methodology in a real process application has shown that this high detector coverage may not be achieved cost effectively.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 30 -


Detection Coverage




Yes 0.99 9.41E-01 0 0.00Yes 0.98

0.97 0.01 9.51E-03 1 0.01Hazard Scenario No

1 0.02 1.94E-02 1 0.02

No0.03 3.00E-02 1 0.03



= 0.06 x 1.5E-3 per year

= 9.0E-5 per year

This will result in risk of 9.0E-5, which will satisfy the risk criteria of no more than 1.0E-4 per year.

Note: The likelihood of the mitigated hazard (e.g., successful detection and activation of the suppression system) is calculated as 1.41E-3 per year with these parameters (0.94 x 1.5E-3 per year). The operator has verified that the consequence associated with this is related solely to minor equipment damage and downtime, and no safety hazard exists. The mitigated risk satisfies the risk criteria. This was used to simplify this example, but is not necessarily typical for an FGS.


The proposed fire-detection/suppression system design is based on expert judgment and/or good engineering practices through application of the requirements of national standard/industry guidelines. The design involves use of optical fire detection with two detectors placed in opposite corners of the module. The detectors are mounted near the ceiling and oriented toward the center of the module. Figure A.3 illustrates the design.

Figure A.3 Proposed Flame Detector Locations

The detectors generate a discrete alarm when a fire is detected. The alarm signal is received by a logic solver, which sends a discrete signal to activate a chemical suppression system. The suppression system is designed in accordance with national standards/industry guidelines for sizing such systems. The



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 31 - ISA-TR84.00.07-2010


operating company verified that the proposed design is adequate to suppress a fire caused by the proposed scenario. In addition to activation of the suppression system, the platform ESD system will be commanded to activate, which causes shut-in of the affected wellhead and blowdown of the platform.

Optical flame detectors will be set at a sensitivity that allows for detection of a 1-foot-by-1-foot (0.3 by 0.3 m) fire at a distance of up to 100 feet (30 m). This will provide adequate sensitivity to detect the hazard scenario of concern given the overall dimensions of the module and the proposed location of detectors.

The initial design did not specify whether any single detector in alarm state will cause the suppression system to activate (e.g., 1ooN voting arrangement), or both detectors are required to cause the suppression system to activate. Spurious activation of the suppression system is not hazardous, but it is an undesired event from an economic standpoint.

Step 8 – Assess Detector Coverage

Detector Geographic Coverage

The operating company selected an incipient flame-detection criterion, which was verified as sufficient to detect the identified fire scenario at distances well in excess of those between the wellhead and each flame detector. A computer model was used to analyze geographic coverage and generate coverage factors for both a 1ooN voting arrangement as well as 2ooN voting arrangement. Graphical output of the model is provided in Figure A.4.

Figure A.4 – Fire Detector Geographic Coverage

The results show that approximately 97 percent of the module is covered by 1 or more detectors. The area that is covered by both detectors is much less. This is due to obstructions associated with the wellhead that create locations that are in the field of view of only one detector. In addition, 3 percent of the module is not in the field of view of any of the two detectors, and this is due to blind spots in the corners of the module.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 32 -


Detector (Scenario) Coverage

The hazard scenario was analyzed by overlaying the hazard scenario on the field-of-view of each flame detector. A determination was made if each detector could sense the hazard given the size and shape of the fire as well as obstructions within the field of view of each detector.

A range of possible scenario outcomes was considered that addressed the possibility that the fire would extend outward from the wellhead and could be oriented in any direction. Eight different flame orientations were considered in the analysis. In each case the determination of single-detector coverage or two-detector coverage was made. A computer model was used to aid in computationally intensive nature of this method. Graphical output of the model is provided in Figure A.5.

Figure A.5 – Fire-Detector (Scenario) Coverage

The results show that 100 percent of possible hazard scenario outcomes are covered for 1ooN voting arrangement. This means that there is no possible orientation of the fire hazard that is not within the field of view of at least one detector. The results show that 88 percent of possible hazard scenario outcomes are covered for the 2ooN voting arrangement.

Results of detector (scenario) coverage method are higher than the results of detector geographic coverage method because the size and shape of the fire make it very likely to detect, given the location and orientation of the two detectors. It is very likely that both detectors would sense this hazard scenario, but possible that the jet flame would be oriented in a manner that the wellhead itself obstructs one detector’s view of the flame.

Step 9 – Assess FGS Safety Availability

The safety function was initially defined to include both detectors to sense the hazard. Thus, a 2oo2 voting architecture was employed. A single suppression valve has been included in the FGS function. In addition, it shall be assumed that functional testing of sensors and final elements occurs once per year.

Methods and sample calculations on how to calculate PFDavg are included in ISA-TR84.00.02 (ref 2.7) and have not been included in this technical report. Using simplified equations, the resultant PFDavg for the FGS function is 0.015 or an FGS safety availability of 1 – 0.015 = 0.985.

Step 10 – Perform Mitigated Risk Assessment

The frequency of the hazard scenario with consideration of the benefit of a fire-detection system (detector coverage and FGS safety availability) was calculated as shown in Figure A.6. The initial calculation was performed using the detector (scenario) coverage and 2ooN voting arrangement.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 33 - ISA-TR84.00.07-2010


Detection Coverage




Yes 1 9.23E-01 0 0.00Yes 0.985

0.937 0 0.00E+00 1 0.00Hazard Scenario No

1 0.015 1.41E-02 1 0.01

No0.063 6.30E-02 1 0.06


Figure A.6 Mitigated Risk Assessment


= 0.08 x 1.5E-3 per year

= 1.2E-4 per year

The weighted average consequence is reduced to no more than 8% of the unmitigated value. The design reduces the risk by a factor of 1/0.08, or risk reduction of about 12.

The overall likelihood of the hazard scenario was calculated as 1.2E-4 per year (1.2 chance in 10,000 per year). This is 20% above the maximum likelihood that was selected for this scenario of 1 chance in 10,000 per year (10-4 per year individual risk of fatality). Therefore, the risk has improved over the unmitigated design, but the risk criterion has not been satisfied with the proposed Fire-Detection/Suppression system design.

Note: The risk criterion used above has been provided as an example only and is not to be considered a recommendation or endorsement.


Since the risk criteria was not satisfied by the initial FGS design and 2ooN voting arrangement, the design parameters should be modified in order to meet this objective. Options that may be explored include the following:

• Adding one or more additional flame detectors to increase detector coverage

• Increasing the frequency of functional tests of the existing system design to increase FGS safety availability

Note: In this particular example, simply increasing the functional test frequency by itself will not result in an acceptable design. Thus, increasing functional test frequency should be evaluated in concert with addition of detectors. Change the voting arrangement of the flame detectors to 1ooN (e.g.,., either detector in alarm state will cause activation of the suppression system) to increase both the detector coverage and FGS safety availability, at the expense of increased frequency of spurious activation of the suppression system.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 34 -


Each of these options should be analyzed by repeating Steps 8 through 10 and determining which option provides the most effective safety solution when considering the risk criteria and costs of system design, installation, operation, testing, and maintenance.

A.2 Application Example – Gas Detection in Natural Gas Production Platform

This example involves combustible gas detection in an offshore natural gas production platform. This is a small platform that is open to the atmosphere and relatively unconfined. It is also a normally unmanned installation. The platform produces flammable hydrocarbon gas under high pressure. An ignited gas release presents a potentially significant hazard to personnel who may be on the platform conducting maintenance and other activities.

Facility Information

The platform is rectangular in shape and open to the atmosphere on all sides. It is approximately 50 feet in length, and 50 feet (15m by 15m) in width. The deck is comprised of grated material. The module includes nine wellheads located as shown in Figure A.7. For simplification of this analysis and for illustrative purposes, other equipment, including piping, instrument connections, and well-control panels have been disregarded. The fluid being processed has been approximated as methane gas for this example problem. Methane has a Lower Explosive Limit (LEL) of approximately 50,000 parts per million (ppm v/v) in air. The prevailing wind at this facility (about 70 percent of the time) is from the southeast, however several weeks a year (about 30 percent of the time), the wind essentially reverses direction and comes out of the northwest.

Figure A.7 Example – Offshore Gas-Production Facility

Step 1 – Identify Areas of Concern

The screening process employed by the operator of this facility includes an evaluation of each production platform to determine if gas detection should be employed. The screening analysis includes the following factors:

• Type of material processed

• Process pressure and temperature

• Potential leak sources of combustible gas

• Previous incidents in similar facilities



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 35 - ISA-TR84.00.07-2010


• Occupancy of the facility

• Electrical area classification

• Degree of confinement of process areas

Only one area of concern was identified for this facility - the entire production deck of the platform, as shown in Figure A.7.

Because this is a production facility containing flammable gases processed at high pressure with potential presence of personnel on the platform during maintenance activities, the screening criteria determined the need for combustible gas detection. A risk analysis was desired to determine if the unmitigated combustible gas hazard posed a risk high enough to warrant further risk reduction.

Step 2 - Identify Risk Scenarios

The hazard analysis identified a credible potential for leaks to occur from any of the nine gas wellheads. Credible scenarios include a range of release sizes. For simplification of this analysis and for illustrative purposes, the analysis of only one risk scenario is included here. The scenario involves a pinhole leak from the flowline due to erosive action of the fluid (e.g., sand production) resulting in a release of combustible gas on the platform. This is the most likely release scenario that will place a demand on the gas-detection system. Other scenarios (not analyzed in this example) include a large leak and a rupture of equipment.

The leak to be analyzed was idealized as a ¼-inch (6 mm) equivalent hole diameter releasing flammable methane gas at 1100 psi and 100°F (7600 kPa and 38°C). The assumed orientation of the release is horizontal. Because the platform is open to the atmosphere, the operator desired an analysis of this hazard that was sensitive to the local meteorological conditions at the facility, including a variety of typical wind speeds and wind directions.

For the purposes of the simplified example, only two wind directions were considered: 1) favorable wind (prevailing wind direction), and 2) non-favorable wind (180 degrees opposite to prevailing wind direction). Two wind speeds were considered: 1) typical wind speed of 11 miles/h (5 m/s) and 2) low (non-favorable) wind speed of 3.4 miles/h (1.5 m/s).

Step 3 - Analyze Consequences

In this example a range of consequence analysis options was considered, including: qualitative estimates, simplified hazard correlation tables, and gas-dispersion modeling. In this case gas-dispersion modeling was selected to analyze the size of the flammable envelope and its possible location with respect to proposed location of gas-detection equipment. The dispersion model selected allowed for analysis of the flammable profile in the downwind direction and crosswind direction based on similarity modeling. The model was sensitive to the quantity of material released, the rate of release, and local meteorological conditions.

Gas-discharge models were used to calculate the release rate from the ¼-inch (6 mm) diameter hole under 1100 psi and 100 °F (7600 kPa and 38°C) process conditions. The discharge model calculated a release rate of 0.5 lb/sec (0.23 kg/s). The dispersion model results showed dispersion in the downwind direction to an endpoint equivalent to ½ (50%) of the Lower Explosive Limit (LEL). This value was chosen to correlate with the sensitivity of the combustible gas-detection equipment to be used in this application.

Results of the gas-dispersion model show the potential for a combustible gas envelope of dimensions 20 feet (6m) in downwind direction and approximately 3 feet (0.9 m) in the crosswind direction. This result was obtained under “typical” meteorological conditions for the facility of wind speed 11 miles/h (5 m/s) and neutral atmospheric stability. The model was studied and determined to be relatively insensitive to



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 36 -


atmospheric stability for this example problem and relatively sensitive to assumed wind speed. For the location of this platform, the meteorological conditions were found to be relatively constant with respect to wind speed. The model only allowed for analysis of the release orientation in congruence with the wind direction. Further, the model was run with an “un-impinged” release, which allowed for momentum jet effects to dominate the air entrainment into the gas cloud.

Figure A.7 illustrates the output of the gas dispersion model including the cloud footprint in the downwind and crosswind directions.

Figure A.7 Combustible Gas-Dispersion Model – Gas Footprint

The orientation of the gas cloud in this figure is arbitrary, and it is recognized that the actual hazard could extend outward from the flowline and could be oriented in any direction as a function of the hole location and the wind direction.

If this release occurred and the combustible gas cloud was ignited, a vapor-cloud fire would occur. A vapor-cloud explosion was not selected as the credible consequence in this case due to the limits on the quantity of gas within the flammable envelope being below that which would be required to sustain a vapor-cloud explosion. Discussion of the parameters impacting the outcome of an ignited vapor cloud is beyond the scope of this technical report. Refer to CCPS Guidelines for Chemical Process Quantitative Risk Analysis (ref 2.6) for more information.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 37 - ISA-TR84.00.07-2010


The credible consequence of this scenario is a potential life-threatening injury to a single person if present in the wellbay module at the time of the release. Based on the expected personnel staffing philosophy and historical data, the occupancy of the wellbay module is considered to be no more than 8%.

Figure A.8 shows an overlay of the gas dispersion results on the platform in the direction of the prevailing wind. Figure A.9 shows an overlay of the gas dispersion results on the platform in the direction of the non-favorable wind.

NOTE Release from Well #1 Flowline

Figure A.8 Gas Model Results – Dispersion in Prevailing Wind Direction

NOTE Release from Well #1 Flowline

Figure A.9 Gas Model Results – Dispersion in non-favorable wind direction



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 38 -



In this example a range of frequency analysis options were considered, including: qualitative estimates, simplified frequency lookup tables for generic situations, and quantitative analysis of industry failure and leak data for specific equipment items. In this case, the offshore industry maintains databases of equipment leak frequencies, and this database was queried for an appropriate leak frequency.

The likelihood of a pinhole leak in a single wellhead producing natural gas with the range was found to be 5E-3 per wellhead year. A probability of 30% for delayed ignition of high-pressure gas releases was selected for this release, based on offshore event data for similar releases. The frequency of a flash fire event is therefore 1.5E-3 per year for a single wellhead. Since there are 9 total wellheads, the total frequency of the flash fire event is 9 times the frequency of a single wellhead, or 1.4E-2 per year.

Lack of normal occupancy on the platform reduces the risk to personnel. In this case, only 8 percent of the time the platform is occupied. The hazard scenario is a mechanical integrity failure that has no apparent correlation to its occurrence and the occupancy of the platform. Therefore, there is an 8 percent probability that an ignited release results in the identified safety consequence, owing to the low occupancy.

Funmitigated = 1.5E-3 per year per wellhead x 9 wellheads x 0.08 occupancy factor

= 1.1E-3 per year risk to personnel

No other protection layers were identified that would reduce the frequency of the hazard.


Based on the operating company’s risk criteria, the likelihood of this consequence severity should be reduced to less than 1 chance in 10,000 per year (10-4 per year individual risk of fatality). The frequency of the hazard scenario without benefit of a gas-detection system was calculated as 1.1E-3 per year (1.1 chance in 1,000 years). Application of the FGS risk model is shown below.

Detection Coverage




Yes 1 0.00E+00 0 0.00Yes 0

0 0 0.00E+00 1 0.00Hazard Scenario No

1 1 0.00E+00 1 0.00

No1 1.00E+00 1 1.00



= 1.1E-3 per year

The risk of the scenario is a factor of 11 higher than the risk criteria of 1E-4 per year. Therefore, the risk criteria have not been satisfied for the unmitigated situation.

NOTE In the above example, the mitigation effectiveness has been set to 1.0 for simplicity in communicating the calculation concepts and inter-relationships between the various parameters. This assumption is based on the detection



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 39 - ISA-TR84.00.07-2010


of the incipient hazard and is within the mitigation capability of the FGS final element design. In actual practice, 100% mitigation effectiveness may not be practical and should be evaluated on a case-by-case basis.

Step 6 – Identify FGS Risk-Reduction Requirements

Based on the results of Step 5, a recommendation was made to design a gas-detection and automatic-shutdown system that would reduce the risk by a factor of 11. Automatic shutdown would involve closing well surface safety and wing valves in the event of gas detection. Gas detection for similar facilities using IR adsorption technology has proven effective. Initial targets for gas-detector coverage were set at 93% and gas-detection/shutdown system safety availability of greater than 98%. Application of the risk model to determine the weighted average consequence for this example is shown below.

Detection Coverage




Yes 1 9.11E-01 0 0.00Yes 0.98


1 0.02 1.86E-02 1 0.02

No0.07 7.00E-02 1 0.07



= 0.09 x 1.1E-3 per year

= 1.0E-4 per year

Therefore, a weighted average consequence of 0.09 compared to the unmitigated hazard will result in risk, which will satisfy the risk criteria of no more than 1.0E-4 per year.


The proposed gas-detection/shutdown system design is based on expert judgment and heuristics through application of the prescriptive requirements of the appropriate national standard/industry guidelines. The design involves use of open-path, combustible gas detection with three detector sets placed on the platform, as shown in Figure A.10. Note: The initial placement of the open-path gas detectors gave consideration to the prevailing wind direction in this area being from the southeast.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 40 -


Figure A.10 Initial Gas-Detection System Design – Open-Path Gas-Detector Placement

The gas detectors generate a 4-20 mA signal for measured gas concentration, and also generate discrete alarms when combustible gas concentration is detected above a threshold value as measured in LEL-meters for a detected gas level. The sensor signal is received by a logic solver, which sends a command to shut down all wells in the wellbay when gas detection is sensed. This would effectively shut off the source of the combustible gas from the leak point and mitigate the flammable hazard over a period of time as the pressure at the source drops.

Combustible gas detectors will be set at a sensitivity that allows for detection of a combustible gas concentration of 0.5 LEL meters or greater. This will provide adequate sensitivity to detect the hazard scenario of concern given the overall dimensions of the module and the proposed location of detectors.

The initial design did not specify whether any single detector in alarm state will cause the shutdown system to activate (e.g., 1ooN voting arrangement), or multiple detectors are required to cause the suppression system to activate. Spurious activation of the suppression system is not hazardous, but is an undesired event from an economic standpoint.

Note: This example does not address placement of the detectors in the vertical dimension for simplicity. An application of this technique to an actual FGS application would need to address this aspect of the problem.

Step 8 – Assess Detector Coverage

Detector Geographic Coverage

A computer model was used to analyze geographic coverage consistent with the methodology shown in Annex B of this technical report. The model generated coverage factors for both a 1ooN voting arrangement (any single detector has the capability of initiating a shutdown) as well as 2ooN voting arrangement (two or more detectors required to be in alarm state to initiate a shutdown). Graphical output of the model that calculated geographic coverage is provided in Figure A.11.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 41 - ISA-TR84.00.07-2010


Figure A.11 – Gas-Detector Geographic Coverage

The geographic coverage results show that approximately 78% of the module is covered by one or more line-of-sight detectors. The area that is covered by both detectors is much less, in this case only 21%. This is due to limitations on the capability of a threshold volume of combustible gas being sensed by more than one detector, which is based on the number, layout, and orientation of the detectors within the area of concern. In addition, 22% of the module is not in the covered area by any of the three detectors, meaning a threshold volume of combustible gas at those locations cannot be sensed by the proposed detector array.

Detector (Scenario) Coverage

The scenario coverage was analyzed by overlaying each hazard scenario on a grid containing information about the proposed gas-detector locations and orientation. A determination was made if each detector could sense the hazard given the size and shape of the gas cloud.

A range of possible scenario outcomes addressed the possibility that the gas cloud would disperse downwind from the release location and could be oriented in either the favorable wind direction or the non-favorable wind direction. In each case it was determined whether or not any of the gas detectors were positioned to sense the combustible gas cloud. A computer model aided in conducting this computationally intensive problem.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 42 -


Output of the model is provided in Figures A.12 through A.16, each figure showing various iterations of the model. Only selected iterations have been included for the sake of this example. Figure A.16 shows a spreadsheet computation of the scenario coverage for the existing detector array.

Figure A.12 Release from wellhead #1 – Wind in Favorable Direction

The existing detector array allows for detection of this scenario outcome.

Figure A.13 Release from Wellhead #1 – Wind in Non-Favorable Direction

The existing detector array allows for detection of this scenario outcome.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 43 - ISA-TR84.00.07-2010



The existing detector array does not allow for detection of this scenario outcome.


The existing detector array does not allow for detection of this scenario outcome.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 44 -


Well Scenario Initiating Frequency (per yr)

Wind Direction Directional Conditional Probability

Detected by FGS?

Detector Coverage

Detectable Frequency

1 Sand Cutout 5.00E-03 Favorable (NW) Non-Favorable (SE)

0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes No

1.0 0.0

3.5E-030.0E+00


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03

Total 4.5E-02 4.4E-02 Detector Scenario Coverage 96.7%

Figure A.16 Analysis to Determine Scenario Coverage for Existing Detector Array

The results show that the 87 percent of possible hazard scenario outcomes are covered by the detector array and can be sensed by at least one detector.

Results of detector (scenario) coverage method are higher than the results of detector geographic coverage method because the layout of the detectors with respect to the prevailing wind is such that it is very likely the release would be blown by the prevailing wind into the path of one of the open-path detectors.

Step 9 – Assess FGS Safety Availability

The safety function definition was initially defined to include only one detector to sense hazard. Thus, a 1oo1 voting architecture was considered. A shutdown of the leaking single wellhead has been included in the FGS function. In addition it shall be assumed that functional testing of sensors and final elements occurs once per year.

Methods and sample calculations on how to calculate PFDavg are included in ISA TR84.00.02 (ref 2.7) and have not been included in this technical report. Using simplified equations, the resultant PFDavg for the FGS function is 0.015 or an FGS safety availability of 1 – 0.015 = 0.985. Note this equates to a risk reduction factor of approximately 67.

Step 10 – Perform Mitigated Risk Assessment

The frequency of the hazard scenario with consideration of the benefit of a gas-detection system (detector coverage and FGS safety availability) was calculated as shown in Figure A.17. The initial calculation was performed using the detector (scenario) coverage and 1ooN voting arrangement.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 45 - ISA-TR84.00.07-2010


Detection Coverage




Yes 1 8.54E-01 0 0.00Yes 0.985


1 0.015 1.30E-02 1 0.01

No0.133 1.33E-01 1 0.13


Figure A.17 Mitigated Risk Assessment – Existing Detector Array

Risk = CWA x F unmitigated x PFD(IPL1) x PFD(IPL2) ... x PFD(IPLn)

= 0.15 x 1.1E-3 per year

= 1.6E-4 per year

The weighted average consequence is reduced to no more than 15% of the unmitigated value. The design reduces the risk by a factor of 1/0.15 or a risk reduction of about 7.

The overall likelihood of the hazard scenario was calculated as 1.6E-4 per year (1.6 chance in 10,000 per year). This is 60% above the maximum likelihood that was selected for this scenario of 1 chance in 10,000 per year (10-4 per year individual risk of fatality). Therefore, the risk has improved over the unmitigated design, but risk criteria have not been satisfied with the proposed Gas-Detection/Suppression system design.


Since the risk criterion was not satisfied by the initial gas-detection design, the design was modified in order to meet this objective. Options that may be explored include the following:

− Add one or more additional gas detectors to increase detector coverage

− Increase the frequency of functional tests of the existing system design to increase FGS safety availability

Note, in this particular example, simply increasing the functional test frequency by itself will not result in an acceptable design. Thus, increasing functional test frequency should be evaluated in concert with addition of detectors. In this case, the operator desired to analyze the problem with an open-path gas detector located south of the 9 wells in addition to the existing 3 detectors. The additional detector is positioned in a manner that would detect gas from wells 7, 8, and 9 in an unfavorable wind condition (e.g., wind blowing from the northwest). Figure A.18 shows the modified detector array. The coverage model was rerun for this scenario, and the results are shown below in Figure A.19. Figure A.20 shows a spreadsheet computation of the detector coverage for the modified detector array.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 46 -


Figure A.18 Modified Gas-Detector Layout


The modified detector array allows for detection of this scenario outcome.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 47 - ISA-TR84.00.07-2010


Well Scenario Initiating Frequency (per yr)

Wind Direction Directional Conditional Probability

Detected by FGS?

Detector Coverage

Detectable Frequency


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes No

1.0 0.0

3.5E-030.0E+00


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03


0.70.3

Yes Yes

1.0 1.0

3.5E-031.5E-03

Total 4.5E-02 4.4E-02 Detector Scenario Coverage 96.7%

Figure A.20 Analysis to Determine Scenario Coverage for Modified Detector Array

The results for the modified detector array show that the 97% of possible hazard-scenario outcomes are covered by the detector array and can be sensed by at least one detector.

The application of the risk model shows the calculation of the weighted average consequence for the modified array.

Detection Coverage




Yes 1 9.52E-01 0 0.00Yes 0.985


1 0.015 1.45E-02 1 0.01

No0.033 3.30E-02 1 0.03



= 0.05 x 1.1E-3 per year

= 5.4E-5 per year



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 48 -


The weighted average consequence is reduced to no more than 5% of the unmitigated value. The design reduces the risk by a factor of 1/0.05 or a risk reduction of about 20.

The overall likelihood of the hazard scenario was reduced in the modified array to 5.4E-5 per year (5.4 chance in 100,000 per year). This is below the maximum risk that was selected for this scenario of 1 chance in 10,000 per year (10-4 per year individual risk of fatality). Therefore, the risk reduction has improved with the modified design based on four detectors and the risk criteria has been satisfied.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 49 - ISA-TR84.00.07-2010


Annex B - Detector Coverage Assessment Techniques

B.1 Detector Geographic Coverage Assessment

A geographic coverage assessment seeks to determine the degree of coverage of a monitored area, which contains a process with potential fire or gas hazards. The goal is to determine the fraction of geometric area within a monitored process area that is covered if a release were to occur in a given geographic location. Geographic coverage is a function of the release detection equipment in the monitored process area, considering obstacles that prevent/inhibit detection and the defined voting arrangement for the safety action of interest. For example, an array of many flame detectors in a monitored area with few obstacles and a 1ooN voting arrangement (Figure A.4) would yield a higher geographic coverage than an array with only a few flame detectors in an area congested with process equipment and a 2ooN voting arrangement (Figure A.4). Detector geographic coverage does not require a specific risk scenario to determine coverage. The method assumes a hazard could occur anywhere within a monitored area and seeks to determine how well covered that area is. Detector geographic coverage does require general information about the magnitude of a fire or gas hazard that requires detection in a monitored area.

B.2 Criteria for Fire Assessment

In general, the system’s ability to detect a fire of given intensity increases as the number of fire detectors in a monitored area increases. However, in any system there is a threshold fire intensity below which the system may not activate due to limitations on the sensitivity of flame detectors. Since an analysis of geographic coverage is not conducted on a scenario-by-scenario basis, a general criterion needs to be established to determine the fire intensity that requires detection at any location within a monitored area. This criterion determines the analytical endpoint for adding more detectors to obtain a given level of coverage.

Most optical flame detection methods are sensitive to thermal radiation at various wavelengths, and the radiated heat output of a fire is an important parameter in determining the threshold for detection. Determination of appropriate fire detection criteria is beyond the scope of this technical report. Selecting a very low threshold detection criterion may be appropriate in some instances that are extremely vulnerable to small fire effects or present a severe potential for fire escalation; while in other situations this criterion may lead to an excessive number of flame detectors because small fires cannot be sensed at moderate to large distances from a detector. On the other hand, selecting a very large threshold criterion may be appropriate in some instances where only minimal coverage is required to annunciate a fire in a normally unoccupied process area; while in other situations, it may allow a fire to grow to an unacceptably large size beyond which automatic control actions (e.g., suppression) can be considered effective.

Procedure for Fire-Detector Geographic Coverage Assessment

• Select detection criteria – threshold fire magnitude that requires detection of incipient hazard (e.g., fire intensity of 1 foot by 1 foot at 100 feet requires detection and automatic suppression prior to fire escalation)

• Select a geographic location for analysis

• Determine if the geographic location is within the field of view of each fire detector in the monitored area. For optical fire detection, ensure that obstructions between the detector and the geographic location are accounted for in making this determination.

• If 1ooN voting is proposed, flag the location as covered only if it is within the field of view of one (or more) fire detectors in the monitored area.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 50 -


• If 2ooN voting is proposed, flag the location as covered only if it is within the field of view of two (or more) fire detectors in the monitored area.

• Increment the analysis over all geographic locations in the monitored area.

• Create a sum total of all covered locations and determine the overall fraction of geographic area that is covered in the monitored area (i.e., detector geographic coverage).

B.3 Criteria for Gas Assessment

The ability to detect a gas hazard at an incipient stage increases as the number of detectors increases. However, there are practical limits on the number and position of detectors that will imply the possibility of a small release going undetected as the gas disperses below its detectable concentration or situations where a small release remains undetected for a period of time until gas accumulation occurs in a semi-confined/confined area. Since an analysis of geographic coverage is not conducted on a scenario-by-scenario basis, a general criterion needs to be established to determine the size of gas release that requires detection anywhere within a monitored area. This criterion determines the analytical endpoint for adding more detectors to obtain a given level of coverage.

Determination of appropriate gas-detection criteria is beyond the scope of this technical report. From a practical standpoint, the size and shape of a gas release that requires detection are required to perform a basis analysis of gas-detector coverage. For flammable gas detection, factors such as the degree of confinement and presence of turbulence-inducing obstacles require consideration. The typical form of this criterion is a spherical gas cloud of given size (e.g., 5 meter diameter, etc.); and the actual value can be based on analytical consequence modeling or study on the effects of flammable gas-cloud size and the potential for damage blast effects from a deflagration. A smaller gas-release criterion may be required in certain situations that are vulnerable to fire/explosion effects; while in other situations, a small criterion may lead to an excessive number of detectors in an area that presents minimal hazard. A larger criterion may be appropriate in some situations; while in others it may allow an unacceptably large accumulation of combustible gas that presents a significant escalation hazard and beyond the capability of the mitigation system’s effectiveness.

Procedure for Gas-Detector Geographic Coverage Assessment

• Select detection criteria -- threshold gas release that requires detection of incipient hazard (e.g., gas release of less than 16 feet (5 m) in diameter requires detection at 60% LEL for point detector or 3.0 LEL meters for line-of-sight detector with automatic ESD prior to escalation of the vapor-cloud explosion hazard).

• Select a geographic location for analysis.

• Determine if the gas release of threshold magnitude centered at a geographic location can be sensed by each detector (point or open-path type) in the monitored area.

• If 1ooN voting is proposed, flag the location as covered only if threshold gas release can be sensed by one (or more) gas detectors in the monitored area.

• If 2ooN voting is proposed, flag the location as covered only if threshold gas release can be sensed by two (or more) gas detectors in the monitored area.

• Increment the analysis over all geographic locations in the monitored area.

• Create a sum total of all covered locations and determine the overall fraction of a geographic area that is covered in the monitored area (i.e., detector geographic coverage).



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

- 51 - ISA-TR84.00.07-2010


The advantages of Geographic-Coverage Assessment include an easy-to-understand graphical representation of results. There is no requirement to generate specific scenario-by-scenario coverage results. Computational requirements are high for this method (as well as scenario coverage). The disadvantages of Geographic-Coverage Assessment include the fact that it can lead to a situation where detectors are added to cover portions of a monitored area that are relatively low-risk because the method is not sensitive to the frequency of a fire event at any given location within the monitored area. This factor can also lead to a situation where a location with a high likelihood of a hazard is not covered adequately because that location is treated the same as any other location in the monitored area. These factors are addressed in detector (scenario) coverage assessment.

B.4 Detector (Scenario) Coverage Assessment

The risk scenario(s) identified in Step 2, consequences identified in Step 3, and event likelihood identified in Step 4 are used in the coverage assessment.

Consequence analysis in Step 3 generated information about the potential impact of the identified fire and/or gas-release scenarios. The impact zones are overlaid on the plan view of the module. Most often, the impact zones are based on turbulent diffusion fire models, showing flame size and shape, or gas dispersion, for unconfined or semi-confined areas. A determination is made for each detector in the monitored area as to whether it is capable of detecting the scenario.

Procedure for Fire-Detector (Scenario) Coverage Assessment

• Select a hazard scenario in the monitored area identified in Step 2.

• Select the first consequence outcome of scenario. For a fire, each outcome is represented as one of the possible flame orientations.

• Determine if the consequence outcome is within the field of view of each fire detector in the monitored area. For optical fire detection, ensure that obstructions between the detector and the geographic location are accounted for in making this determination.

• If 1ooN voting is proposed, flag the scenario outcome as covered only if it is within the field of view of one (or more) fire detectors in the monitored area. If flagged, increase the frequency of detectable release for 1ooN voting by the frequency of consequence outcome calculated in Step 4.

• If 2ooN voting is proposed, flag the scenario outcome as covered only if it is within the field of view of two (or more) fire detectors in the monitored area. If flagged, then increase the frequency of detectable release for 2ooN voting by the frequency-of-consequence outcome calculated in Step 4.

• Increment the analysis of all scenario outcomes for selected hazard.

• Increment the analysis over all hazard scenarios in the monitored area.

Create a sum-total frequency of all detectable releases. The ratio of detectable-release frequency to total-release frequency is the detector (scenario) coverage for fire detection in the monitored area.

Procedure for Gas-Detector (Scenario) Coverage Assessment

• Select a hazard scenario in the monitored area identified in Step 2.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA-TR84.00.07-2010 - 52 -


• Select the first consequence outcome of the scenario. For a gas release, each outcome is represented as a cloud profile from dispersion analysis with possible multiple wind directions/meteorological conditions.

• Determine if the consequence outcome can be sensed by each detector in the monitored area.

• If 1ooN voting is proposed, flag the scenario outcome as covered only if it can be sensed above the threshold concentration for alarm by one (or more) detectors in the monitored area. If flagged, increase the frequency of detectable release for 1ooN voting by the frequency–of-consequence outcome calculated in Step 4.

• If 2ooN voting is proposed, flag the scenario outcome as covered only if it can be sensed above the threshold concentration for alarm by two (or more) in the monitored area. If flagged, then increase the frequency of detectable release for 2ooN voting by the frequency of consequence outcome calculated in Step 4.

• Increment the analysis of all scenario outcomes for the selected hazard.

• Increment the analysis over all hazard scenarios in the monitored area.

Create a sum-total frequency of all detectable releases. The ratio of detectable-release frequency to total-release frequency is detector (scenario) coverage for gas detection in the monitored area.



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

Developing and promulgating sound consensus standards, recommended practices, and technical reports is one of ISA’s primary goals. To achieve this goal the Standards and Practices Department relies on the technical expertise and efforts of volunteer committee members, chairmen and reviewers.

ISA is an American National Standards Institute (ANSI) accredited organization. ISA administers United States Technical Advisory Groups (USTAGs) and provides secretariat support for International Electrotechnical Commission (IEC) and International Organization for Standardization (ISO) committees that develop process measurement and control standards. To obtain additional information on the Society’s standards program, please write:

ISA Attn: Standards Department 67 Alexander Drive P.O. Box 12277 Research Triangle Park, NC 27709

ISBN: 978-1-936007-43-1



--`,`,,,,,`,,,,``,`,,,,,,,,`,,,,-`-`,,`,,`,`,,`---

ISA TR84.00.07 2010 ED

Documents

Transcript of ISA TR84.00.07 2010 ED