mg;" sinhumaswdurdwmmm—

65) Imtlun I MINI-||

mamma
Cahen-msi m

Tim-wm. Hamm *-

l'íů mam-1.07 2913-

Guidance on the Evaluatinn of Fire,

Combustible Gas, and Toxic Gas
System Effectiveness
ApprowdMim 10;IMF“

WNWHT
m-lwlummuntau nakupu "
“uuu-I .- m- imm l t m n m mm u: m m n d
nm:;mnhhrmummm- M H W - “ h w If
ll-I-lllildrlrIF-II
www-Wm pumu lh
mnm; mi:! tuLil'! k i n u :- 'lht unu-.
Hm m u m n m Inmr vlh- llum l'- m ,
M u f - n IHHIÚIF Farm. vidim-u" “"-iw
.n: mmm-Er: run-umihh-mdmy
MEMMHM Mau-lla.

___-da,)
IMTRH.OD.OT-2018. Gula-nu on Ihl Evllunlnn ůl' FIN. Cimbultlhll Gall. Ind Twin Gli
SNÍH“ HÍWIWII'IÍ"

lan: Haman-nam
Dawnghl G 201! bar-15h A|| rluhu mai-ml. 'Prlnlcd lnih: umi-a smu- nf úmrtn- Nn m 101
[Iw- public-tunu muy hn ropmuunnd. mm In:! rlll'liwj snim. nr Hanu-mnie. m nm:Imm urbi
any m a n a illuctfmlc. mechanical. phuhmprřng. mmm-.g. trumf—vlna. cuul. 1:11. plic!
mnm FWHIUH ul' mu Publlůhiť
l$l
ar T w . Nuundnr Bmw
PD- lil-bx 1221?
Hmmm Triangl:Fm4.Núrth-Garůlfná “JÍDE-
amu-*www-
 -3 - rsn-resomor-sms

Protool
Thi—o protnou io inoludod for information purposes and i: not part of ISA—TRHQQGT-ÉNB.
Thi: toohniool ropdrt hdd hodnpropdrod do port dt trio urvioo of IBA. tho lntornotiortol aooioty of
Automation. To bo oi root vatu-o. thio dooumont ohould not do otoiio out should do do "not to
ooriodio roviow- Tot-rord into ond. tho Bounty woloornn otl oommonto ond oritioionro ond o: : thot
the; bo oddrouod to IM Boorotory, Standordo ortd Prootiou !oord: rsn. !? r.w_. Noxondor Drive:
F.CI. Box 122W; nuooron Triangl: Forit. M c . sms; Toioohono tits) 5494411: Fox (9191545-
5255; E-molt: dlondordontooorg.
Thin iSA stondordd ond Prooiiou Do ortntonl i| oworo ot tito growing nood tor ottontion to tito
motrio dnt-m ot unit! In gonorol. on tho Intornottonoi autom of Units [St] in oortloulor. In tito
oroooroir'on oi otondordo. rooornrnondod ordotiou. ond toohnrool rooorto. Tiro Dooortntont il
further oworo oi iho honor-to to users oi isnt dtondordo dooumonto ot inooroorotino ouitoitio
rotoronooo to the SI [and the motrlo system) In thoir husinoso ortd profession-:| doolinps with other
oounh-ios. Toward this omi the Doportmont WIII ondoovor to introduoo SI and oocoptohio motrii:
units in all now ono rowiood standards documents to the greatest extent possible. The Metric
Prdoiioo Guido. which hos Ideon publishooi by the Inoiituio of Elooiriool and Electronics Engineers
(IEEE) os ANSUIEEE Sid. EEE-1592. ond futuro revisions. will be the reference guide Ior
oehnioone emboio. abbroviotions. and conversion factors-

It is the poiiotir of ISA to enoourage and welcome the partioipalion of all oonpemetl individuals and
interests in the development of ISA standards. Participation in the ISA standards-making prooess
by an individual ín no way oonstitutee endoreernent by the empioyer of that individual. of ISA or
of any of the standards. recommended practices, and technical reports that ISA develops.

CAUTIICH — ISA DDES NDT TAKE ANT PUSITION WITH RESPECT TD THE EIISTENGE ÚR
VAIJDITT GF ANT PATE'IT RIGHTS ASSERTED IN GGNNEGTIGN 'i'iIITH THIS DÚGUHENT, AHD ISA
DISGLAIMS LI.i5|.BILl'I"I'f FORTHE INFRIHGEMENT GF ANT PATENT RESULTING FROM THE USEDF
THIS DGCIIIIIENL USERS ARE ADVISED THAT DETERIIIINATIGN GF THE 1Irl'.|Eil.l['.ITT"|" OF ANT
PATENT RIGHTS, AND THE RISK GF INFRIHGEMENT GF SUGH RIGHTS, IS EHTIREL'I' THEIR O'NN
RESPONSIHILTT'I'.

PUHEUMT TD ISA'S PATEHT' PDUG'T, DNE DR HDHE PATENT I'FDLDERS DR PATENT

„MJU—MTS MAY HIWE DISELDSED' PATEHTS THAT DDULD BE INFRIHGED BY USE OF THIS
DDCUMEHT. AND E!EEUTED A LEI'TER ůF ASSURANCEEDMMITTIMG TD THE GRAHTING DF !-
LICENEE OH A WGRLDMDE NÚNDISBRIMIHATDRT BASIE. WITH A FAIR AND REAWHÉEL'E
RWALTT RATE AND FAIR AND HEMUNAELE TERMS MID CUNDITIDHS. “FDR MORE
INFORMATIÚHDH EUGH DFECLDSURES ARD LETTERE GF ASSURANGE. EÚNTAETIEA OR “EITL
WWW.HA-DRGIETENDARDBFATENTE.
OTHER FATENTS DR PATENT GLMMS HAV EKIlT FDH WHIEH It. DISGLÚSUREDH I.:!T'IER DF
MUR-MICE HMS HDT BEER RECEIVED. IBA l-S NOT RESPGHBIBLE FDI.IUENTIFTIHG FATEHTB
DH FATENT APPLICATIONS FDR WHICH A LTC-ENB! MAT BE REGUIRED FDR GDHDUGTIHG
IHGUIHIES iNTG THE LEGAL VALIDITT OH SCOPE CIF FATENTE. DR FDH DETERMINIHG
WHETHEH ANT LICENSING TERMS GIT DDNDITIUNS PRUWDED IN UDHNECTIUH WITH
BUEMISSIDN GF A LETTER DF ASSURANCE IF .rii.|"I"I'L DE |" ANT UGENSING AGREEHENTG ARE
HEASDHABLEDR NDNDIEBRIMIHLTGRT-
IBA REDUEBTE THI'tT „TYDNE REVIEWIHGTHIE DDGUMEHT WHO IE AWM! GF MW PATEHTI
THAT MAT IMPACT IMPLEMENTATIIJH OF THE DDGUMEHT HDTIFT THEIEA HARUM“ AMD
FRAUTICES DEPARTMENT OF THE FATEN'T AND ITS WHER.
HDDITIWIALLT,THEUSEDF THISDDEUMENT MM INVDWEHW! Hm
QFERETIDHEo DR EDUIHIITEIIT-THE[IDC-UMĚT“ CARROT ANTIÉIIFATE ALL FIM-HELE '

WttB Milli rtghteenorůedt

IEA-TREBI1214915 --4 »

APPLICATION!DR MDREBSALL PWSIBLI SAFETY mu:: MCIATED WITH USEIN

WAR—DUU!CDNDH'IDHS. THE USER CIF THISDDÚUMENT MUSÍ EKERCISE EDUND
FROFESSIDNAL JUDGMENT CONCERNING ITS USE AND AFPLIGABILITY UNDER THEUSER?
FWCULAH CIRCUMSTANCES. THE USER MUST RLSD CDNBIDÉR THE APPLICABFLIT'I'DE
ANT GUVERHHENTAL HaimLaliíl'llllřťlIr LIMITANDNB AND EETAELISHED SAFETY AND HEALTH
FMC-“EEE EEFDRE IMFLEMHÍTING THIS DDGUMENT.
THE USER DF THIS DDGUIIIEHT SHGULD EE AWARETHATTTIEDÚEUHHIT MAY BE [HF-i'm
BT HECTRDHIG SECURITY [551] ESJ'HE GDMMITTEE HŘEHDTTET ADDREBEED 1fl-"lÉ
FDTEHTIAL IBSUE'E IN THISEHEIM-
ISA lRHEWJin„umi is :: nmnpmm DIDÍH'IIDTIal mammalian lhal sets Irie nlandard for mne: whoipm?-
ennmeanng und imunologa! Io morava lnu. management. aniz-ly. and cmuruuunw a! mam
"temnou and contrat unum: uuu nr.-fm Inclunlry und enim! m t m " ucturu. Founded In 1915.
ne:. ancien; Wld.-ly u u u alobal :mndnrdn: uunll'ln Musiq pral-manualu; pra—alan Human
amulrmnlnu; Whillhlů honit: unuinchmcnl mmm; hnala conter-nul und uhlnltn; nm:! pravidlu
Wing nnndnnrur-dwnlonm-nt programu tur na 40.000 number! und 100.000 :unlnmum
around lh! war .
IEA nwm mm;-gg, : "leading unline pumínhar nf Embannďem—Bd content. and HF- th!
inundlng silurem uf Thaňutornntinn FederatTnn twuaíedmhnmmr. un BE&WFHIÍDH-DT
mmm nrgenizetinne eening 'The Heine ef Mamatínnf Thmugh a whellyawned EHEIM,
IEA bňdges the gap beh-Jeenstandardeend their implementation with the ISA Security Compliant!
Institute wm and me IBA Wireless Cummianee mnam—. (WM.

ĚÉIWIW n w m lm nam-mmm: cí rem Warning Eman-? m dwelnnlng un: tant-mu

NAME DDMPM
Hl.m. FG! mm hmmm
lt him—nil Fee :::-cm Hanuma Gunmmmm
|. Barrem Ghuwún
D- Hadrbum Prulllps 55
A. Haier Brt'l'emEgeln-ns
11 Dtishnlm Phillips 55
R. Chittilapilly Dir & Namraf'Gamp-
F. Diegem men Safetyr
R. Dmn DuPont
L. Garcia Siemens
c . Geo-me Flint Hina Realu.-rm
|. Gwen Cumultnnt
N. GopnMwnml HUMWIII Prom Hudora
F amu Hunt ill Fram: sum
M. Hmmm-nr BIB- EGH Saluťm LP
w. Mam Run-im Funda:: Tach
P. Gluhn “Gautiera
5. Harman Eaton
F. Hendi Schneider Elmh'it:
P. Herena BekerHíeJt
F_ Janů: Ghemn
J. Kallambettu Bechtel
F. Kannan Peueleum Devehpnm Dmen
$. King Hnnewell
|.. W l Emmu
!. Lung Chlmn
J. M:! Mim-opaduLtd.
!. Mortal Kin-laduBantumi Corp

mm 2018 IBA. Allrighls mod.

 - 5- mamma-2013

DuPunt
mSDhltims
Det-Trmice
Westem Inchstť LH.
Jambs Engineering & W I.I.[:
Chanan
SIS-TED-l Equium l_P
BP
Errhersnn
ASRC Energy Sam
Samar Energy.:r
FireBus System
BP
BIS-TECH saam LP
Gnnaulhnt
Ghemn

MMMBSMDIHISA sundammmmmwmm
mmm-410.313:
GDM PANY
nm.mpmiuu Yokogawa UK Lu.
U_m Emma-Gabi!Raad- &Elm
Ě

U_m BRBLL Cenami-lg

P. Huneywell Inc.
Emmu! GIT Bonnem. LLG
D.Ihm T.F- Hud-gina.In:. - nad mmm
J_Fedaieil Feria-rem & Asan-t:LLG
EW Wood PLC
.L-P.Ha:|el Hauetmm
D.LBE Avid Saluliurs m
E_LÉIIHII AECDM
Tim Gnnstútant
U_m Flunr Gum-
GW AWM MHC-mmm
Gm City of Guelph Walla:Salim
Emason Process hiragana!
Enamel! Automation
DuPnnt
Fleldmn'm ep lnu:. Asia-Panic
Harman starty Bam
Advmed Gperam Emelmneůo.
Induawial Automation nm
Bums & Hammel
Siemms AG DF FA
Gunsultant
Appia-d Burm muj:
Che-wan Energmm

might 2013 ISA. Allright m

 Tiíspmemhlm

manga-mmm
 —T — MMM-2015

Gant-nt:

Fawn -9-
Imm-ctím- .. .11.
1 Bm . ....... -15—
2 Rafal-mm .. . ....... -15-
: Mumdmmnwl ....... -11'-
4 mminFGSdt-ign..„.„„ -1I-
.w-
: FůSlnuim—nngndmumnuprqmmnnw
inm A — Samo-h uni-Quantum" Mummn ural: "|ta tui-minu...................................„.- 43 -
Mm ! - Dam:-armani unum-n: tlmnlquu „ - 53 -
mc —MWWMWM mne-pl . .. 43-
MMD—Amuummmmnmmm. „ “BT-

mwmwxmmmrr'"""WWREM'WWHW" .W.

Wai-lt 191!IGA. AIIHahlimimi.

 Mammut“

Gopmgtmlsmummm
 -i - ISA-Tmmm-iůt!

Foratvoed

The World tio develop this edition of ISA-mjufi? began in 2014 and was completed in 2018. At
the same time. the functional eafet etandard ensure—A 84.00.014004 wee undergoing updates in
poroitei with tec 51511. The i 4 Fire and Gee Warning Group maintained awareneee oi
oommittee activitiee nuncieted ivith rnodiiying the goveming etnndarde. The eoepe of updates to
the End Edition of this technical report tvoe limited by the I S A N committee. and it was not in the
1riroritiriig
group's charter to aiign tiris edition of the techniell report with the subsequent issuance
of ISA's functional safety standard-

This technical report describes how the underlying principles of the functional safety etandarde
oon he oppiied to the drtil! gas eyeteme. Those llli'nl unden Ii'i grindiplel lhůt were ueed to
develop the guidance in the teohnieoi report remein ooneietent n t e new ieeuance of rec 8151 t -
2015 and MENSA-515113015 [replacing ANSIiIEA-eo.DG.U1-20ůdt. Because of the liming
associated with approval and publication. this technical report retains the references to AHSIIISA—
M.DDIit-EDM. At the time of publication, the vrorlting group provides this achnowledgment that
the recent publication of MENSA-6151 1-2018 retains the same scope. application and underlying
principles associated with tire and gas systems.

ramenech-aute ie intended for uee in evoluoiing the effeotiveneee of fire end gae eyeteme
lFGSei in precese indurtry applications. lt addreeeee the implementation of Fine lo reduoe the
ridit of hazardous releases involving safety impact
NDTE_ Users can choose to apply the concepts in this technical report to environmental andi'or operational losa
acananas.
netmonitor-zora ie provided for information purpoeee only and ie not part of nosnice.
annotation til: efdtl Modified) (reference 2.1).
Aliance-Madonnu and lec 61511 treterenee 2.9) are perfomance-heated standards that
provide the minimum requirements for designing and managing a safety instmmented system
[SIS-L As part of the safety lifecycle. the functional and integrity requirements are established for
safety functions that reduce the risk of hazardous events identified using a haaard and risk
analysis. Guidance io prouded in Port 3 of either nnoursnenouonaoor or iEG 51511 on the
vonoue methode ueed to evaluote rieit and aiiocote ririt reduction to identified eafety funouone. fin
underlying oenumption in all of the melhode ie that the identified eefety functione ore copehie oi
achievtng the aiiocated rten reduction in the operating environment.
The scope of ensures-acceptance covers electrical .i' electronic ! programmable electronic
systems for use in safety applications. Accordingiy, the lSAEt-t committee develops standards and
technical reports to provide guidelines for the implementation of automated for instrumenlddi
eyeteme in eotety applications. The purpoee of ise.Tae-i.oo.or.2oie to to provide guidance on
how to evaiuote the effectiveneee of identified PGS functione in a manner thet ie ooneielent with
the undeifying principles of m a t n o u - e n c o n i a o o r . PGS functions that are identified ae eefety
controls. alarms. or intertoclts should be implemented according to the applicable requirements of
ANSIHEA—BdBLDt-SEME (reference 2-10) and ANSIIISA-Bd-DD.D1-EUM„ based on the degree of
risk reduction being clairned for the FGB function, in addition to relevant application specific
practices. For example. FGB functions should be implemented per applicable requirements in the
loiioviing standardu. oaeed on the rieii reduction needed:
. General fire end gde eyetern eefeguarde ivith no eoeoino rielt reduction oieimed ehould oe
implemented per application-specific standardu from local ]uriedtctfon having authority.
: FGB functions with claimed F E S risk reduction factor [HRF] lees than or equal to 10 should be
implemented per a p p i b l e requirements of ANSIJ'ISA-BdBt .01-2012. Safety Contracts, Atanas
and frrferfoclrs in the Process industries-
e FGB function With ctaimed Fils rieit reduotioh feotor ti'tI'ti' in enceee ol tft ehould pe
implemented per the eppiioehie requiremente of ANBiriSA- „ H m - t i l t ! end molitan-

copyitght 2018 ISA All rigl'itsreserved.

ELTRMNW—W'IB -10 -

84-00.01—2004 (based on IEG 61511 con'pliance. Mnich includes cortsirierslicn tor IEC 61503
compliance mirror end-user prior usa approval of serlsnr, logic schra- and iaai element ard:-
system).
Prescriptlve approaches for the daign of somelal components of a n FBS are provided in
recognized and generally accepted good engineering nechces (reference 2.2 and 2.3) for certain
applications. I n complex h e a r d ocel-iarics. especially lime involving high-risk exposure lea..
ollshore oil and gas installations)- and in sltuatlons iii-here no other prescriptiire guidance is
available supplementing these practices with pedormance-oased analysis can result in an
improved design with more effective coverage and lower nohahility of F G S faihire- It is ultimt'ltielgir
the users. decision on when to apply perfomance-based approaches. Nod-“ng in this techrícd
report suggests the preseriptive practices are invalid orthat illeg.:I should not befollmired a s required
by local jurisdictional authorities. The concepts urujertyiig a performance-ham approach are
suitable to the analysis and design ot" FGSs in proc-esa iridlistries, and these priiciples can be
used effective in conjunction with other good engineering practices.
THE EIAIIPLE RISK ANALYSIS METHODS AII) RISK GRITERIA WAHED IN
THIS TECHHCAL REPORT MVE BEEN PRGVIJED SDLEL't' AS EIPLAHATÚRY
MATERIAL AIiID SHDULD HDT BE INTERPREI'EDAS REGOMMENDATIDNS.

ALBI), 'I'l-E EXAMPLE FES ARCHI'I'ECTURES, [l:—[EGTUR CÚ'HERABES, AND

“monitor EFFECTIVENESSREPRESENT PDGEIEILE SYSTEMCÚHFIGllitATIůNB
AND SHDLLD NDT BE With—TED A5 REGDHMEWAMS- THE
GMFIGURATIONS USED IH ACTUAL APPLICATIONS ARE SPEUFIJ TG THE
CIFERATIHG EHVIRDNMEHT AHD PROCESS CDIIJITIDNS IH WI'IIZH THEY ARE
USED. AS SUCH, NO GENERAL RECÚHMEHDATDHS CAN EE PRCWIDED THAT
ARE AFPLlCABLE IN ALL SITUATIONS.

THE USER DF THIS TECHNICAL REPDRI' IS CAUI'IDNEIJ TÚ GLEARLY

|\'III'I'I
UH[ERSTAI'IJ THE AEENPTITJHE AND DATA ASSOCIATE) THE
HEIMEIER I N THIS DMUHENT BEFCIIE ATTEHPTIHG TD UTIIJZE THE
HEH-DDSPRESENTEDI'EREII.
Users of ISAFTRB4.ÚD.DT-ED1B wii Mode:

. Vendors. crad-users, and cortsrlhrts who are mobilu the perfomance-hned concepts to
FGB filma, in addition to outer applicable good aúieering practices-
. Hazard and risk analysis teams Hat are allo-cating risk reduction to FGB functions.
- FGS designera who want to understand the impact of detector coverage and mitigatim
effectiveness on the integritycď FES functions.
. Any additional entltbes wm irish to grain further insimlt 'IEIID perlcnnmce based FBS deeim
concepts.

“melaminem-m.
 - 11 - MMM-2015

II'III'ÚCIUG'IÍDI'I

The tence standards committee ionned a working group to etudy the anetysie and desigh
procesu: that are commonly used in the procoee Induetry for tire and pae eyetema tFGSe) and to
monde guidance on how theee proocuee can tic adapted tc incorporate pertcnnanoe-baeed
conoepte.
roce. ae their are coneidered in thie report. are c eubeet oi induetrial autor-nation cnd control
eyeteme that are employed in the roceee Induetriee for the purpcee ol detecting loee of
containrnent ot hoeocrdoue matericle rom the proceee and initiating c reepcnee to mitigcte the
relecee impact. Loee c i oohtclnrnent can toe a email lepit or a ccteetrcphic relecee. lt can be
detected o meaeuring the pieeenoe of the reieoeec molerleie tep,. oce concentration) or inierred
from the e iecte oi the releaee te.g„ thermal radiation trorn o hre).
Detection melhode considered in thie technical report con include detection of commenpte oee.
touto pae. emclie. ileme. ccouetic emieeion. or rapid hect riee in creee edieoent to the prooeee
lteelt and in critical areee. euoh ee occupied pultclnge or pulldinpe with unrated eleclrtcet
equipment- Detector coverage cnd eeeocicted detection capability vary eulietentielly depending on
the hazard ecenario and the characteristics of the detector.
Actions talten lotr the FGB con toe manually or automatically initiated and can affect a wide variety
of ereteme. auch oe eheltering in place or evacuation in reeponee to audiblc and visual didi-rn
indicatione: water detuge: tire auppreesant initiation: manipulation of heating. 1irehlilation. and air
conditioning [HUMI] system equipment; procese iaolation; or procese depressuriaalion. Similar to
detection capability. the effectiveness of these mitigatitre actions is highlyr acenan'o dependent.

Use of perfomance-based design is not widely adopted for FGEs within the process industrie-e.
However, MENSA-84.00.01 2004 or [EC 61511 can be employed as- a design basis for miligatiire
fire and gae safety functions by considering the following delinitions from ANEUIMDDDLEDM
or IEG 61511:

mítigatíon
action that reduoee the eonsequence(s) of a hazardous event
NDTE I Etran-gloe ilechetle eirlergenrqr depe'eaatlization on detection of & oonfinmel fire organeledr.
prevention
action that reducee the likelihood of occurrence of a hazardous event
protection layer
any independent mechanism that reducee rialt oy control. prevention, or hitigation
NDTE i lt can be a prac-eee engineering mecheniern euch de the eiae of veeeele containing lucerdoue Meeth. e
mechenicel modemem.euch ee e relief iii-etue. e BIB. or en edminielreliue pracem." euch ee en eneergencp plen egeillet
ml.? ll'lililblfl
ln ii'llmiitont fluid- Theee W H ! M eurem-tec ůf by humll'l HMM—

[EWRCEr IEC clolhlzalilii. Definition o.o.ci. modified » reference lic Figure il umo itemNote l )
eetety function
function to de implemented e:.: one or more protection Icyere. wnich ie intended to achieve or
melntcln o ecle etcte for the proceee. with reepect to o epeciiio haeardoue event
Nů'i'l l The eete elete cil the proceei tor eech identified "fet-i| iuiciicn ie defined well thet e etecle etete hee been
echieied eno the mm.: heeerocue event hee eeen eucloeo cr I-um'liil'lllf mltigetec.

ieounce: IIC eielhlzedlo. Definition lilie. codec Note l . derived lrcm idem!
eetety tnetrumented function (air)
eetety tunctlon to ne implemented IM" il eetettr inetrumehled eiretem tata:
NDTE ! ili GIF ie deei to echieve ! fetiulred Sil.. which ie tlelerrhh'led in retetionehlp with the mechem tepen
percepeting in the “cnet the eerne nett.

Copyright 2015 IEA. All rights reserved.

MWNN—HÚ - 12 -

11|ere are ten boardy rh'lfemnt philosophical approaches used it Ile phones itdostries tor
sam designrequirements to ensure the availability and efhclieeness of FGSS: presmptnve
arrdperltnmhased. The chodce of design method is a n ownerfopaatu' decision FGSs have
hadilinnally been designed and implemented according to various good engineering practices
audi as HFPA 72 (reference: 2.2) and E N 5 4 (reference 13)- These meeuiptive glactícee do not
requ're mann of the risk reduction capability of the FGB as measued by B safety 'mtegrity
asd prababiityoffa'hre ondernand (PFD), nor do they considerquatntitatíeerheaamfor detector
coverage.

A performance-tmel! approach consistent with the MWMM.MJIIH u lEC 61511 i s

dhacliwebecmseitmmthesaength oflheexístingstandmil-Imlelrer, Maritim-loan
perform-hned apuoach has historically been chatlenging to muly lo FGB 125191 due to
% fm

Traditionalhazardand risltaalysls techniques are sulted tor hazads related toprocess deviatíons
from normal operaci:-L These process haaards have ltnown initiating causes and mnseouem.
allotu'nn the sekty hmction to be specll'lcalty designed to detect the eye-m and to resp-end hy
aettieuinn or mailtamin-n a safe state of the process. FGSs are typicatty anotace-oter! to reduoe
the rtslt ot neneral loss of containment, such as leatts trom equipment seats, ftaones, and Pipina,
and areotten not associated with a specific hazardous scenerie These hands can be sme to-
dlefme arte analyse and ohen require the use of advanced risk analysis martin-nes, such as nas
tiso—ersten- tire. ano explosion meeting.
Host often FEBE do not werent hazardous consequences from necim-"mg, tnrt rather mití'gate the
eflectsolt an celerithathas already occurred- FGSs typicaltyreúicethensagtřtude and severity
ol“ the ooelseqoence ierhead of etiminating it- Typiell haaard and risk anáysis metu-nes that the
iderrtitied saietytimction eliminates the consequence. Therefore, ais i::lmortrltl to utderstend and
evaluatetheluzaniscenarioresutting from FGS operationaeensm'ettatlheresidualrislt
acoeptahte-

An FGB mmemmkmmuion due to an inadequate detection rate-_An amiyn's byl-ieallh

and Safety EXECIIIÍ'HB [HSE] of eight years of hydrocarbon ras-ae dia (referat-ace 14) showed
ttsat the effective detection rate uras about 50%- The detection nt many releases was signilicantty
delayed. Seating to higher consequences than expected- Even if very high integrity can be
acltiewed by the hardware design and testing ( e g . . low average probability of fea'ltu'e on demaml).
suticient reduction in risk will not occur unless the detector coverage is also very high. For FES
ftmctioos. detector coverage should be analyzed with the sat-ne (if not starej otranhtatiue tiger as
the ventilation at the average probabilityr ot failure on demand for the hardeaare design.
FGS ehectiweness is also related “to the abllity of the mlttnatlon elements lean.+ tire water system.
verdiation system, process Insulation) to lunotlon ln & way that mouce: haaúous mem
predictahly. Illianatim can inside
BWF-"g
. the m

. Guertitg the m "material

. mlyiig tie mer-m the appropriate fleetr and spraydtaracunsllzs
. anti-caiu alams notify'ng personnel to shelter in place rr emrahe

As in "temene ofdebeemrooverage the effectivenessofthe mitigatiirealionsisdependenton

nmysituaiond Cl“ soenario—specitic factors. As a result of these cmnplesiies, iliat'ng an FGS's
action night not necessarity mean that the consequence can be fully miligalled.

A s a realitoftheoefactors, a comprehensive approach to the hazard and Mamas indicated,

as it onen tifinltt ilo deuelnp a sound technical justitication frl' alocstíng cia reci-dino to FGB
fteudions ta'-tg a som rislt assessment process, such as layer of pole:-Ilan aniys's (LUPA)

Copyright:-1013 ISA.Nl rights moved.

 -1 3 - mmmmmm

[rehence 2 . 5 and 2.5)- The idtmiicalion cf FGB functions end aliocaliun of perfomance tanců
&) Item requires hazard and IH. conáderations that are beyutd typical LUPA implementáitn.
Futhermore, FGS perfomance vailiratim should include evolution ofthe detector coverage and
crmsider the effectiveness of the mitigatitre actions and the safety malability of FGB hardcore
end sottware design.
This ISA technical report describes the analysis that should be mdertelten and the effectiveness
clieria that should be speciied when an FGS ls implemented in : sekty application. The report
integrates performance-besed fire end gas system design techniques htte the applicable pol-tions
oI the safety life cycle described in ei'dter ANSIJISA-B-mUm-zoůe or IEC 81511. The report also
Genesee the development of detector-covemge criteria applicable lie cech F B S function ano
ilchnies a series of applicatim exatmies [Anneat D ) that illustrate the technique-| used to Map
url veriy the detector coverage all nitigaftion effectiveness.

wmeamimm
 'I'Iis page irbnlintmlly len blank-

WMBEAAIFUBM-
 - 15 - ian-Tasemnr-aoie

1 Scope
This technical report is infcrrnalive end does not contain any mandatcry requirements.
This technical report Is intended to be used in conjunction with other good mgineering pli-action
applicable to FGB installations. it is not intended to stand alone crbe a replacement tor application-
specilio practices.
iSA-THBALDUD? is a derivative of the ANSHISA-d-t.0it.01-2004 n e c 61511 Mod) standard with
application tc process industries. This technical report is intended to address detedtion and
rnitigation c i tire. combustibie gas, and tcxic gas hazards in process areas. Fire detection and
mitigalion within ncnprccess areas is outside the scope of this document.

This technical report is intended to:

Be used by those with a thorough understanding ofAHSliiSA-Bt—lltLIH-ZHD-L
Clarity the additional information that shoutd be considered when developing a parametre-
based F E S design. This inciudcd integrating the design activities into relevant tic-“tions of the
safety life-cycle model.
Cladfy how to deline FGS functions within typical F GS dldignswtiene automatic action is alten
as a result of detection of a fire or gas event
Provide example scenaric assessments to den'mnslrate the a|:|piical:imt of perfmmance—trased
concepts to the analysis and design of FGSs.
Demonstrate that any coverage or effectiveness factor beiovr Bitti: recum in a n FES risk
reduction factor of less than 1 0 of the F G S dldign.
Offer a performance-based methodolcgy—fcr facilities using a prescriplive methodology [e.g.,
API-146 or API 1413) (reference 2.20 and 2.211 to aliocate tire and gas detection. The
methodology provides considerations for how to improve tire and gas effectivenllc- The
perfomance-based design process described in this TR can provide more effective hamr!
detection and detector piacement in cases where fusihte plugs (tire) may b e needed-
Define a methodology that addresses the design and effectiveness ct"FGB mitigative Timeline:
that is consistent with the underlying principtes used to design and access theetfectiveneas of
preveptadve ftutetionjs.

References

nrrsrnsnsnnn.n1-enn4 nad 51511"042, Hnidinndfšatetjt seen marsu-mm

terms Processindusaectdc sans1.- B. 3. interním-alsom nimim'-
Res—damit TriangieíParir,N.t1,2t]i_J-t.
uran rs. Nation-di Furs saun cene. tennis-Firermenenmnm ante
Štíři-%: 1933? Fire Balsam amd Fire Mann Eyatenis Earl-21mm aut| t m
PmEil'i .

HSE Offshore Fire and Enpiosion Strategy .“Issue 't:

France—Hink First
cervence. Layer nt Protection Atelvtíe: skusim neseme.
Edition, New cr. Emili.

GGPSMIGHE. Guidelines for initiatingEntente and-independent Rotation Layer! in umo!

Fitet New You-K'Zttitf
Protectionnositele Edit-init. .

canondomisa.nemam
MTRM.UD.ůT-iů1i -1G -

'i'. cus-mmm. Rumuni: fur Channel Fru—anu Quantitative Hluk Antima. a d Human.
New Yuri-:. 1 999.

&. meiiisn-Tea-imna Safety inefmmented System1351_ Safety mag.-ay Levei(aiu

Šaman Tech.-viem. International! Society of Marianum Research Triangl:Pam. H.P...

!. IEG 515112016. Funciinnli SIMM 30l imrrummild SHP-IM! for 1M Hutu MMII?
Sector. Film 1. ! & 3.
1D. M E N S A - 8 4 - 9 1 -D1-2012, Safety c.:-nm, Aiarme and interiecks in the Pmeeee industňee-
gamma.
11. UH. HSE GTO GSD mmm Reise—re Reduction Campaign—Rapa! on the
Hydmcnraon Reina: incident inwuigaiinn Project—filmůmin 3132001.

12. UML HS! UTC 93 002 - Oiilhm Gas Delicia“ Sítiny Gdiirion innsiigaiion af Definici
Spinning. Aprn 1993.
13. IEG annie-231: Explosive atmospheree — Part 294: Gas detector: — oarmance
lequírementa of deieetors far Hamri-jable- gases.

u. IEG courses-2: Expiusiue atmosphere-s -— Paxi &'$—2: Gu deren—iura _ Schein-“i. imieiiniibn.

un und minimum ni Eminem.-': far Hmmm gm: mai amen.

15. I E G E W H — 2 9 4 2 Explosive atmosphere: » Peri 294: GM důl-NIDM - Performa-m

requirements grupa.-1peti: datumem for iinmmnbie gases-

15. A Review of Very Large Vapor Cloud Expioeions', U-K_ Heallh and Safetyr Executive,
Pipelinll and HaIardeua Materials Safety Administralim (U-S. Deparlment uf Transport)-

17. Eniuniian ai Connautniimi Fiuřd Dynamu v: Tn i Gn Gianni for indoor Gu Deiniiun

galium. i..l Mahler. Dr. Ryan Hilditch. Publlihod und Hontu: um cem: 2013. MHOCPS
ympao um.
15. GBP Report daň-F. _Gnnaequence Huge-Wm IMernqmualAaeaqigtiun n! nil EHEIM
Predna—em hiami:2919.
m maila-151_2015 mmm: cum Syna.-ia ihr-ine Fionu mami-fas.
30. nm n a humana-d Francii-ao for Annivlil. nation. .inniniiliioo. Mii Talián arma:
System: Far minim Pfůďliifiůil hemm. !" mnm m r .
21- HPI-me Heuumnmdedpresune farHrammm nm:!emi.-aiunmapu-im em.-q
mier-an Piem 4m edition,auta.
22. FMalobal aanm- mem.-mm Chia eventsMii-4m 291,1.

WMWIMSÉI'MWM
 - 1T - MMM-2018

3 Definition of lenna and aoronyme

3.1 Dettnltlone
Thle eection contains dennilione of torrne that have been introduced or claritiod with moooc to
performance-hour!Fee applicatione and included In thie technical report.

detector (geographic) coverage

The traction of the geometric area or volume ct | defined monitored proc-eee area that. it a hecercl
were to occur in a given geographic looetlon. 1lilould oe detected ooneldefthg the defined voting
arrangement.
detector tecenarlol coverage
The traction ot the hocord ecenarloe from prooeee equipment within a delined end monitored
proceed area that can oe detected oonelderlng the frequency end megnltude ot the heaerd
ecenorioe and the defined voting arrangement.
tire and goe mapping
The onaiyeie oi detector covering: to examlne a propoced or eitieling FGB detector leyeuthioling
arrangement and verify FGB pe rmanoe torgele ore achieved by the deeign.
Foo eftectiveneee
The ability at the FGB function to detect and rriltloate a deeign-haaie haaard under a demand
condition-
NDTE 1 PGE effech'voneca ie dependent on a number of Ícctdre nadcidtaci with ' . induction. librepecitic
gg-emting coricndnns. end maintenance. Fis effectivenocc ie _c function of the FGS_p-ertomenoe m.
Including datech-commas, FES safety availability. end miligalion action attach-veme. mlh-ig faroaerlrioncaude.
common nic-cla. end systematice faiuree.
FGB risk reduction factor
The ability of the FGS function to reduce the frequency of oocunence or the severity of harm.
NGTE 1 FBS risk reducňon factor ie enelyze-d quantitatively for FBS fmctions that pacient nr mpeleiy mitigete the
Inzert! as & techno equal to the recipcoca'l of one[1]|n1inue FES efieclivenees.
NDTE 2 FcES safety fu'ictticmstitet do not oompletely milígelie the hazard, the reádud listi: ieincluded in the aneb-sie
ef FGB risk reduction. Seo Annex [: for example.
FES safety availability
The availability of the tire and gas function designed to automatically mitigatie the consequences
ot haeards-
NGTE t PGS evailehiityic equal to one minul the medaility ot failure onMINI [PFDevgt for theFGB eefety function
(emar. logic cum. ond.tof tinel otemont).
mltigation action etfeottvonoee
The confidence that the final oiomentte) eotlona will auoooaeftilly mitigato the conmuanod of the
heard detinod in the FGB locale of doeign.
NOT! t Reter io Annex B for additionel guidance on niiligetlori etl'ectiveneee.
tocit voting arrangement
implementation ot toou twhere hl:- 1) voting in an FG! le each that upon ectivelion of any elngle
detector in a monitored area iviih multiple deteolore. the logio toner oommende eli-edited eetety
actiontei tc occur.
N07! 1 The errengenient tence to provide e higher level ol eeteiy ln thet e dengeroue undececced teilive o! c ei Ie
detector mii not mnie-t the required action once the hlul'd ie detected eny eecood nedele-d detector. 'e
erren ot eieo provided e relativei hl _ rlevel of eng-otom to | uhoue active lon otthe F_d-'$. oeceuee e feiee elerm
II “Flint“ by I h r Wife det or valil "u" " i l l y ectiontel occur when h d hu“ i t MII.

Modlit voting arrengement

implementation ot hlidani (where hl:- 1: voting in an FGB le euch that the logic eolver oontrnende
epecitled eelety actiontei to ooour only upon activatlon of any M or more detectora in it monitored
area.

Dopyt-loni 2015 ISA. All rights reserved.

onemocní-sms - 18—

3.2 Ahbretriations and acronyms

tooI'l: one out of N voting

1002: one out of two yoting

3D: three dimensionai

AlChE: Ameriean Institute of Chemical Engineers

M_ARP: a s low a s reasonahly practicahle

ANSI: Arneiican National Standards institute

API: AI'IIEI'i-I'I Petroleum Institute

CUPS: Center for Chemical Process Safety

CBW: closed-circuit television

CFD: computational IIuid dynamics

EHPG: emergency response planning guideline

ESD: emergency shutdown

FEED: fruit-end engineering design

HES: hydrogen sullide

HSE: Health and Safety Exemiye

WAG: healing ventilation air conditioning

IDLH: immediately dangerous to life and health

IEC: International Electrotechnioal Commission

IR: infrared
IBA: International Society of Automation
FBS: tire ano gas system
Anu: dangerous unoetected failure rate

LELrl.FL: lower exploaive limitrlower llammability limit

LUPA: layers ol proteotion analysia
MDS: metal oxide aemiooncluctor
llFPA: National Fire Proteotion Asaooialion
GEHA: ůooupational Safety and Health Administration
PEI.: penniuiole exposure limit
PFDawn: probability ol failure on demand average

Copyright 2018 ISA.Nl rights men-rent

 . 15 . www.domaci:

PHA: oroccu hl:-roi ll'tllttlll

PPM: carte per million
DRA: quantitative rielr. aeeeeament

RHG: radiant heat output

HRF: risk reduction factor

$l I-tll'ltv inltrun'tlntcd function

SIL: act-tr integrity lltflt
ete:"tety inahumcntcd svetem
STEL: short-term exposure limit
TI: test interval

TLV: threshold limit value

TWA: time mint-rtu! average

UV: ohm-lom
vce: vcpor cloud citplcalcn
lt
Rlett concepts In FES dollgn
11135 technical report provides a n ovenriew of aome hazard and risk analysis methods applicable
to tire and gaa svetem design including qualitativer semi-quantitative, and fuliv quantitative
methods. to ultimate riek- Hazard and risk analyses are often need to identify toee—of—oontainment
events due to a procese deviation from normal operation- I n contraaL most FGS funolions are
epecihed to address the risk ot lees of oontainment due to problems with equipment mechanical
intimity or other i n l r d i caueu c i t o " ot contatnmcnt not related to prectu hazard analytu
(PHA) enhance regarding e i how the need tor thlll runcuqnt ia Identihcd_ an rice can be
rmoortant to an evmtt rteit management hrat-uv

A performonoe-ůaud dcllgn ot soil-ty functions |: orooecded by annlvzing the hazard and hair ot
oredihie.r-oenarioe ondrcllooating rislr.reduction to eufety functions that wrli be apecllicatly deaigtttrd'
to address these. etrente-. Although a variety ot methods are used In “the prooees industries. e n
invereaeirt-glfgiI common methodrs t_ayerol' protection analyaie (LUPA) (reference 2 5 and 2.6). LUPA
ie an established method for e'u'aluatirtg haIBrdoua event propagation and aaaeaaing the capability
ef safety mentiona in reducing event Ptali.. itn important objective of LUPA ta to enaure adequate
independence and tie—partition at the initiating cause: from independent protection layers “to
mlrrirnile oornmoh cal-tee. dammeri mode. and svetem-the Failure:
„However, LDM dcee have "mutations which tancem clear ii.-hen examining FGB function. WPA
mutt-muy cenerdertt dihltr two panict- statu for :: candidate protection lov-r: wanna or failure it
. : prot—etec teror little. therei t a consequence Il the protectionIny-rtuccendut the mopngetion
ol the hataIdoue event ta haited and there re no conucucnhe. While thlc te ort appropriate
assumption tor many independent protection layere.it is not suitable tor FGSc. eince they typicalltr
do not stop the lose oi oontainmertt event from occurring. instead. a euooeeat'ul FES funetlon
Dmi-'Em an aiready had situation from adding werde. It is. dimi-nt to ensure mat common cause
and dependent mode iailures-“are evaluated between the FES and the Initiatíng source. if the end-
ttaer risk creatio- are based on never-teno the haamloue event [te.-„ predenting- me release et

etme cuisine.uranem—nu,
MWDm-fmm - na..

Il'iitút'liilii.. nn nnlL mauniim mil iii mamina far lni— FGB. Nevmlm. tin: nnnaiplna ii'i init tit-
“M a: und ia plein-:|:guaninu túr iiilbrůvůd.FESinf-guard dum-
T m inchninai runa" PHIIHH : iii-.lt mna-i| in iliuutrnin inn mnam ol mw imunitu. mim lili:
iiiin hn nnaiyna. I i dutinu" inn aut—aim :DWHWI. mint:- availability. and mullnniian
ltluntlwnuii. and lhll'lbii' alia-.v:ihn— tuninf: tn hl q u a l i a l i l y connu-na in the natural and mit
Minimum. Thu modni unu »: mnm-Hud want t r n to illunimin um iii-.h. analytu: nt mantinelů
Inllliitlrig iifiii'itii tram I.tia imlmlii'ru nuuntni to thii llnul autconutiii. Fur "551ml iilmplltliid l'ifll'li
lm tFlguru i ) cenama: litru annual!nf PGS Mfactlwenaaa: datami WFIÍDUU. FGB nalil?
Milabllllr. and miligalion aifeclwanaiil. Whita thin almplihed avan! lm shaw: mltlgutlhn
atlaatlvenaaa na a single prababillati: value. thiii Is Innu.r ta illuntmta ll'iii númnapta. Irl reality.
tha atleatliraniias af mihgaliun antiqua "ra attil'l :: mam :dl'l'lplůi collection af tantal-a. Thi: want tras
bi'ariahaa represent tha prababillt! ni suma! and tha probability nf failure af than-a aspects—thin
mathematical complamantii.

Tha event tree begins With a hazard aiiaíng Tram loss nr maminiriant within an area a f Bahnam
and follows the pmpagalina ahl-"ie ananarin thmugh the aumeaa „na “failure tria) nf each aapeqt
mntrlbuting tn effectiveness- Guantitative analysis can be uaed ta rapu-l ilia relalitra likelthand
and magnituda at the communaut- af each potential autu.—mne. Risk assessment delarmines thai:
lalarahllliy of the puianlinl mmm-nas hanna nn the annaequmne neverim and illielihanit by
nurnpnnng tria-nutnome lmquennif and Wnsaquanae nevanrf ta lh: and-mar rlaii anima.
Faso-unini- Fuss-un FWHitlilllln Hm"
nm:-lu Antal-Iti Itinininlu mm: autumn

m F ii-fil unum-
Ě-Ěr -,
mu ani mtm:
Irina:
Bill!tim nu
l.!ll _ na: m unlim-
fu
nan unmngnnii
FESWI "“-
Figure 1 — FBS affeativannšss model
“ii-.- Tiiat aspaci af FES ztratil-ranami: in tha prababliiiy mat m a bazaru la dataatithia niva" the
detector layout and citam vnitru armngerrt'ant. Far example. Hannan i: iaitan upnn acilwtian at
“mi: nr mara gata Helenium the hazard ia daleatahla Will.,f irl the SGEHITÍD invalvas a gas cloud lhal:
Gawain at lunar lwa dat-edm in the ali-ay. Luis a l nantninmani pingu a demand nn tha FBE.
mquiríng itn aan-.in: army ia dataci inn hai-Hiram canattian and in initial: required action. Fallaci
deimlon ailnws tnc inciplcni canaiucm tn nacnlnia to a in ll' magnitudu went T m "gamma
natural might nnt hi autoalanie air-nimi anianinni in the F a; unit li oriental: th: ř a s mi ht
nat ii- ntiqntlun Iri nim-anima in: larger hazard Thll Gamal-Mili na: nat him inuninarnind inte t .
'i'lllt rnndui in inu lin-hmm! maart. Far tha null- nl ulmpumlyl ||. ||! nnumud ihnl tin Inclpltiti
ůnndlilnn that is nat datumu dua in mndcqunln dnt-nim novemu vnutit l'i'inn unmiiinaind hanna
tl'iiil l l :|.t tha capability ol Iti! FGB- li: altaallirulir millgiilu.
Th: second branci-i ni Ilit ava-ni im (FES ani-i availability) Wann- thn igi-nluiilillltir ai-
iiuuuautui FES activaiim "WH : animated hazi: . ras functions mailu annaafliil..'lagt=-
numerisi. and tinal alumi'inllal. Failure uf tina FES lunatiim lu upnula lin dámami mann lti

. mm-ÉÉÉA; Hmmm
 - 21- lůWůDDT—iůtl

escatalion of the corisequsnoe. ůuanlifieation o f the probability of failure on demand can be

performed using the techniques presented in ISA-THBLLUIIDE (reference 2.3)-

The third branch o f the event tree i s the FGB mitigation action effectiveness which has a n impact
on the event dutcdmee and should be carefuli considered when avaiuaiinp overall eflectiveneee
of a n FGS function, The deelpn intent o i an F a ie typicaiiv not to prevent a haeardaue condition
tram tnltlolly occurring. but rather to redace (ar mltipaiei ine eeveritv ai consequences to a lower
level- a. small tire is prevented lrorn becoming a large fire that can escalate into a larger or
unacceptable consequence. A small gas release that presents a toxic andi'or fire hazard is
prevented from becoming a large gas accumulation that could result i n a larger o r unacceptable
consequence. Therefore. the residual rislt associated with a successful F B S operation should be
considered i n the overall determination of n'slt aocephabilily.

However. It would be lithl'llctllly incorrect to caneider tne FGB detector coverage. safety
availability. and mltipatian eliectiveneee in the same manner ae arie would consider Independent
protection layers. The separate depiciiarr in the event tree ol FGB detector coverage. eatetv
availability. and mitigation effectiveness i s simply intended t o highlight the aspects of the F G S that
matte its evaluation different from the typical instrumented safeguard- Personnel involved i n the
design o r modittcation of FGSs should consider that any change to the FGB or t o the content i n
which i t is installed will most likely result in changes t o the values o f all three o f these parameters.

Diilerent methade wiln diilerent degree: of quantitative ripor are ueed in the procese Induetriee to
implement the concepie dlecueeed in the preceding paragrapne. Theee methode range tram semi-
ouaniitatlve techniques to iull quantitative nett analysis rosa) meth arie. A quantitative rielt analysis
can b e used to mal-te decisions about the rislt reduction strategy (reference 2.1). The DRA should
be based o n a comprehensive risl-t analysis a n d consequence modeling for the hazardous event
under consideration- Semi-gu antitative methods utilize scoring methods that categon'ze the
attributes that define rislt and then select grades of F E S performance based on the results of the
scoring process (eee Annex A i .

Where poeeiale and practical. ather inetmmented ealeiiur eyeteme. auch ae eatetv lneirumenied
lunctiane. anould ae designed ta prevent iaee at containment, The development at a methodology
to allow the allocalion and verification of the rlslt reduction capability of an FGB function should
not be construed as a n endorsement o f the use of a n F G B function i n Iieu o f a properly designed
preventive safety irish'umenied function- Thus, i f rislt analysis determines that two orders of
magnitude of ríslt reduction i s required to address a high-pressure scenario i n a vesseL a safety
instrumentaci function e l ů E i l t D i n l e t feed to t h e v e s s e l upon d e t e c t i o n a i high pressure w i t h a rřllt
reduction Ut tWů ordere Cif m a g n i t u d e 't! p r e l e r a b i e . This t e c h n i c a l MPM dili-II n o t Chilli-tfii
addreeeing the above hazardaue event with a eatety Instrumenied fu nctlan achievinř ane order oi
magnitude In camainaiian with an PGS function providing the remaining ane order a magnitude in
risk reduction. This technical report focuses o n the implementation o f FGEs t o protect people a n d
the environment when the process is operating normally. but toss of containment has occurred due
to such factors as corrosion, erosion, a lealting gasltetr or tubing failure, o r the process i s operating
abnonnally, and preventative layers have failed. Thus. consider a different seenario where the
pressure i n the vessel i s within tolerable limits ( e g . . not hight and loss of containment has
owned. In this scenerie. an Ftls function ie an appropriate chatce lar reducing the rleit. because
thelůitl ltd Ectintldl far implementinp a preventive "illy inetrumented function t d prevent ioee of
con nmen .

it i s advisable to use a n approach that ensures:

. Loss of containment i s mínimized through implementation o f preventive systems and an

equipment mechanical integrity progam.
. FGBe are deeigned end maintained to be etlecthre in reducing the eeverlty af lose-cl-
aanteinment.

CopyrigimlBISA.Nlr'ghtsreserved.
IMTHMMQW-iůld -22 -

4.1 Performance'hased FES design process

Design and implementation of an FGB can be perfonneo in a manner inet le consistent with the
unoenylng princlplee of oothm e u e o - u c o o t - z o o i ono lec 61511. The funoonlentoi approach
to to exonline the hozorri eno rici-t ln order to eeioolillil required Fi'is performance. ono then io
epeciilr a design thai achieve: that performance. This perfomance—based FGB design procese ie
illustrated i n Figure 2 , and it integrates into the relevant poriions of a safety..r Iiie ctitele for safety
functions.

Planning: ------ Fire & Gas Hazard Assessment

Fire a, Gas Phllgmphy 1. Ident Areas ol Goncem
2. Ident Hazard! Risti si:enarios
o. Analyze coneeouencee
4. Meine Heeerd Frequency
e. Mecce Unrnitigeied Hecerdr iiieit

E- l ! Requirements
: &. ldeniify FGB Pertonnrmce Requiernente : Specinoatlon
I i :
I
: 'i'. FGB eonceptuei Deeicn E
I.".'.'.'.'.'.'.'.'_'.'.'.'. '1'.'.'.'.'.'..'. ''''''''''
: ' : Feriomlancs
: o. verlry Detector Coverege : vadneatlen
. i i
i o. Verity Fee Barely Availability :
:|
i E
.|_ iii. Verity Effectiuenece of FGB Aciione
:
I

11. FGB Effectiweness [Mitigated Risk)

HDTE elm ?. e. e.me to nlerreouire iterclíonle meel pedonnerioetergeie-

Figure : - Performance-hned Fee deeioh mou"
4.2 Planning: Fire and gas philosophy
Henning for perfomance-based FGS design should include determination of the end user's tire
end gas syslem philosophy- This philosophyr is a well—reasoned technical basis that establishes
the Overall goals tor hozoro detection ono mitlgetlon. It eho-ulit oe ooneisient With the end ueer' e
rieit occeoionce criteria thoi will be ueeo in the ollocotion oi eoiety iunctione to protection lol,-fen.
li ouioee choices made by s e s designem. Appropriate choices ior a given ueer facility ore often
best performed through standardized application of a tire and gas philosophy.

FGSs are beneiicial i n miligaiing the sel-ferity of haIards typical in the process industries-
Mdiiional information about these hozoroo can be found in CCF—$ (reference 2.7). The oeocri lion
here to Ihienoeo io old in definino Foo performenoe ohiectivee heeeo on the ciioeerl philoeop *:oi
the end Hilf.

Goprlighi 2015 ISA. Allrm: reserved.

 - i! - summer-cote

To understand performance requirements for FGB. lt le important to have a dennitlon of the end
user's philosophy that le being applied to rnltlgsle hacards. Miliostlon systems usually need to
have a philosophy developed before a designer can proceed. Different users of this TR 1.irill haye
different philosophical approaches toward detection and mitigati-on of fire and gas hazards. This
section describes how the elements of the tire and gas philosophy translate to perfomance-based
FGB design- Some elements of a mitigation philosophy are included in codes. industry
recommended practices, or company standards. However, elements associated with detection and
mitígatíon are usually established by the end user.

The primary questions to be addressed in detinlng the perlormanoe objectives tor tire eno pes
rnltlpetlon:
e What magnituda of ha.-„eros should the FGB detection equipment oe designed fortl
. What FGB actions are required to successfully rnltipate the hazard?
This TR proúdes guidance on how the chosen philosophy will impact performance-based FGB
design-

4.3 Fire detection philosophy

When ttamma'ote or combustibte hydrocarbon liquids are released from the process. ammulate,
and are subsequently ignited. the result is :: turbulent diffusion fire. The extent of a post fire hazard
ie governeo by the else ol the peer. the burning intensity ot the fuel. ono to a lesser extent.
meteorological conditions. When preseuricecl pes tor liquidllwoipholl) is released and i hlted
Immediately upon release. the result is a momentum-oriven. turbulent _iet fire. The extent a jel
flre hazard is gayemed by the rate of reieaee. the shape of the flame. the liarne orientation, and
the burning intensity of the fuel.
Both pool tires and jet fires emit thermal radiation, which can be hasardous to people within
seconds of exposure. Process equipment or structures can be d a m a g e d within minutes o f intense
fire exposure, especially if fireprooting is not provided or not effective. Fires can produce heavy
smoke, which is hazardous if introduced in an occupied building- Personnel can b e hamted either
by the direct effect of the ignition of the hydrocarbon release or by exposure to an onpoing tire if
the ability to safety evacuate is impaired. Fire detection can be benefiolal in the letter case. by
detecting an inoiplent fire In lime before further exposure to personnel or impeirment ol evacuetion
routes cen occur.

The ectione that are meet effective In the early tlnolplent) etape of e flre are:

e atanrte and evaouatlonfshsltering of personnel

e- automatic emergency shutdown (ESD) with isotation of href and depressuriaing
. activation of deluge systemsft'oam systems to suppress hunting, cool surrounding equipment,
or, in some cases, e x t i n g u h the tire
lt a fire is not detected sady tincipient). the potential existe for the fire to escelete to a hazard that
impact: more equipment. impecis evacuetlonfepreee. and causes more severe harm to people and
the procese.
Fire detection philosophy elaternente are ueeful in detennlning the performance oblectivee of fire
detection system. The performance objective wlll pulce the designer on the magnituda el fire thel
should be detected and the safety actions to be automatically activated. With a specific philosophy
statement. the FGS designer can identify the performance objectives, and this will guide the
designer to choose the proper basis of design. Without a welhdefined philosophy, the FGB
designer can provide a system that is over-designed or under-designed and does not achieve end-
uzser expedations. The following are two different philosophies for tire detection- Each is valid for
a particular application.

W 201!ISA. Alldihtlm.
mramor-sms -se-

Turie 1 - Example fire aman- ptlthsephles

FiebateetionPhiloeeýrf mammogra- Týdnů“

Gmi amdetedfreeaeeíyss Whamňoled Wřma
padtsllnrerfueetl'leposáňy Windpientiira l-igh-sdaeassds
efeecaiaiimninimiaaimmh &meeshiFGSniigaáon
handaumpseermlh Muammar-„il
. purptavaoustionormihsmh Simicu!
m siamrotil'leefjnn
. Minimal
. „“Where-osad
. tvemfandfnnmueioeďehmdw
“amending-orion“
W nemam-admin:
mmamngáiám
WFGBnňigaňcn
. WWUMWHJ
áa'mml'a'lcatinn
. sl'uhdumvorrlilalim
Mandaeafreltethmh tiit'ioamúefedpmceam
“WWW“ Wmdevstoesdie Manana—hltanu
hmatovou &reoessdGSn'rllgeoiol-r Wae-hier
mainlmmm
- Hostinec-Immuno“ '
b'!
deolsbonofftol
humorem.-:mad:“
nasem Irma)

l'a'onpractical to deteetd potential tire hazards- Detection manner of an incipient tmu (earlyr
stage) or a fully developed laazant. Note that with longer Eee. optical flame detector perionranee
night be degradad. Safety actions can be as sirnpte asanofau'nment and isotaňoo offuel, cr as
oorrmliacated as isolalím„ depeessurizing, and sup-513ml.. The tire detection piiosophy should
specify 'rf alarms and FGB actions will occur on a single detedor in alan-n state (team ar ramku
more than one detector in alarm state l e a . . ionu).

4.4 Flammable gas detection phllosophy

Hien nammahle gas (or volatie liquid) is released hol not Methodistelv ignited, :! m fuel-
a'r mixture forms. which len amanulate andlor Mate my li'nrn the pohrt of release. Safe
cm:-ersten occurs when ine gas dmtes in air helovr the Inner fhmmahle limit (LFL) or:-nemenim-

I there is an absence of plrysiell mnt'rnement of the flarne front and ahsenoe of flame front
iieraction with turhulenne—iedueing ohstacles, then the ita-ne will not significantly aeeelerate. If
igied, the initial phenomenon is a short-duration, omnia-rt fire that hurns from lhe point of ignition
het-gh the gas cloud in short duration- The llarne tmm expands slowly near the noir-lt of ignition.
h the event the flame froult does not aocelerate. the vapor cloud fire will not produse a siprifrcanl
presswe wave Chlast). The frre ie therefore called a hash fire. A flash fire ls haaerdous. but the
esteru ls llmlled to the shaaefsiae at the flame envelope itself.

milever, gas can acmnnrlate in contin ed and seni-eonfined areas of a pro-seas- listuieolljr. a
niimum gas cloud aeurrmialion of 5 meters (reference 2 4 and 2.12) 1.lvas demmstra'led to he
seilirient for enabling a Ene front to aecelerate to a vetootty that has the potential to eouse a
significant pressure wave. This does n o t exclude the potatt'eel that under adverse conditions, an
amnnulation of less than 5 meters might result in siria' hazards. This pressure slave is also
wed a hlast, a n d the plsannenon is known a s a trap-rr cloud explosion WIZE)- The arteen of t h e
UCE hazard is governor! by the amount of gas aoctnmialion and the degree of oorrlinernent and
namestim. and it can be med a s the pressue generated by the blast and is duatlon.

memensaumm
 - 25 .- ISA'TFBALULW—m

Parconu! located outdoors are otten not írtiured by the pressue wave itseii b u t can be huit by
Holt-velocity hagtnents. Hon-blast-reslstant shucha'es can be severe damaged or collapse.
musim hana to building occupants. Blast etlecls can resim in haaards at significant distance
beyond the bomdal'f o f the fiammabie cloud.

lt ted-stable to detect tlammable gas before ignition. especially i t i t i s in a confined and cortgmed
area where the gas can accumuiate. FGS can be benetiúal in detecting the presence of a
What-air mhtmre (or detecting & release of tigh—ptessure gas). Automatic actions can hl:
m by the FGB to minimize both the possibility of iglition and the setrerilgir of the vapo: dou!
tie hazard. Actions that are most effective in the eau stage o f a gas release or accmntlalim ae:

. alla—mt! evacuatiohtsheltering of pets-mnel

1iii.-ilh
. mumie ESD isolation and depem etpilnent ital: can b e Ieaking gas
. ostatni: control of ignition sources (electrical de-enelýzalion, etc-)
- activaiion ot deiuge svstems to disperse gas and sempre-a huning of the gas
ln Ius context. eartv detection means beta-e a Iigh probability of ignition or before a large
acoteoilation occurs. i t gas is not detected earlri them i s the potential for further acmuatim
Heating in escaiation to a more severe hazard. i\cloding the potential for a VEE. or forgas to
migrate beyond the process area to iocatiaons Mare it“-ete is either high personnel ocmpancy or
minima:—owoce.

Willie a ten seconds o r less, a vapor clo-t.td hre will btm back to the point of ignition and me
the hazatts described above; however. the afterettecls can include a residual jet tie (for &
mnmhmdliven release) o r pool tire (for a limit! reieaseu'pooling). or perhaps both. The reeiihlal
tie 1litil continue to burn until the source of the fuel is isolated a n d any accumulated fuel "u
censu-ned- Widle i t i s highh.r preferable tio detect a Mobile gas hazard before ignition to
aafeguauti ife„ F G S can also b e benelicial in detedíng lie residual tire and taking actions to Iini
its theatiotn and intensity-

There ae seveial different philosophies for W & detection. Flammable gas detection
can be appied to detecting either a n acmlalion of gas or a release of gas- Actions cotld Ile
pronlpt attenuation. sheiter in place in response to an alarm notitication, or acting to limit the
mmm and ignition potential for a vapor cloud. The Folio—ím a r e two different philosophies ice
tlacmable pes detection. Each i s valid tor a particuar application

manganistanu-nem
[EA-TRBQMDT-HHB _25_

Table 2 - Example eornttuatlble gas detection philoeopltiee

Hann-hle Gee Detection Eternal-tte of l'hilitieiaptrii|Dechian

T.
FMMI
„%
Deu-eteredtaegaereieaaeehv Hdhhanwttafaderae
Detection“:Leatdreieuoweeeletdiumue'WJId
“WW““"““„mam
mmmagmewfu „www.ttmemwmmmw
diumlaaehd'n ' taelluaureetta 'inti'

mona-an tiene “Wm-mmm.

Heardův“ me SumetfulFGanvt-geiim:
medem.
. moenwm managery-mmm“
Mmtoeuiamrht esa:
Migration omamnou: area.-
Dtteeban: VIMI'IDH m gneleua eee na direction nehet táhne
latery detector layout end eureng ntll'iin edenim tree lem el
meu lm neutrin. Beaute nilt'tln neuen are autumn
Mil domenumam a accent are . detected vad-n efron inte
ehodd he malem-tme: with perimrttr get Medion hure-on
mm thetthe relem uuu Hachette artera fregatu-guaninu
igi-titan nauce aurea 'AllIt hgheraeeuatntv ena Imre—ehm
Saucerful FBS mt-getan:
Imran-mne magnetic ulelv ard dev melanomu
ehm tur rubin-lieESD!
Hani: : mam area:
Detection: Gee dupou-lionpultem might habent-ideale.mape
heard: ent mort m r e in m e m u u aan mnich—dtm
earňned mamuta-domenu m. ahmidhetlewdit
na: niternou den hmmm: in odtrh: milionem
mrtafa-at volume tlutaen result in a m mmm—aimed
'l'npeir ettral ilthgrltjlur unpgjreveouelienfem
Stmaaful FGB nitigaiim:
. indolu fuel eouree enddepmeauriu
- domin ele-china! apparent:
- dramata personnel tu solely
Wine amoniaed'eree:
Detection:Heliabie debedimeemnctbeaaled in mm;-adam
ruimmlate [ebemoeofmnňnemenh'ídumelíonl nařeliaeeveriy
ut'enignied gesetwdďřňghoomemthebdtebeerseventyďa
mdmdfreiínoHCEj. CTBIÍÍE iedteoeradueehaddbeidedřnd.
múdeteolimďgaanigatimshatdbepmndedatremmeď
dorucen (detection atl—WAGeErittakeG. ele).
SLDDBEEMFGSnítigalim:
. dama: Shelten'evemete pneuma!
. de-emrgize electrical apparatus

lt ia- impiaclical to detect all gas Ieaite, even all Ieaks that could be haIaJ'duue- Hele-ase enureea
and direction of díapersiun cannot always be predicled with certaintv- In some Iomliund. where
gas can be dispereed by wind or ventilation, a strategy of placing detectoro DI'IlY around Iiltelv
release source: can have limited effectiveneoo- The gaa detection philoaop'rqir should specify il
alarm: and F B S executive actions will occur on a single detector in alarm atate Modlit) or require
more than one detector in alarm state (Zoot—l). A well-defined philosophy vrill guide the FGB user
in determining the correct performance ohlectivee.

4.5 Toate gae detection phllutuiiph',f

Toxic ga: detection invalvli an analvele of a epeallie a attention. ae generel guidelines are difficult
to tet due to the widelv varying hadarde ol dlllerent tot:: materialu. the vadatlone ln danemtretiont
dl todle materials. and the high dependency dl toxlo haaarde on elle-temito ladem. indudlhg

copyright aute tail.. All rlghte renewed.

 — 2? - ISA—THB4.ůů.ů?-m18

“analogy Therefore, one W "s to select a hazard acer-arie aid model the extent of the
Isa-zad (eg., dispersion, oornprm ihlid dynamics [CFD]:|. To model a toxic gas hazxd,
onrusider the smallest hazard soenaio that vrould require deteclicn: tlis can be based on either
riator a team-based review.r and should be likely to occur in the project lifeli'ne. A second approach
is to d'l'ecttv postulate the maglihste of a toxic gas volume Hat is of concem and then design
using a geographic technique (e_n. 5 m HES cloud size. El m H.?-!$ em size:-.
The objective of a tcxlc pas detection system is to detect cmmuations ol pas that could be
luzardous to personnel ln time tor proper protectlve actions to be taken. Molnatic actions can be
uren by the FGB to minimize ete severity of the hazard. Actions Ilut are mast effective In early-
stage of gas release cr acc-mutation se:
. m atd evacuationlsheltering of persomel
Iliuith
. ammmňc EBD isolalion atd dep-ensurizing equipment lu! eu be Iealring gas
'I'hefolon'ing is a n example plies-ruthy for toxic gas detectim-

Tahle 3 _ E!E—it“: talit: g a s detection MH

I'ma"hhitmen" Huila-lepil! MHW! Decision Typical

„mademw Wants-storico"
manganem WWWNÉMHMM
Womanityhrslaaas W-MHWMMDMWDMW
manin'rniza pctmtiáfcr meamamgaammbnmmm
uhňaddlaliongashazsl'dtl'st "lonely-.
“"Bůh“ Marsem
! - áambemmalaperscrmeltoaafsiyu'slrhadů-mtdad
Wai-emplorautomticEsm
Iamm enm'tofadalea: mmm
Umím: 'aingasdouziatcea'lziůadhtmishm "armádu-m
madamlawmandspadngmúanuhadmb facilities
actiesselpcsehaiaslrscmsriss. Basama-el
mehdmnsuaossssras. delsdicnumiwsmemdrss
shmidcesocisnurlsdnlthpsrifnstsr
*“
dots-crime Motion
Mmmmrrprcviconlldme Hummel
mew-Mmtcsnlmwmmrdm
mnm
masem
- mtmwndm aida-“hmm
“Wlaautmúis

4.5 Fl'e and gas hazard assessment, requirements specilicalion, and

performance verilicalion
Dellemining the target performance of a n FGS function should be Wed using hazard atd
r'utr mahsis- In this context, perfornmnce includes: safety avahbiitr of the FGS equipment, the
mape of the FGS detectors. and the effectiveness of the mítigative actions A design for FGB
miigation requires input from ete ent user s f re and gas philosmhf tn terms c t establishing the
per-lorrnance objectives.

Techniques used to select target FGS pedommncs should cortsider parameters that affect the
hazard and n'slt. Thev are chen appierl on an equipment-item oasis udetermine it an FGB shaun
he outsider—ed tc protect each eqiprnent item and, if promin is required. what degree of
performance should be targeted in the design. The hazard atd risk meters that should be
ouruidered itclude the following:

Watersem-19mm
IMTRMDůDT-Eůti . 23 -

+ material itammahllttvitottldtr
. process temperature
. plocees pressure
. hazard frequency.r
& soutce Iealt size
. ignition sourooo
o potential tor atti aooun'luldtlon
o environmental oondltlona
Two lvoioal strategies for the haxard and neli assessment for the selection of FGB nei-immer
target: are used in industry. These hire general approaches are referred to aa send-quantitative
and fully quantitative tisk analysis- 1tiltihile the fully quantitative risit analysis rrtethodotpgies ara
more precise, the semi-quantitative methods are also aoceptahle-

. Semi-quantitative risir analysis has a level of effort similar to layer of protection analysis
(rate-rano: 2.5 ano 2.61. tt uses lookup tables ano "order of magnituda" selection: to categories
various iii-lt parameters and mereni; oatoolish the needed ooriormonoo lorqoto. Theta semi-
quontitativo toohnlquu need to od oatibrotod to lnaurd that t o m oooru level-oi-etlort tool.
provide oatltiootorv ruutla. Seo Ann-it it tor on automoto of a unii-quantitative naurd and
ridit analysid-
o Fully quantitative tiel-t analysis vei'il'iea that quantitative risk toleranoea have been achieved
using detailed quanlilicatien of the hazard and tisic. Whie the holit.r quantitative analysis
provides more accurate results, it is also more time consuming and can tte resouroe intensive
(see Atmel: D).
The following steps are tiroradlnr applicable to both strategies for hazard and risk anáysis.
ii.d.1
Stop 1 - Identity areas of oonoorn
FG! inatottoliono in the promo induttriu oro would-oliv doolgnod to oddrua liquid: oaaooiotad
With idos-ot-oontalnmont event: oouaod oy lanka. corrosion. and orollon. ln many dont. r a s t
are only expected to provide generalprocera area coverage. Under these circumstances. the FGB
design can tal based on simple prescriptive practices img.. references 2 2 and 2.3). it available
for the application. In some process plants, their implementation ls benefielal, while irt others use
of an FBE 't's unnecessary- Hot all process plants will even undergo a formal anatysisol PGE
design requirements. The determination of whether tunnel assessment of PGE design
requirements analysis is required “i" be the “result of end-itempouďesipreoedumninndI'Eg'tJÍEtÚlT
.

Mittalem. snah as;-

1 droom nosoro- onotlrall tři-ut:rooon'imandottona-

. dHAiai FGB
- and-user standards and design maiden
.—

realitami-y requirements
auditor iecdtrunertdatinna
PÉE screening analysis
e previousincident::
Jin FGB screening ondivala can be used to identity areas el ooneern where FBS installation aan
hl nenolielnl ll'l reduomq ook. nn FGB dementni: anulu-l: should oonaldlr the nerentabilitu and?
tonloitf ol lhl motorista bling pronese-d. union would identity diodou novtom-nt tnnt toordunu
en ono ol edita-rn tor oooulolo poriotmonoe-itaald FGB design. the plot. plano. prdu“ lloliv

dhammamuttamam;
 . 29 . ISA-M.DQDT-Éů18

diopron'le. heot end meteriol bolet-ice. ilncl Pointe ehould be onolyeed to identify the prooeee
meterioltet end normoi operating conditions. end whether the rnoterlele prooeeeed oonleln llre
hourde. comhuetlhle ooo hoeorde. or tolilc poe hoeerde.
ll.! Step 2 - Identity hiul'dft'tllt idil'lil'lůi
Fotomonce-ooeed FGB deeign required idenllliootion or record eeenorloe tor which Hits
Modem are designed. Attl-iouph the FES is expected to perfoim ort dorriond for a vrldo ranpo of
general hazards. a few specitic hazards should be identified tio establish target performance and
allow measurement o f achieved performance.

Major equipment items should be analyzed to identify the type of tire or gas hazard, and this should
include storage lanlts. pressure vessels. pumps, compressors. separation equipment (distillation
totvers. etc.). and heat eschangers- The type of heeard depends on the process ttuld composition,
ttte process conditions (temperature and pressure). the state and duration of the credihle release,
and the type end locotlon of ignition sources.
Performance torpete ore defined with retpeol to the hozord ecenortoiet lhot FBS deeipn ie Intendetl
to detect ond odequotely rnitlpoie. Thle etep con involve direct hoeord ldenliliootlon (o.o.. dd ilw
radionl heot output tire. td rnl comhuetihle pile pcournulittlon. 20% LFL ooouniulotlont of
ldentiticntlon ol oredlhle ecenorioe involving releoee pl hazardouti material thdt oould plve rlee to
hre end pos hosordo. These include corroelon-inltloted leolio. tlonpe pocket leoliii. ond emoll
diameter tuhlnp failures. Where scenartos ore selected as the hostil of deeipn. the analysio ehduld
consider the attributes ln outliciont detail tio detennlne the potential physical oiioraotorlstloe of the
hazard scenario. such as fire s'oze or gas dispcfsion extent.
This step results in a list of equipment items and assoctied hazardslfscenarlos that are _lTi
forward to subsequent steps.
4.6.3 Step 3 - Analyze consequences
únos :: hre or gas scenerie is idenlilted, s consequence severity study should be undertaken to
determine the physical extent of the hecard and the potential to eseelete the severtty it not
detected. This either take: the tomi ol o model thol predict: the physical etlecls of the retence. or
ie hoeed on qualitative teen PHA letim ]ud menit or eemi-quonlitotive techniques. The end veer
ehoold decide the onlerlo o n o to onolyze t e eiitent of the unmitlpoled llre. oomhueilole poe. or
toiiio oce nosord econorlo touolltotive. eernl-ouonlitollve. ondlor lull ouontltotlvel. The following
eeotione oddreee ouontltotlve melhode only. The oppllcotlon ot consequence modeling ie not
addressed in detoll in this teohriicol report. l'teler to CCF! treterence 2.71 tor more guidance.
end.! Fire hoeorde

For tire scenarios, the extent of f'l'e and themtal radiation effects ale usually required to detem'lino
detector layout requirements. Fire detectors using optical or visual detection means are sensitive
to the amount o f radiant heat output from the tire, but limited by a threshold amount of radiation
received at the detector below which a fire cannot be detected- Consequence models predict these
physical effects as a function of orientation and distance from the tire. Results of fire models
provide the basis to determine the number and location of fire detectors necessary to detect a
given tire scenerie.

The tire onolyels ehould identity o threshold amount of rodinnt heat output that can mutt to o
potentiol hozord. or eeoololion of it hourd beeed on the type of prooeeelnp equipment end leyout.
The criterio thould he ueed oe the end point for the llre coneeouenoe onelyele.
end.: Cornhuetlhle pile heeorde
l'or e comhoetlhle poe hoeold. consideration ehould he given to the dieperelon end potential
ammulotidn of pos ln uncontined or smí-oonllned areas. and "hmotu should be developed ol

Gopyt'ight2t11t3 ISA. All rights resemed.

ISLTRMMDT—ZHB - 30 -

the extent of the oon'rouslihle gas hazard. Although this can be accompltahed oy delinlng the
volume of the gas aommuiatioh ol concern, gas dtsperstdnlaccurnulation modeling and explosion
analysis ln contined or cor'rgested areas should be considered.

Baa dispersion anatysic using simitanty models ia adequate tor same outdoor loeetiona where
olap-etalon is only affected oy mcmentum jet eftecta as well as atmospheric effects. Diepersion
modeling results should be generated for concentrations at the threshold tor alarm tor gas
detectors. Similarity models and other cimplilied empiricdl models can be misteading when
etudying gas dispereicn. especially tor indoor releases. Simplified models can yield uastly different
concentration profiles than tuti computational ltuid dynamice lCFD) nrcdeis. tn moet casea,
ventilation and geometry dominate the diepersion. ec moel simpiihedrempincat models cannot
accurately capture this tnlonnation to a sulticient resolution. Further. elmpirlied mcdele treauently
Willi solid surfaces. These play a significant role
do not account tor turbulence or the interactiontropor
in the shape. else. orta concentration at the cloud and thue need to co etraluated with
eultlclent resolution. Gee dlepersicn in ccnllned or cchaested epoces or enctased volume should
use consequence anatyete methods lec.. CFD) to elrantine concentration arctitee under the
influence ol lorceo ventilation systems rather than atmeepheric eltecls.
l'or liammeolerccmoustiole gas hazards. thedpae concentration to the tirirnenir means ct potential
hesard detection:hoeever. the actual hasar can include one or more ol vandr cloud eliptcelch
iconllned or semt-continedi. tire. cr tclria inhataticn elrpoeure.
The hazard is a tunction of volume of haserdoue material. concentration. and level ot continernenl
in the case ol \'o cloud exploeion. As the volume increased. a more cerne hacard becomes
more Iilrely. Therefore. the detector piaoemenl is predicaletl on criteria to detect the gae
concentration early enough that action can be taken before the release becomes a larger gas cloud
of potentially higher concentration- With earlier activation. the hazard potential can be Iowered
t e p „ maximum explosion oucrpressure that could be toiereled without severe damage of loss ol
lilo). The development of these criteria is provided by CGPB treterence 21) but is outside the
scope ol this technical report.

16.13 Toxic gas hazard:

For facilities that store. handle, or proc-esa toxlc gases, the worst crediale science-io odn be a n
unoonlrollecl release of a toxio substance to the atmosphere. Facilities that deal with these
substances qEnetally' íl'lttest in equipment lla handle the substance- such 35 Vents to Hanes;
scroll-bere, tncinesalors- or alternate oantainrnenl. uissaeis. The failure ai this equipment, its
controls- o r t h e piping systemilzself lleaits. erostoh, and corrosion) can lead to otelwse- Gas
detection Stratenie are-onen utilized to help miligate this potential hazard?

it is common Ptacttce for companies handling tento gas releases to cortduol dlapetaion neodeling
of credilale scenarioe to delennirle the potential elfect of a given release. Dlapetsion modeling “till
address plant and surrounding area topograohy iniorrnalion, leaI-t rate rrrloonatim- plant.tueathdr
data, and toxicity information- ERPE temerpency response planning guidelines) numbers of lDLl-l
timmedlalely danger—otra to life and heath) number-rrr are alten terenu to characteristic the eutenl at
“the acute toxicity hama.

The desigh rnrent a l toute gas detection is to mitignle the ne'-rarity at the unnlitigaled hetero
aoenerln. This il' typlcaity aceompiiehed hy early detection-malachit: il'l mcroelfecoue ert-tiergci'ltltii
reaper-ine, conte'rnment. or the attenuation .at personnel to a. sale location Unmiligat'ed
cornequeheee should daline the attent o l impact of the unrnitlgaled hama autama.. which edn
include-onsite ondror potentially oltsrte consequences.
esse Eecalatloh ot mmmebie and totrla l e s haeartle

the enim. intant at line and ga- detection te. ueuelty to mlttgate eo cimca timeout attention.
'i't'rte re trainery accomolrehea oy tlmtttnp the eirtent at the heaerd'cn ih carne cash. manner

cement aale tailn atimenrum-e.

 — 31 — mm.m.or—2o1 B

adrilimral lime before escdalion to an! for elfeclive emergency resources ard containment
mm alowfor the evacualion oď pelet-mel to a safe location-

ln arlriiion to an incipienl tire or gas release scenan'o used for establiáring detector location a n d
placa-ent. the consequence acrialyás mnu include an assessment ol the potential outcome of
tim scenerie if unmitigated by the FES- This could result in escalation ot the Interdous event into
:: larger. more severe consequence than the scenerie selected as the basis ol design tor FGS
detection. This severe consequence represents the potential cutoorne ol FGS lailure due to
inadequate detector coverage. poor FGS availability. or Inetlectlve midgation actions
esse outer consequence modiication factors

Dmeancy, lime at risk, and ignition uuhahility are other factors lhal crrricl lrc considered vvhen
msirg rislc to personnel safety. 'I'hese factors should b e justilied hurgh scenario-specilic
matysis that ensures that these [actors are reasonable a n d appropriate fu“ the scenario under
consideration. For example. commancy Ecely changes a s plant personnel responcl t o potential o r
redmd loss o f containmenL l n cmhast. the Iilcelihood that a release is narmnahle i s dependent
l.i'ilhen
on the chemical properties release size and location and dispersion potentní t'lammable
Equus or gases are involved in the scenerie. it i s possible to estimate the potential for a tire or
explosion using qualitative. send-qualitative. cr quantitative methods Ignition probability data tor
cunhirstible liquids. liammabie liquids. cnd llammahle cases i s provided byl:-“CPS (reference 2.71
Grmioeon determining eppropriatevalues tor these lectors ls outside the scoped! this technical
report
ice.-r Step nt - Analyee hazardpomocy
Before establishing FGB perlonnaroe reqúrements, considerations should be given to the
ieirood o r frequency o f the hazena-[s] tlmtcould result i n t h e unmiligatedlescámed consequence
seuerity. Further, a decision can be made moct the tolerahility of a n unniigaterl ň'e a n d gas rislt,
Ulrich can guide decisions about the scope of a n FGS design- Release frequency can b e
determined by applying databases of equipment failure rates to the idenlilied scenario, but could
iso Ile based on qualitative (e- ., PHA temi judgmenl) or semi—quarlitalive techniques.

ln nuny cases. a rislr scenerie arises from equipment damage end faitue needianisrns. such as
general corrosion. that are well wider-stood In these cases applications! hrdosti-y lailure rate data
garanta he considered. For chmele soda databases include leolt "m tor oomponcma. .
srt-oh as prom Hannes. pressure vas-lis. and compressor seats Meli-ods hr detection induce-y
inspection
We data based on site-specific and maintenance cisto-res one also available.
ln some casas- the hazard scenerie can sense front unigUe faccors mat shoclid hne addressed in a
academic-specific analysis- An attempts is an nnoontroiied release o! :: ianfriahle gas in gas—
pronocíon mie due to-produced marimusic; erosive damage totionirec. i n this dese. industiy
girl
“nikde rate databases are ol limited value. The end user's prior expertem-e a considerable
m of jodmnent can be pulsar: to eslaisish thelrequency o f the reieacee scenerie.

ttisoňen the case thatfi—re and gas neliecim "es provided in a n area to deeeeuetease'irommulliple
Wines of potential relEaae. ln mese came, mece should b e some Ecion!hlen to aggregate the
Emunim of the potential hadam searched in the area of connect- This is acoomplished ev
accounts-ig for a. number c l equipment lei: Soenartoe with similar mm and generating
dresu-m total or cumulative frequency ct'redease. Tide cicis ll'l minimalni the nunioer ol scensrlos
“loar need to ne il'tdt'vidually analyzed For example. sun-| the neumn- nf nit mooc mth od av
Manthre to the area of concern.

45.5 Step 5 - Assess umnlligalerl haterdirtslt

Whalerdi'rish rs measured hehe mastering lhc barda tí M W FBE. "lhs"
"Emme approach rs nemocematthe FBS rs mamilelileíntheevertnfme hazard.
Tireutmrtlsatedescaiatedeoreequamasevemyand hazardneqrsamymoemoaredtoend—

Meneses. Hllůghlám.
MTM.W.W—3HB -32 -

user criteria for tolerability. This can be accomplished though M of a hazardirisit matrix
with suficierrtlydeta'led information regarding consequence sere-iyarid liketiiood. Alternatiyely,
tpanlibitiue risk ctiteria can be stated in tenns of toterabie rnitigate-d euentiltelihood- lf the criten'a
"liticete thatthe urmi'tigated hazardfristt scenario is toterabte- adritional risk reduction using FGB
filmům-[B] is not required unless othenlrise mandated by tuned legal requirements- If the
lazadfristr is higher than target criteria, then t h e rislr.reduction requirements should b e established
ftrthe appimue tire, combustible gas, or tosic gas detection function 'n the FGB-

if the odemne of this step results in an acceptabte situruim with no additional risk reduction,
father analysis of performance-based requirements for FGB design isoptional. Design of the FGB
and seirsor phcemeru should be based on existing nett-node tof system design, such a s the
appicaiite intimitu standard cr industry guidelines and relyiag on the jrldgment of a qualitied
engineer for ser-ser placen-rent. Good practice guidelines in mie: B nemu be considered for
serusor placement-

eee Btep 6 - Identity FGB performance tergets

After previous steps in the hazardirisit assessment. equipment of concern and boards of concern
hi have been identified and the consequence severitynittetirooil and acceptability of an
megateo hazard wrll have been considered. The preeetttation ot this intonnation can vary In
format. The attenuation can tatte the form of a qualitative hazena assesment- a fully quantitative
risk assesment, or a semi-quantitative assessment of haaardfrislr- FGB designem with more
qualitative hazard input cen apply broad guidance frcrn industry ol'oolripany practices to establish
a singe and uiform performance target (e.g . 35% target detectrloorremge)- FGB designera with
me quatlitatiye tramrd information cen establish pedal-matce tageh that are specific to the
lands beitg assessed-

More itimnalion on the setection of FGB perftumance targets is iactuded Íl'l the annexes of this
TR. Armen A contains a n oumple of a semi-quantitaliyeqipmadthr setecitg FGB performance
tagets. and Antes D contains worked exampleB of FGB nemam hne! selection, using a
variety of methods for a variety of applications.

155.1 FGB pel'hemm metrics

FGB perform targets shoutd be consistent with the crad-user pliesqily for hazard detection
alert mitigation. based on the level of hazard and tisk associated earl-i process heeards in a
emitored area. and agreed upon by the end user- Adrieueroent of FGB performance targets
studu be through application of one or more of the listed FGB neim mbics shown in table
4. in the absence ct spacího guidance from the end-user philosophy. the totiowing options should
be outsidered tor mice:
t . Applications with ctou-ned FGB risit reduction factor s to: Doanbticetion of detector
coverage as FGB performance metric. Qualitative outsideretim of other performance
metlice
2. Freeeritative FGB safetyr functions: Applications with clem-ert FGB risk reduction factor
[RBF] it eso-eee of 10. Quantity detector coverage atd safety arrahbility.
- hůgative FGB safety functions: Applications with clained FGB HRF in excess of 10.
Gila-diy detedor coverage, safety availability, and miigation action effectiveness. Note
thai: these types of functions it is difficutt to achieve ta'get HRF, as they require strong
FGB detector coverage, as WE" as FGB mitigation effectiveness-
m of an FGB function as either preventatiue or miligatiue is the responsibility of the
end userofllis technical report. Where unmitígated ha.-ard seuerity isdeemed to pose an eleyated
level of fazardirisk, FGB mitigation as well as other non- FGB means of risk reduction shouid be
corrsideled. Target FGB performance can be detined in various way-.s, such as a n FGB risk
rerhrction factor, percerd reduction in risk of unmitígated ita-end semity, or maxi-nom allowable

Copyright 2013 lBA."tutam

 -33— Isa-Tescoma“

":lhuůf the FGSinciorL Target FBS pelhmlance StÍtl be mica to reduce tie
ineEloodofant-Initigatedhazardoutcome.

Table 4 - FGS pufunnanca matrice

"furnace-hlavic Esara-nice Roommate-dm Gum

FESihtediorm Mňam Applicatiorrantuech'larlFGE kmh

riskredudimůmržm

ApplicdiomntmcliimedFGE m 0
mkmwam

ass—som“ Woo-M Applicmiomntwod-MFGB mo

rekrsoncmtam-sttl

Mistři-e:“ Applicationsnt'neůiauiFGE Html)

riskreůldimůham

FEEl'riigáonectisn WM mmm-hun mc
Wl. claimdFGSr'ckwůdr-hcu
510
W:“ mmm mc
ctm'mdFGSrHcrulúl-lhth
“:=—10

Performance targetsfcGSdetector courage dualni b e quantitiedinrdlmplications “duelem

risk reduction is chined- Detector coverage shmltl be defined per cedr PGS function associated
with area monitoring.
Performance tai-gets for FGS safety availability should be continue—dt and. wherayar FGS tunel
RRF cxoaeds 1G. FGS safety atiailahilityr smc ce quantitied. Conti—motion should at roi-“nun
"Include prior ose experience and compliance to my applicable industry standards-

Dtmtitication of FES safety availability shouirl lie expressed based on 31 FBS function assou'derl
with coverage in a deiacl monitored area.

“linere applicable, perfonnance targets for FGS mitigation action electiveness should be
continued. and. Wiener the FGS target EHF eso-seus 10. FGB niigation action etlectiuenosns
slmld be ouantllied. Guidance on mitigatioo action ctlactiucnass is Med in ciausa 5.2.10 and
Annex G, Including hfonnao'on on estimation this meu'ic at a hazard scatauto-by-scenario level of
detail.
As illustrated in Flgu'e 3, FGB performance tageh should be selected such that the target rtů.
reduction can be achieved by the FES Mety function- F G S eifeciuerlces is the product cí
atplicable performance rneh'ics including detector coverage, FGB m availability, mt! FGB
niigaliue action eieciuenass accounting io: curl-non cause, cum-nn mode, and systermii:
Iaiures.

Copyright EMBEALAI úpis reserved.

Water-acne ..ai.

r_i-ri-
_'__ era _mea

HmmawF-GS Melies

mama membránám-edic reduce risk.Feaeireeeuaneaaaimedbeam rc W

lil: associated With the Mailer! hcanrd eevedry cc meet the end-ueer rielL Mantra.
Meine nek eigniticanw beyond ana crder et madame tflre and nee FtFtF : 1m necht net t_ie
practical far many rrriiigatim applications.- heeaieae me achieved ital: reductiae “ec malty limited
hg deieetcr place-merit actieved meer-age. ar mitigafln cheativeneaa rada than FES aatety
“Tahitity. ln fara. a n adiiewed detector coverage řadu baiaw 90% limita the metal achieved
HRF : 10 irreapectíve af uťherFGS performance metlice
WTE The flek aFee—hif-gstadiamtmníng 'IDIJEE detem-m FES unitate-Hm.— Hd-WEMWEBIÉ
fee.. nerfaetFGS aperalieerimaellraaltmm intatai'agteríat. Wemdďeaewifthehmmí Eli initiating avant
cenama: eredmneeeuaamaareear-ahl ln eaecaneemmrededienmeamounmlmumm
mawEneetthenakMimwemĚd veš"
4.5.52 Betten-haste hazard far measuring tama! FBS Mariae
“Hearing the ccneept ot pedarmance-haaed FES diam ia the need to dehet a hazard of
illeahcid aizefmagnitude cr larger. The designer ali-aute specify thia hazard when identifying
pelfarmanee targete- The Epe-tried hazard threshold eiaelmagnitude should be:

. eauaiatent with the ent-user philuaephy fer halami detection and mitigatiun
. buedanthe Ievelnhiakamcidatedwilhpimmha mmitaredaea
. Iikalihaod df hard
» aeverity ct eacalated heard if nat adequatedetected and miňgated
1within
. the capability at the FGS actions to meet the target haaard niiligatian (eg.. reduce
severity by m e arder at maanitudei
. agreed upan mirne enduser
IIII'E Uaa-afapriaranatyaiacffreamgaahazafdeht—mlelpmaaaaafatyarlmmmahmdd
mhdmpriaramiyaiamaelamemmteriatdhamedhIEFEEdaaigh-Wharadalndillďmiláin-ihaaald
"Samantha príarhazardaráysisshucidaligtuithttmeápmiemanta
4.5.13 Design-basis When fire

Ehúd-eurech firee can be detected either during une hciienl ata-ge (early) ar inlhe hirdevelcped
stane. Automatic aalietyactiana icrtire auppreaeianalmidhe consideredin idanHyingthe design-

Wright 2013 ISFLAII'UH received.

 — 35 — IEA-WEB .(H—3115

bags hand- Hyůntsm'hnn fire deledinn _ tyrpietillmI he based on detection of an inelpient tire.
Bottle plilo-sop-ties iii nul rts-mie initial! line ddeetion i n all areas, pnartirmladglir unmmned
installations. The Hinting talie pinea-ee g_iidance on several alternatives for selecting the
design—basis hazard.
Tal: 5 - amulet oddesign-basis tire haaards

DonationHůl-de DPP-5"
' l _ _ ' I'll-tlm
Trois-topu
[ odioh

holmium-math Hu-eimidredoo'haeh Mumlohidihewdlreu

m minimem-mramoru
duatlon
Mame—cupu thmrdome-alrm
„mmm Hansardem-mmm
Wada-trnem: Madumhsardarsu
“Faure—Be Typical test oonďrliore torgasplmieie
detection
arma-tmm Lmhaaardareaa
Scmbdchpau'maipsysh'n o'e-citilaledrsoenarios.
omnia-gevea: Ěmmmráw
Einar-Imm Silgadelaohoruilieda
„Malín-trable Tmu'n'ioraddadioruiislia
ným Emuhpháďmliad
Iulius-Misa! F.,-HŘE

ie

ďmmůymhmtaaa

lt“ a ráeae soernio'ssdeded heated of aspecilied hazard magnitude, then tire mdelirtg shmid
be used to detemite the studenta!the Ee hazard and the deteclahility of tire effects as a fumion
of tisknoe. The Multi-ig end-pain critet'm should be mnsidered:

. severe damage b mms eqiprnenl dolore 37.5 mtm! (12.000 BtulhrfíF)

. life-threatering themal latialinn ler ehm exposure above 2D kWh-ni (5.500 Eltul'hrl'tF)
- serious bum injury and hlo-cited escape routes above 12.5 kwh-|= 114.000 Etulhrlfti)
. moderate onen inju'y above 5.0 time? (1.100 Btw'hrtltit for short exposure t s l minute)
The installed system :;t bowenie ol horationirig properly within the selected zone of thennai
radiation. In addition. the designer should outsider modeth'ig thermal radiation to the threshold of
detectaoility for the selected fire detection teclmology le.g.. opttoal. heat) in accordance with the
uendor-specilted pel-formou capability.

sea.: Design-buh Witte gas hurd

Gas detectors can be positioneo to detect a specified staermagnitude of release or to detect a

specilted volume of gas. The choice for a nasim-oasis gas haaard should be consistent with the
end-mer philosophy on gas detecion The telo—hg table provides guidance on alternatives for
detecting the design-basis lazna

meanstsenliiuismamo.
l$A-THB4.DD.DT—201B .as.

Tahle & - Examples of design-basis na: hmm

Dni-chonřtilooophy Deliah-BnihHuu-d WW
utlhhthlonilondkn
mamutitmmlemw Hmmmmmmm marty-incentiva
Wiedeengdetechm maintltosmhghpwap
Whmtdnityhmlm release
Fiennebtegasrmvdassomouih Laurie.-adm
toalmttžtcňmlowpresmme
release
Hitů
W F' E_mů
mlesseráaermznof
] I'ma-dm

- ligisttíllžbsrsecitugasandhm
daewitl-Muathnlessthm
Enii-files
. DEhg'stUJ-tlbetsecjtu'rqid
Meidling-maslem
cil-stimlesstl'imEmirmea
FIElnmettegesolmdesao-ciaadutha mnu-tmu“
lhfeecleelcitmolilih'l'ltbeeedmaa
mldedianeterenmpa'gmm
qsnlittnimms
Date-et aluminum-ie"in E-nieliaI-ephmcei' Moneim Wiliúnpnceesmcf' nix-Eratem
MMEMÍ mammalian hm
FMM-3333“ T-mmm'
mama WMnmmďd-a
“lil-mehrspherieddusdmltthn Writúnproceesa'eesďhnmůmu'tall
WWW
Andieieofdereeanddihae _
WMĚWĚWĚ Imm-imeem wmmmmd
IWH" masa“ a núsrsluihblatnudehg smestmclreidanagsepdhmmtď
m]—
colalae museums-g)

It is the responsibility of the end user to determine if the pupese of gas deteclim is itcípient
[early] detection or major hazard detection, which implies quantilim of gas enotld be mesent that
it ignited could cause large-scale safety impacts.

lt" a release seenario is selechšd instead of :! Med hand mm:, then ga

dispeiaianfaccumhtíln modeling “shot-lid be used to dehermiíme' “life leadera er the mame
wearing. armilhe deteclahilitgi ae a tehotim ofdístance. The following end-Mt niter'iaihmtůhe
sahá ETEÚÍ

: 26%of LFL“ Threshold oř ignitahililgiof ga: Villon::t MMM gasem mód-eli:

Hime-nt
- att-“mms ot LFL: Threshold ofdetenahilitv him m m gasmediu“
mena Design-hasta tost:gasumre
Toxic gse-deteetors can be positiouecl todetecta specific sire BF Mneme nl tutti.:imeem! width
a process area or migration of thonic gas html:! the woe-as area. or they zau. he pallia-tento
pruhem access ani: agrese pathways. The choice for the design-case hmm shoota be mnm
with the end-user philosophy and guidance from the cmpeteht sumu.-igi co taxa-_ gas mame
letiste.Direct specification of the extent ata manga; heard teorie mtm-mute. Theeecnnd optim
tsinspecify one or more release scemrios end model amordmgiy-
it s release scenerie ie selectedinstead of asnecil'leu hala:-zl magnituda. thenMega dimension
modeling should tie usedtc determine the astavt ol the tomi:gas newim the detedahiitruí
the heard scenerie. The followingend-mint lei-item: can be maiden-d:

mwamůmm
 - 3?- summer-tore

. “Minehaha—slety exposure
. “lest-old lieiyited average (TWM-threshold limit value Humanart-tam W init
[STELHpemiss-ibte exposure limit [FEL] for chronic health exp-omnes
ln adrition, lindelirg should address the threshold of detechbiity ot tunel huit: gas taing
selected gasdetecbon eqťpment and vendor-approved perfmon-cem.

4.6.1 Step ? - FGB conceptual design

In addition to the design basis above, the initial design of the tire and gas system components, as
vvell as sensrrplacement, should be based on existing nietlndsforsystern design, such asihe
appicable national stambard or industry guidelines, and on theiudynertoď a weiter! engineer
for some items such as sensor placement. For instance. some users space detectors based on &
nadmíru-rtuti spacingiliat will result in a minimal hazard,
"OTE Edie Wget risk redtirtien form FGB safety turistice “u : tů. then Entita“ mamutů-sensor.
logic ach—'. and tmel elm—tt adeptem.
An initialFGB detectcrlayout should be proposed using emertiudgrnent byconslderlngthetactors
discussed in Mies 3 . 5 . which have a n Impact on FGB etlectivemsc.

When identilying sceriarics that are used to establish FGS performance targets. it is httportant to
cciuioer the design timitations c l automatic FGB activation. Ensirre stat the besis-ot-deeign
Maude are appropriate given the limitaticn of the system- For emnpie, detector
loosaticnlplacanent tor a tire suppression system design that exam-es otiym iiciúent fire will
need to be designed vrith detector location and placemertt sultirierl tio detect cody-stage fire
special-nos.
Design Maraida'the amount of time between when the baza-d i'iialybeoomes dete-stable
byttteselechedemimleotaidlhetimewhen lheexpecteddegreeofliskrerhcioncmmlonger
be adtieved dueto afutlyoolllated hazard. This will deltne Items:—.d! respolaetinereqňrement
frl'theFGSsafetyfunrdiout-
1l.l'eri:l'y
4.5.3 Step b - detector coverage
11te|loposedlocationottie and gas detectors should be analyzedtodeternitebolveltectivethe
proposed array ot detectors with a given voting arrangement vvil be "li doteď-ig Ile hazard and
ililiaMg a spedlied safety action. An assessment of detector coverage involves analysis of the
potential sotuces of tire and gas within a given monitored process area and me peitormence of a
proposed detector design, including the number. type. location. olielitation. and set points of
detectors. There are lat least) two possible approaches that can be used tor ire and gas mapping
of detector coverage. tic coverage and scenerie coverage. In either case the analytical
method to determine achieved coverage should lnvolve a computer model to map detection
coverage. Reiter to Ameri B tor attributes that modeling software may contain

Design verihcetion should account tor common cause. common mode. ano oecervnncies between
the detector coverage, safety availability and mitigation effectiveness and between the FES and
the iritiating sorpce oilr the lla-rd or other IPLs. The coverage levels that have been achieved for
a g'vert proposed detector array are then compared against selected perfmvnance targets. lt the
average tauget las been achieved, the proposed design is acoeplable- If the target is not
aclieved, the type, number. andlor location of detectors should be reviews-d andntod'rlied unii the
coverage target is adieved.

4.5.5 Step & — Verdy FES Safety Availabílity

(limitativeveriliculion ofthe FES safety availability should be perappicdtle glidmuce of ISA tor
safety instruneoted Emotions [SlFsL F G S safety availability is Maule-d perFGS irnclion arut is
the mdeennirsi corruolement of the probability of failure on darmo (FFU). PFD for a FES
fr.-uzlimisasururulionofltte sensor PFDavg +logic solverPFDavgi-ttrdelementPFDavg,

Copyright 2018 15h.. All rights moved.

EA,-TMM“ - 38 ,

wile-letne PFDevg is a function of the dangerous uideuctedfailure rate of each device. thevoting
arclitecuire of each device grouplng. and the proof test intervat of the devices. 1ilerll'lcatlon can be
aooornptished using the techniques presented in the ISA-TRN. OD.02 for aneiysis of SlFs
However, several significant differences between SlFs and FGS functlcns should be noted to
eltsiire an acc-italie assessment of FGB safety availability is achieved.
FISL proper definition of the FGB function is criticti to acmratiely assessing the FGB safety
“Hity. The mantity of detectors and possible vnthg schemes of the F G S function are ili-eclyr
relded to the detector design basis. which spedice: the gas cloud or flame size that the detector
may can detect with the goal of mitigatíng fmther aculmlhtion. such that the gas clo-lid or harte
size cannot escatete to a catastrophic event. FGB appiimtions cm be designed to act when a
álgle salsu goes into alarm- However, most systerrls implement some form of voting o f muttipie
sensors in an area of ooncern to reduce the tiitetihood of system activation from a single sensor
fit.-'e. Typicalty turn or more sensors in an ar— of mw“ must go into alarm before automatic
action taken- While this reduces the probabitity of nlisarloe trips from a single sensor failure, it
also reduoee the probability of successfully reeponring to a Ilaaardous event. It is less likely for
Moor more detectors. to be in the area of conoem, am.-ting the layout of detectors has not been
dlallged with the implementation of voting.
Detector voting schemes cannot be detem'llned umil a detector design besls is established te.g..
dtesensor array should be designed tc detect an aoctntualion of combustible ges with & maximum
dimter of 5 meters). If en area of concern oonuins three detectors. the ability of the detectors
to detect the event within the required time will determine whether the voting scheme is foot.
'Iu-ol 1003, or 2003. Thus, if the postulated 5—metetr gas m u t a t i o n is moved throughout lite
Here of normu and, at eny one time, only one (letech: Gen "see“ the accumulation, the ventily
sdleme is 1oo1. The other two detectors cannot 'see' the aocunulation volume irl question all
ttmsátuid not be considered as redundant measured-ena for the hazard scenerie.

Sentra one shnmd consider the source of the hilure rate data being used in the PFDm
mutation itself. Failure rate data is readity available from a variety of data sources [vendordda
"luhlstry data, site specific data, etc-)- However, it me looks dosely, this failure rate data na
presented typksslIy includes an assumption that the device 1lllill operate in a fail-safe, de-energize—
tio—hip diode. Most FGSs operate in an enemize—to—b'ip arrangement- Gonsider a failure mode
estate a logic sclver is unable to energies its output- In a de-energize-to—trip scheme. this type of
falus hill prevent one from initially opening a tail-closed valve during startup. Thus. it would be
classihed as a safe failure by the manufacturer. Howe-ref. in an energies-imdb scheme. this type
cl more prevents one trcm opening a suppresslon van-e chong & demand. Thus. lt shoota-be
dessihed as a dangerous failure- Thue. one needs to cerehtly leview the failure rate dete hem
WM for use in the calculations.
Abio+ radove terce needed for enyr energies-tomto nibgebve actions should tte avellebte feng
mougti to u'le-ettlre design intent of the FGB action. Fore-simple, the availability of dneluge or
minn systems shouldbe includedindie moon. FES deeigns typically involve odhadům
ofina eienaents lhal might be controlled byother systems. stitch as isolation valves oontroflied by
the safety it:-sournented system logic solver. Any eqtn'gmerrt that i s required for FGB operatiin
EDI-I'm
Shodit!be includedin the FGS availability calc-latine- tflhe associated wítl'l the FEi-Eis
used hy any other protection layer ior the-sono hoax-dns event the common cause intensit nu
overall fish reduetion of this design-should be evahratcsi

Tise-safety availability that has been achievedihr a given FGB function is then compared again!
& setected perfomance target. tl the safety avmablhtytorged has been achieved. the? mm:
and Macboo- of the FGB function are “capable if the target is not achieved. desig-l
garan'lelers such as redundancyi diagnostics. and testintetvats shouldbe lie-viewed andmobile:!
tutti the target avalebiflly ls echleved.

možnosti?—tiene“
 - 1! — ISAt-1'RB4.DD.D?-201B

Jimmy
Lito Stop " attestivmssofFGS actions
tutitigation action effectiveness is the cootirtence that the results of activating the final control
clementfs) of a n FGB ftmction will seiccesshly midgate the consequence of a detined hazard a e
expected (eg.. prevents a small tire or gas accumúation from escaiating to a large fire or
accumutationt- In this contingency. the FGS wooden can be ineřfective such that the outccrne of
the event is not significantly different than it would be if no detection or activation occurred. The
concept of effectiveness of the FES actions is madona only when considering FGS functions
that are intended to rnitigate hazards.:hverefore. this has also been referred to se *mitigatlcn
effectiveness: I n the less trewent oppidem where FGS hnvctions prevent a hazard. this branch
of the event tree is not meaningtul.
The reduction in severity atforded by a nibgation action will be related to the magnituda of the
hazard being acted upon and the fundamental limitahns of the capability of the FGS actions to
be effective. ln general. effectiveness of the FGS actions is likely to be very high when the
magnitude of the detected hazard is smal and detection occurs quickly, sc the desired safety
action can be taken well before there is the potential for hazard eocaiation. Conversely. even
conect detection and activation of the FES actions might be iieffective:

1. Duo to a n excessive time detay between initiation of the F G S action and when such actions
can be coi'isidered effective- For l—npte combuslibte gas detection that isolates &
process and opens depressuiziig tbbwdo-wnj valves can tatoo ED minutes or more before
the pressure in the system has sigriwrlty radim-d with a corresponding reduction'In the
discharge rate of a gas leur. Dui'ig the iriewening period, the gas that already leatted
from the autem court igrite.
2 . Due to severe consequences associated vrith ale hihat toss of omtainment event that
would reallt in a normalne ntagriude beyond the design of the F G B actions- For
exa'npte. a estasbbphic pipeite timhle wil very lirely result in a n immediate vapor cloud
explosion hazard that can have stara-e corisequences before the FGE function can
etTective rritigate them- The enstiig ie might be nitigated but not before severe safety
consequences haveal'eadyooulred.
As a result:. the design verše.-Him should auratum for these codependencies- Mitigalion
effectiveness is recogriaed a a vid FBS performance menit: that will fundamentally limit the
amount of claimed risk i'ecttiction form FGSitnction betovrthe ideal outcome of 100% confidence
in effective FGB actions- In eorioept. early detection of small or incipient. hazards provides “high"
confidence that FBS mitigatim actions vlil be successful- Late detection results in "low“
confidence. Similarty. low confidence resite i't under detection of a hazard that is an order of
magnitude larger than the nasim—bag hazard. Whie guidance on this topic continues to evolve.
as a minimum for all applications. users of this TR sliould even-line the existing or proposed F G S
function to enswe that FGS actions are creditabte a s being effective in reducing the magnituda
and severity of the umingated hazard- The concerns raised about mitigation effectiveness
highlight using a very cardio-tatry approach when considering FGB systems in applications where
ctalmed ristt reduction associated with FGB mitigation exceeds a factor of 10.

The method of verifying ntitigation action effectiveness will dep-end upon the type of action one
takes ie.g. evacuation ot metversus deptoyrnent of fire suppresston versus Isolation and
de-pressurizatton of the process) Fin-aver gradace on FGS rnitigatlon action effectiveness ls ln
Annex C

4.5.11 Stop “ - Determtne ses effectiveness [mtttgatedrlsttl

The FGS effectiveness actieved tor an FG$ hnichon shoutd be compared against the setected
performance target (see Figure t j - l t the target has been achieved. the proposed design is
acceptable. tf the target is not actierrei the maminet FES design should be review'ed and
modified. tnaeased noimage. avaiabiity. auditu“ nitigation actions should be achieved and
reverttied urtilreacll'ngthetagetFmetiectivevees.

wmemuwm
ISA-TRMDDDT-Em-B — 4D -

In addition, the estimated response time for the FGS safetv function should b e veriňed against the
requi'ement ntahlished during conceptual design. If the FGB safetyr response includes evawation
or other human actions, the FGB safeltir function response time evaluation should consider
nonoptimal conditions for personnel egress or sheltering that are likely to occur during a real
demand condition-

The results of the hazard and ristr analysis and performance target verification are compiled into
FGB performance requirements specifications.

5 FBS engineering activities In a project workflow

FGB engineering activities occur at different stages of a project for design, implementation, end
operation of a new plant or upgrade of existing control systems.
Before anv engineering activities, the FGB philosophy should be developed by or in conjunction
With the end user.

5.1 Basic engineering (FEED)

An initial FGB design should be produced. Documents required from the front-end engineering
design (FEED) include the major equipment list, process flow diagrams rFFDsl. process hazards
analysis (Pt-int documentation for hacard Identification. and the layout of major process equipment
Loss prevention activities including fire hazard analysis should ce reviewed. These documents
allow ona to determine FGB performance targets through an evaluation of hazardslrisits associated
with major process equipment. The type and mcgnitude of ncccrd scenartos that will ce the oasis
of FBS design should be determined. s voting philosophy and detector set points should oe
selected which allow one to establish initial coverage targete. For an existing facllltttr undergoing
a redesign cr upgrade of the FGB svetem. decisions about the ccceptalpilittr or reuee ol existing
ecolpmenl in the new design should oe rnade during basic engineering.
Once performance requirements cre established. an initial sos design can be developed: PGS
mapping can be conducted: coverage can be verilled: and the PGS effectiveness can oe evaluated
il applicable. The results are used to provide estimates of the tva-e. numoer. and location of fire
and gas detectors. Ae detailed 3D procese models are not avaliacle at this stage. only a preliminary
evaluation of detector coverage cen se made. out this should consider the location ol major
equipment. The basic engineering phaee ends With cn Initial FGB design with estimates on type.
number. and location ot detectore required to meet the performance requirements. Basic
engineering should include a specification of the FGB logic solvsr and a functional description of
the logic. Equipment design requirements should include event survivetillitv items such se
fireprooling.

5.2 Detailed engineering

FES engineering activities include a review of process hazarde and revelldation of FG!
performance targete. Three-dimensional process models will mature with location of piping.
utilities. electrical elements. and vendor-supplied pachaged equipment. When the :D model te at
the c a u milestone. a detailed design of detector placement can be undertaken. The detector layout
should be reevaluated and updated to ensure coverage requirements are met. Due to the
development of the GD process model between conceptual engineering and detailed engineering,
significant changes to the FGS detector mapping are Iiitelv- The achievement of coverage targete
should be verifled. and detector placement optimized using PGS mapping. and one should evaluate
the FGB effectiveness if applicable. Requirements for FGB maintenance and testing should be
developed. Constructahilitv and malntainabilitv Issues are tvoicallv first identified during detailed
engineering. such as the practical limitations of where deteclors can be mounted.

Further, near the end of detailed engineering. the EU process model matures to the 90% milestone.
A final verification of the FGB mapping and evaluation of FGB effectiveness, if applicable. should

Copyright 2015 ISA. All rights reserved.

 . 41 . lea-Tacaooor-eole

be performed to ensure that adjustments to me location of piping„ cable trays. atd ooruduit do not
hmede detector performance- TIB realne in a tind him! icr the FBS, eith m t i o n and
orientation remirernente for all determ in the FGB. Debiled engineering deirerairtee should be
completed for the FGB.

5.3 Installation and commlssionhg

After construction and during commissioning. the FGB should be 1 l r a l l d a t e d in the ňetd against the
requirements specification. This includes validation of detector type, Iooadoc. orientation. and
response time- Detector F G B mapping nad associated coverage should be checked and updated
ae needed to reflect my changes i n detector placernent dtu'ing construction, inrhting contimtation
that speciiied coverage targete have been achieved.

5.1 Operations and malntananoa

hiring operation arld maintenance. the FES should be mairdained and tested per speciiicalions
developed during engineering design. This includes rei-rim the FGB as part of the mnagement
ot change process to ensure that amr co.-ames to the process area are review—ed to determine the'r
breast on the FES. New or modified process equipment con create new potential teak sources,
1iu'hich
can change the requirements tor the FGS or create new obstaclle that slnid b e modeied
to ensure detector coverage is not contprmn'eed-

5-5 P o r i o d i c assassma n t a n d audit

The assumptimsused in the FGB soeoiicetion and dativ! (mg.l FGB detector mnoho and alarm
response action) should be subject to periodic assessment and revalidatlocn. The performance of
the FGB safetyr Motion during irrepectionltesting or actual demands should be eualuated
periodically against the specification requirements. Unaooeptalele FGB 5-3e functimt
performance m test or demand shotid he investigated ard connected prorrptty. The end user
retinoid establish the frequency of periodic assessmerrte. It is recommended that periodic
aeessmenis coulc'uie with other procese safety revalithtion activities.

maurskou-sm
 'I'Iispage milionaIIy len blan.

Ona-masa AIIlighlsresened.
 — 43 — ISA—WDDBT—Ém&

Anne: A — Sample semi-quantitative perfomance target selection technique

FGB performance targets define the aliiyof a n F G S function to dete-ti. alarm. and it necessary,
act to miigate the consequence of a tie or gas release upon a demand common. ln concept, a
higher hazard installation should rect-"le higher ievels of perform lilie a lower hazard
' ' should allow lower levels of cedcrmcnce. so that FGB resources can be effectively

Becoming on the end-user process hazard analysis (PHA) andFGB piilcscphies the factors used
to assess risk. effire and gas hasards in hydrocarbon processing areas cm oe evaluatedin a semi-
quantitative method. The factors in a serii-quantitative analysis yiefďmg performance targets for
FGB should be calibrated based on the assessment of typical haaard scerarios. consequences,
ieimds, and target risit reduction for the facility under evaluation- The abiityr of this method to
act-"eve the desired level of rislr redtnclim is contingent upon the process conditions and equipment
heiig consistent with the assurrpticne used to develop the performance targels- For situations that
do not conform to these assumptions. the usershouid consider altering the method based on site-
ad user-specific factors.

Tiisartnex presents an examplemethodology using a scoring system developed fora hydrocarbon

processing facility with Iire. ccmbustibls gas. and HES toxic gas hazards- This ranking procedure
is used to evaiuate the hydrocarbon rue. ccrnhustible gas. and ionic tI-IESi gas risits for each area
into one of three risit categories (high- medium low) for the purpose of establishing FGS detector
cmerage performance targets. The sampůe methodoiogy described here shcuid only be applied to
FGS safety functions With a target FGS risk reduction factor s 10. The reader should be aware cf
me requirements contained i n "ting standards applicable to FBS hnections based crt tis-it
reduction factor targets as descriled in the forevrord of this techriell report The following
tediirsol instructions apply to this sperňc example of a semi-quantitative mmm- The example
risk analysis methods a n d rislr criteria contained i n this annex have been provided sole as
esptalahy material and should not be irterpreted a s recommendaticms.

l-hzard rariring is a function of the enripmenl, hazards, consequences, Droit-cod, ccmpancy, and
ase-dd factors. Ranking requires an eqrilnent-bysequípment ease-samicím. including:
» Heidifying hydrocarbon procesního Balmont
. identify credlble scterces of hydrocarbon gas or liquid release
. identify amount and type of processing equipment in FES acne
. identify process conditionsinu could aggravatefmitigate coitsequeme severity
. measing consequence severity
. identify equipment that the FGS is intended to safegua'd
. asess magnituda of safelycutsequences (injury versus ie Ming)
. identify conlinement and megection in process areas that corid w combuslible
gas hazards
.- assessing hazard Iikeiihocd
. determine Iikeilhocd cf reiease ham all identified release scrlces
. identify credlble ignition scenes (Manaus and intenninenn
. identify the effective response action tc prevent safety infants
- assessing ievel c-cizupancylr in FGB mne
. identify ncnnalfrouiíneocmlcy [cperalions, maintenance, oorůactli
. identify ncnrouline commander lancraftu-is, maintenance, Macu

Watersem-igen lesem
 „u-
lan.-mam'miaamá-

li nn FGB mna is nat easay' character-med hy dm: ur mnm arm matná Hiatnummůhň FEE-
zune hazard Fani:r quantitative Í'ÍER analysis,- s'hould na considered.
.Flgure A..! shaw; the hazard mm;; procedura-

Flguru AJ! - Hazard running prdndurn

WWW EU'IHEŠ. A|| Nihil "linii.

 ada.-
ammmzuie

mmWHurem-nnumalmlmhmmnmmmnagmm Aa.
nn M b m ů n e . FGSmnarequring haha hazafdreňew Matem mmm

M T351:1 —- Select mainr praca: equipment ÍI'H'II

Mantia iba major pulce-ss equipmart 'n the FGE mne (ur p m m analysis arie uwaipr
equipment item at & Himal Frgura A 2 assign: :. default mama Sacramentu typ:! a! mih-Lg
:quipmt typically faunu m a pracu: Hamry realny. and Figure AJ antena & campu-|::
Spare based on the phase u! the mahaial IH the process- equimnent. The imma Hmmm: IBF lh:
Wmmumm mbaSeIíne Win-nd Ufa W h a t cuuídmsmt in +: samara;
Emmu: maf. Nun-51:93 hazard-

_— » - ... . . _. ., ;
má?
_ Ent-Ennui“ _
?;aiamheatm
EE!

&:mmm B

Jimram i '
_WJM 2.5
„Wegmann- 'a
52
_—Éem'uesselkaactr

_WD-mm 3 -_
M % -
mawa %. '
'1
mmm
Bail-13513 .! .".
EaI-mam.? ? '
Hmmm
T
=m:- mm + '.
ĚWPTPEW * i_ ;_
Hm A.: - “Manipmnnthn hun "knih:-:| spáru

magmatu; mmm„
aiu-munmmsn
nit-

human-mam Gmšgqilrm
50GB"

mmm ! *
WI! IWH. * g
3“
15! _“
Figura A.: -- Wm: mnm-In!hulmani-aumu- umi
HBF = marhumm- mím
slabin Liquid T (Proma-i'it-FP (FM-Filmů:
F|| anu-HBF mtnm- mmmm-wumumm mm ulmimi.
“Winin- Lmuw FFHl T (nm-w == HBP
Gas T mmm) : NFH: Gan alsa unum armani: liquids. magnum-wa?-
JLZ Tm.: — Mjust Ilhelrhnotl sv.-zora fur aucupancf
The hala "kollha-ard scan ihnuld hp nulu-tu:! na hutním? ln rlflnt tha occupanqy invmnmmt
nm the mujnr iqmpmmt Imm. Tma uhnul: h: maid MII" nn lh: lm 1 ln ncl.-fu unu Immih-
mnqnphnm hunrd. nr thl Impact balad nn lh! unmullgnlnmmnlnhd ::a lhal1 i FBE dulun
mimi: mamuta. Flaw-u n..-t darme mupanny nájmu-nam factors. Tha mul: |: nn odium
'Illmlihmd fur taxu: humus. If nppllcnbln. Nu further lluullhond adjustment ln r m u q d for tmu:
“hazards. Additional adluslment ís required fur *Hre and Hammable hazard Fikelihnnds.
HETE FQUrE hd;M u m h r ú m tn dummlnu an idjui'lmanl'fantůr and mm rem-lamina Triu-mth
Wm m1 :anim farm- Thn umrti—an [n.g.. hlgr-m mm:: ldgLIllmlM finta lhnuH hn Imai

__F mmmmm
[:?:t
FBE PIM mm d 1“ n
Bmw: Emma“. .
hnrnadiitlInput ' nudu “" -AdiusmňnL-
HIÍEBNĚHTWÉÚHS
'
. " 1 W 1 1EEE ' nm ů J (a

W mm: mm mi:-nwm
. . „mm. smat-ammmm
__ mmmw xmlmdrrunmmmmsh
.[rtgjínewmrmn mm:-uma) ._|.
MBH USÍDQÚBÉEWEIFDI-&$
+mqatinnfrmla1warygifm-

GW
mus—„mmmmmm.
 „.in-4 MMM-Etna

Ai Test:3 - Adina![tkanina-tlenou fer ignitinn environment feature.

The wm mnam: tak is mt appE-hle'b text:: hazards. lt tím mr W
ges- tnemde are arealu-nem Iba-n the [ůethued seem ehnulti he further aďluated'lůrw-
Wehlbilšy.Hume A 5 ctete-es ignitim amateur feature.

M a; .
wwwaclav.: .1 -
41;-
MM t.t-
'
Mme i
Figure A 5 - lnu.-litina envwnnment adjustment

M Talek 4— Mini! consequence seem fur prueess enndtttone

11mm Durtsequetree mermaid he adjusted fůr pronese pressure. This udmmnent'apptteilů-
fie. Rumble. am:milic ge:- haearde. Higher puncem preseure Íl'lditaleťt :: higher "mamma of
ceneequmm imunity ifa release nene to mu. Pmeess. temperature ie already feature-rl inte It:
detautt een-seem sme-. Fagin: AE define: precese pressure adjustment faetpre-

"fm .= Adjt'nehneitt
“meeting 41,5 "
m k)IEDÉ tt
muzeum m5
Santaumana 1 _,
“na 13.1
Fima: JLE— Frau-eee pressure ediuetmenl

5.5 Test:5— Adina: came: eenrn fur Hmmehulty environment

Thi: base autismem.—: seste entit-la be atfpu'eted fer temer: related tn the environment umim :
maul-tg gas |:a if it WEL'E to me. “tis ts related te precese mnfinement ena eengeeůnn
tamen. A higher degtee u! mottem end mngesuae lead: te a more severe consequence.
Figure A? námes- the hamty environment adjustment. The ftemebtltty emírem
museum she-nd ent! be unie-tl ti ilemmahte nee hazard: are helnp evaluetett. De nút- adjust
it:-nemame Genre mth this tanter rt tuni:name; are being svaluntett.

“mtr MLM
LEM
-l “.EIDLW

nm:

gegen ! wee
u'eqše'ům
'' 2 ' 'Em-QH“
Flanel? —.Fitlt|úbilřh environment adjuetment

mwaumm
mit-'reacoioreote- ,na-

se Taslt e - Adluet consequence score for tento geo concontratton

“lt s touto tHEBt hazard is present. the base consequence score should b e adjusted tor the
concentration of toxins reg.. hydrogen euliidoi in the procese tlutd- This odium-ml MWS-"Mt
:td tohto nee hazards- A higher tanto pcmentrotion is indicatitre of a higher magmtude nutt
consequence eoworlty rt a releasa Wer: to coeur. Figure Mi pronace typical HZS concentration
adjuottooniiaotora.

aeioogom ' Nonicmene—.

_1
'ilitipommcoenpn __
ititillgprnto tie o _ „
estimate t _
Astete tos. 2
a_túit. s
Figure M _ His consent-atlet: odinstníent
JL? Testr ? —'noteontno "FBS hazardrank
'For each hazard (fire combustible and tanci„ each honden-rent item is assigned art individmil
adjusted litterlihoo'd score and an animated comentarios me'me hazard roott is Elastan ofthe
adjuated liltelihood score and the adjuatied consequance score- This score indicates the degree o f
the hazard artd ultimatehr the net: of fire. combustibls gas. Dl" tmdc gas hazards.

The-caimiated satoo is dolin—od se “the adjusted bassline hazardrank. Thehighesthtdividuat value

of the bassline hazard rank for eli equipment: wítiiiň a given FES inne is MtF-td as the zuht'e'
hazard rodit,

ALB Ta'sir'd — Determine need for-FGB

E a c h a r e a receives a performance target for fire, flammabte gas, a n d tcutic [ e . g - , HEB) gas lH-rds,
w h i c h t a k e the form of grades- T h e s e grades are listed in Figure A3.

E a c h o f the grades detines a relative level o f tire o r g a s risk, with grade A being the highest risk
areas a n d grade C being t h e lowest risk areas requiring detection-

Lad T a s k 8-1 — F i r e d e t e c t i o n p e r f o m a n c e targets

Design of fire detection systems is predicated o n t h e principal that a turbtdent diffusion fire should
b e sensed early enough that automatic control action c a n b e taken, i f requi'ed, during the íncipient
stage o f the fire to maximize safety a n d limit commercial Iosses to a tolerable level. lncipient tie
detection requires a n adequate number of detectnrs that a r e strategically located in a manner to
provide adequate coverage.

Fire detection pertorman ce targets are selected based on the results of the semiquantitative FGB
screening procedure described in this annex, The result of the semi-quantitative method is the fire
hazard rank. which is representative of the relative tire risk. A higher hazard rank represents a
higher level of risk. which subsequently requires a higher perfomance target on the F G S to
mitigate risk. Figure A. 1U details the relation ship between the ftre hazard rat-th the hre grade. and
the detection perfomance target,

Goprrlghtždta IBA. Alrightsremed.

 .e- ert-women!

Gm! __!tnbiuommiiio. _...

__“A- __ t-ticti i'irrnrrr.IpotenticL „___
......l _ _ „Moderna humrd octer'tiiet
“
.l— LPHP'."W.| MHW.Num-É
Ete—cute antucemena
Flgurl „GLE — Fire. ahd nad performance grade:

er ii: & rten *

Sb c? it tim
.; c o : : o cca
co195o' c cit"
_ „r_iiit; _titL jmw_ _
Figure tutti . Fire heard rent: cnd detection pedormenoe tercel
Fire detectionperiormiince target: tire eveluuied tn iocoironu WMF! tiree could occur mth euftioterit
thtlfitilttr tc reeult tnlifo. eoletr orcummercicl tmocct. Irr these lccnttcne rudtunt heat output (BHO:
tt tried po the crtterton to upnutí-„r the tlorno mngnltudo of the deutch—haute tire that one worth to
dotgtt. The nrcgnltude of a tire homrd to rototed tc tte Tiro otto. which ic directly correlated.to its
RH
HETE 'l'hia applies to free tt'tatat'e not mi?-emco to produce ameeelfe emounts cí mnie before itaitinc tire. Thht
.procecture iawritten on the nápte that hanedetecticn irildcdtions withhigharfrehazard etipcteuoe ahotiltltte
eanaihtra tolcwerleveleof D mire action in. leaf-ona mth hure-“tim hazard emoeure.

Fire grade A ta typicalltr assigned tc areas 'niith higher level: of the risk. These areas are
characterized by hydrocarbonhandling arena where email hrec could ecuee cigniticant damage in
a ehort period of time or i'apiciit,r eecntnie. Euch fire-c rnight he due to the potential “for a higher
coneequenco autoritu ( e g _ nighiprneeure gott from a comproecor) or from a higher liiteiihocd ct“
fire tmu.. email boro pipet-crt: und pump coolet. For the performance target: associated wrth
grade A, o minimum oi 90% detector coveroce Ie achieved tor detection oi o oeeicn-ooele fire elce.
Fire grcce ! ie oeeigneo to meet hydrocarbon proceeeing orece throughout the tocliittr. Theee
prece ore cotegorinc by 'norrnui' rict: proceeeing oreoe cnd typtcotty ccntoin fixed utprnerrt with
mcderote to tow iikeiinooo oi tire. For the perfcrmonce torgete oeeocioteo with groce . o minimum
oi citit detector coverage iu och'reveo tor detection ot u oeoign-ooeie tue size.
1nrt-rere i:
Fire grade i: to unsigned to areas the riott of o hre iu relatively;r tow. Grade areas cre
characterized by a tourr potential for severe consequences (for example, due to high tlaeh point
fuel). For the performance tatgets associated with grade (] a minimum of 60% detector coverage
ie achieved for a design-haste tire size-

Art F G S zonewilh a hazard rent: of T-ID or greater ehould have a fire grade A'- For zones graded"A*,
the installed tire detection eye-tem should be capable of exceeding the grade A perfomance
targete. F G S zones graded A' will likely have a risk reduction tactor target for the FGB function
that is greater than 10. Achieuing this ricir. reduction factor requires performance target: for system
availability and mitigation effectiveness, uit-rich are outside the scope of thin method. Rotor to the
tcrewcrd of the technical report tor additional guidance.
tn addition. the r c c zone enwrd otec ce subject to eddiitonet rtett etudtee. euch ee e DRA enelyeiet
to 'ii'li'llti' thet tire nett te edeouoteiy reduced.

Wim 2015 IGA. All tight!rumu.

mmmE—sots -:n----

u.: Task B.! - Cembnsltbta geo detection mnam-nee targeta

Mgr: of mamma-seem e graduated m Mig able ti:-sense a M M M
gas-at an inc'rpient stage when action can be taken to presentslgnificent loss sterea—rat volume of
gusto ígnite and resultin a dedagmtion- The goal is not to tIE'tl'EH-l'. any size flamrnabl-e chod itom -
Mig. lgniling, or deflaglatiteg. The goal is to Iírrot dame fmot acceleration of such ignied gas.
douds to a speed mat has been deMistrated to be bami: ale threshold of ebu-stlačil dan-age il!
process environments- Thedegaseoí hazard and m e damgefruna combostiblegaa deiag'ation
isrielateci to the size o f the mta and other factors. si:-al „ae oorrIi'hemEnt. and the practice of
unicode-índuant: atleta-ctes
|ushere
[to'nbestible goa detection eerlonnarice target: ale Rahmen lri Ieoeuons wed ale
duos could cause damage kom “elastan overpreosule. tn mese iooatlons. the mladi ees—
momet has the potentní to carne svar: damage. er mem-a gas cioud that ein moly
be detrelopei is need to det-ine requireMents for olmang communis gas detectors-

(nemohla gas gsm:: targeis are selected based on the results of the sernt-gumbtatlive
FBS screening procedure Geocoin-ed in this annes. The result of the semi-quisniihttive meant ls
memmbestible gas hasardfaod: that is representative eines rctetlvecombusťbleges list:. Abigher
hatsan! rank represents a higher level of nek. Mich assembly requires & higher perfmaahee
target on the FBS to n1id-gate risk Figure A111details-the relationship between me nemame
gas hazardruns and the corltbttshble gas grade

W
lm _ _ _

A'
=? _ .inšl _
_.
„315 e __ .— c - __
'i'-E155 EL _1
tíž-„__
"E!E-"í. _ “EF-' ___.
'i'-Ě: _ .ws“ iQue-Hives:
“Figure A.." - combustion-goa hlzard rank and detection perfomance umu
Miele gas grade A is typicaliv assigned to FBS mites subject to higher risk- eimer due to
„frequency release smrces (such a s rotating equipment) or a high degree of curt'mement of a
buning gas cloud that emld enttse damaging flame acceleration a n d overpressure nilsen subject
h a relative small gas releme. For this performance taget for grade A , the g:: delle-titul system
should b e capable otf action-"ng 90% coverage for deteclim oi a design-basis mrhnstíble gas
hazard

Coolhostible gas grade & ":s Wire assigned to areas subíect to a moderate degree of
oodinementofaburůtggasdoud. For this performanoetargetlor grade B. arenas-detection
system shguld b e capableot' adieving 3 0 % coverage tordetection of a design basis" cortMstible
gas naar .

Combrrstible gas grade 1: is moi—calle assigned to open hydrocarbon processing seas with rmed
emripment, relatively lm! operating pressure, and Ielmůolled ignition sol-ces.. The gas
detection system should lava EDGE detector coverage to detect a design-basis mumie gas
I'm-ard.

h some cases, the prim hazard of concem is lhe nig'ation of oombusliie gas beyond
hyriocarbon processing areas nasere access and iglilim mece are well cuůoued- ln niece
cases consider setin-lete dsteclion in Iieu of gas detection will-lin the area ot the Went
Mailing the hazardous material.

montana.—„mmm
 - 51 - ISA—THBd-DDDT-BMB

An F G S zone with a hazard rank of T.IJ or greater should result in a combustible gas grade Ar.
For zones graded N , the installed combustible gas detection system should be capable of
exceedíng the grade A perfomance targets. F G S zones graded A““ will likely have a risk reduction
factor target for the FGB function that is greater than til Achieving this rislt reduction factor
involves having performance targets for system availability and mitigation effectiveness, which are
outside the scope of this method. Refer to the foreword of the technical report for additional
guidance.

ln addition, the FGE zone should also be subject to additional rislr studies, such as GRA analysis,
to verify that combustible gas rislr is adequately reduced-

A.BJ Taslr. 8.3 — Toxic gas detection performance targets

in this example procedure, torric gas detection is limited to hydrogen sult'rde [H:GI hazards. Has
performance targets are evaluated in Iocations where HEB could cause serious injury. Personnel
who enter areas of the facility containing HgS are assumed to be wearing personal " 2 5 monitors
at all times- This is the primaryI means of safety once a worlrer is in an HzS -containing area and
is near equipment containing HzS. Fixed HzS detectors should not be the primary means of safety
at these locations, because a very large number of detectors would be required to protect every
possible exposure- Fixed Hg-S detectors are the primary means of safety to alert personnel who
either are not in the area at the time or are within the area but nct immediately exposed to a
hazardous release. The goal is to either prevent personnel from entering the area c r evacuating
personnel from the area, depending on their initial location-

Performance of HTS gas detection is based on the Iilrelihood and severity of the to:-tic gas hazards
present. Detining performance targets requires det'lning the hazard. For HzS, this is the smallest
gas cloud that has the potential to cause serious injury. This is descriptive of the magnitude of the
hazard that requires detection and is used to deline requirements for placing toxic gas detectors-

Toxic gas performance targets are selected based on the results of the semi-quantitative FGS
hazard rank procedure described in this annerr. The result of the semi-quantitative method is the
toxic gas hazard rank that is representative of the relative to:-tic gas rislt. A higher hazard ranlr
represents a higher level of rislt, which subsequently requires a higher performance target on the
FGS to mitigate rislt- Figure A.12 details the relationship between the toxic gas hazard ranlr and
the toxic gas grade.

„aaa aaa. sagem;

asc
—+
sro a
sad—tra .s- na
access a- cc-
„noc;—ras - c - „ds-
_Él'á
_ Na masem -
Hours 415.12 — Toxic gas hazard rank and detection performance target
Tr'rsic gra grade A ta tyctcally assigned to FGS zones where a lite-threateninc tocit:hazardcould
accorl'rom a Isletivety small gas release at a distance well outside the localized area of the rale'ase.
Toxic gas grade Et tshtpically used when there is a made-ratedegree of an figury-level tmáchazard
Elat could occur from a small retease at a distance well outside the lcmlized area of ttíereleasfe.
Tmuc gas grade c rs used when ac injm-y—lewel tom: hazard could acc-ur only from a large taleas'e
ataůstandebetccít me Ieceltzeit area oftne neim

mamma mamma
IEA-M3318 -i -

AnFGSmneúuialazardrailmfi'jargeateráuidralihaimicgagmdeh'.Farm
gradedh'. meimtaledtuňcgasdetadhnafstemsluiihemaueďemeeůagMdeň
pedmnancetargets. FGSzmesgmdedA'wiEkeiyluueaúskmdudimfacmrtargetfnftm
FGS funciinn that is greater than 10-Adliemg this. :isk reduction factor invdhres ham-ng
performance targets far system avaihbinty and niligaliun ananas-ms which are wiside the
smpaafthísmauiod. H a r e m m w a w a d m m m m w m w m In
addition m e ř ů m a m m m w m m m m m Madamanahais.
taverify that the toúdgaarishisadequaielyniúgated

Taxicgaagradah.gradaaandgradeCFGSaoneamudhemauanimlhwasphaMai
nad cloud equal in sizetd Madistanceiomeacmeruiwmd mmmmhf dia dedica-
haais hazard s c e n a r i a . F o r m i c g a s h a a r d s . m u m a i m a d e d a n a m m m k m a n m
Galanta: to the dem linii Eur die minn-hadů hand samara. Thea: distance-l ara
amoummemuwmwmm

WMBÉHMM
 - 53- IBA-WQDMT-Wii

Annex B — Detector coverage assessment techniques

5.1 Detector geographic coverage assessment
The following example FGB architecturee. detector coveragel. and mlti-gation effectiveness
repreeent poeeible lyttli'n configuratione lll'ltl ehould l'ldll bl interpreted ae recommendations. The
configurations used in actual applications are specific to the operating environment and procese
conditions in which they are used. As such. no general recommendations can be provided that are
applicable in all situations-

A geographic coverage assessment seelts to determine the degree of coverage of a monitored

area that contains a proces: withpotentialhre or gas naaards. The goal is to determine the traction
of a monitored proceec area that ie covered it a releaee oocure in a given geographic location.
Geographic coverage ie o function of the release detection equipment In the monltored proceee
area. considering obstaclee that prevent or inhlblt detection and the defined voting arrangement
for the safety action of interest. For example. an array of many flame detectors in a monitored area
with few ohstacles and a iootll voting anangement would yield a higher geographic coverage than
an array with only a few flame detectors in an area oongested with process equipment and a Errol—l
voting arrangement. Detector geographic coverage does not require a specific risk scenario to
determine coverage. The method aseumee a hazard could occur anywhere within a monitored area
and eeeirc tc deterrnine how well covered that area ||. Detector geographic coverage doee require
general information about the magnituda of the tire or gas hazard that requires detection in a
monitored area.

3.2 Criteria for tire [geographic] coverage assessment

ln general. a system's ability lo detect a tire of given intensity increases as the number of fire
detectore in a monitored area lncreasee. However, there is a threshold tire intensity below which
the eyelem cannot activate due to limitationa of the lenaltivity ol flame detectors. Since an analyaia
of geographic coverage le nat conducted on a scenerie-by-ecenario basic. a general criterion
needs to be established to determine the tire lntensity that requires detection at any location within
a monitored area- This criterion detenrines the analytical end point for adding more detectors to
obtain a given level of coverage.

Moci optical flame detection methods are sensitive to thermal radiation at various wavelengthe.
and the radlaled heat output of a tire ie an Important parameter ln determining the thruhold tor
detection. Guidance for detennlnlng the appropriate fire design-halls hazard tor detection ie
provided ln Clauee 5 of this TR. Selecting a very low threshold detection criterlon can be
appropriate in some instances that are extremely vulnerable to small tire effects or present a
severe potential for tire escalaticn; while in other situations. this criterion can lead to an excessive
number of flame detectors., because small iires cannot b e sensed at mcderate to large distanc-es
from a detector. O n the other hand. selecting a veryr large threshold critelicn can be appropriate
in instances where only minimal coverage ie required to annunciate a fire in a nonnally unoccupied
Diddl" area: ttil'llle in other eituatlcna. it can allow il tire to grow to do unacceptably large lili
beyond which automatic control actions (s.p.. auppreeeionl can be coneldered effective. rlote that
with larger flres. optical flame detector performance might be degradac.

5.2.1 Procedure for fire-detector geographic coverage assessment

1. Select a design-basis hazard for detection—a threshold fire magnitude that requires detection
of an incipient haaard (eg., fire intensity of 1 ti by 1 tt at tDD tt requires detection).
2. Select a geographic location for anatyue.
3. Detennlne if the geographic location ie wlthln the held ot view of each fire detector in the
monitored area. For optical tire detection, ensure that obstructlons between the detector ar'-d
the geographic location are accounted for in mal-ring this determination.

ůdpyl'ld'lt 201!ISA. Allright!reserved.

isomssmmams - 54—

4. I f 1ooN voting is proposed, flag the location as covered only i f it is within the field of view of
one (or more) fire detectors in the monitored area.
5. I f Eoofil voting is proposed, flag the location as covered only if it is within the lield of view of
two (or more) fire detectors in the monitored area-
E. Increment the analysis over all geographic locations in the monitored area-
?. Create a sum-total of all covered Iocations and determine the overall fraclion of geograplíc
area that is covered in the monitored area f i e . , detector geographic coverage).
3.2.2 Attributes o f fire detection coverage assessment
Although there are many methods for tire detector coverage assessment, ranging from rnanud
drawing to computer—aided design, there are some common critical attributes of effective
assessment studies- The tire coverage assessment (Le., tire detection mapping) should consider,
at a minimum. the following attributes for tire detection modeling- It should:

. perform coverage mapping in three dimensions

- calculate the analysis results for user-required elevation of interest
- uiilize the specification of the tire detector [e-g., the results of the analysis should create a
rriap that is identical to the "cone of vision" presented in the equipment vendor's product
literature, accounting for any de—sensitiaing factors relevant to the application typinliy
revealed in the F M 3250 test procedure]
: model the effects of changes in detector elevation away from the elevation of interest
- model the effects of the changing angle of declination with respect to the elevation of interest
- model different detector sensitivity settings for each detector
- model detector sensitivity with respect to multiple fires from different materials of interest for
each detector a s required ( e g - , methanol fires, methane iires, and hexane lires)
. n'rodel multiple obstruction geometries
. present results that indicate the fraction of the monitored area where: n o detecrors are sighted,
a single detector is sighted, two or more detectors are sighted

5.3 Criteria for gas (geographic) coverage assessment

The ability to detect a gas hazard at an incipient stage increases as the number of detectcrs
increases- However, there are practical limits on the number and position of detectors that will
imply the possibility of a small release going undetected as the gas disperses below its detectable
concentration or situations where a small release remains undetected for a period of time until gas
accumulation occurs in a semi-confined or confined area. Since an analysis of geographic
coverage is not conducted on a scenario-by—scenario basis, a general criterion needs to be
established t o d e t e r m i n e t h e s i z e ol g a s release t h a t r e q u i r e s detection anywhere within a
monitored area. This criterion determines the analytical end point for adding more detectors to
obtain a given level of coverage.

Guidance on determining an appropriate design-basis hazard for detection is in Section 5 of this

TR- From a practical standpoint, the size and shape of a gas release that requires detection are
reguired to perform a basis analysis ol gas detector coverage. For flammable gas detection. factors
such se me degree ol confinement and presence of turbulence-inducing obstacles require
consideration- The typical form of this criterion is a spherical gas cloud of given siae [e-g.. ň-meter
diameleri; the actual value can be based on analytical consequence modeling or a study of the
etlects of tlammable gas cloud size and the potential tor damaging blast effects lrom a dehagration.
A smaller gas release criterion might be used in certain situations that are vuinerable to hre or
explosion effects; while in other situatlohs a small criterion can lead to an escessive number of
detectors in an area that presents minimal bastard. A larger criterion can be appropriate in some

Copyright 2018 lsti. Allnghlsreserved.

 -Ei- ISA-WDDDT-EWB

sůaňem;uttiehoueasiemdwm_mmmňmdmnhmhmegasmat
mmneammmmmmmwummsmms
effectiveness.

5.3.1 Procedure for gas-detector geny-optic coverage assessment

1. Select a design-basis hasard hdetechm—ahesholdgasaoctmulatien thatrequires
detection of an inc'vnient trasa-rd te.g.. gas act-muslim ot lea than 15 tt [5 ml in rliarneter
requires detection at 210% LFL tora pondetectoror 1.0 LFL meters tora tine-ot-sight
detector).
Elf—'N

Select a geographic toca'tion for analysis.

Determlne itthegas aocrrrnrrtationotthreshotdnragnitude mattsoenteredatageographlc
location can be sensed hv each detector tpoir'it or open-path type) in the ntonitored area.
4. It tooN voting is proposed. tlag the loeet'ronasoovered onlvit dues-hold gas accurnutaiion
canoesensedovonetormoreigasdeteotorsmmemomoved area.
74555“

it2ooNvohrigisproposedhagmeloceuonasoomedonIviIWechotdgesaccurnulalion
canbesenseduvtwotormoretgasdetectusmmemoritoredarea-
incrementthe analysis overall mmmmemútored area.
Createaswntotalďdlmvuedhcaňamammmeavaanhaoidndtagedyamc
area that is enveredinthemnritnreda'ea [i_e.,deter:liorgengaphir: average).
gigas
BAE Attributes detection magie nasem-ent
Although there are nm:; mett'imls Eur gas detector entrerage assessment. ratgirrg fmrn manual
dmudngmemmnneraideddeágt,maeaesmremnmmuimamhmmatechve
assessment shrdies- The gas mvemge assesanent (Le., gm detection napning) should ennsider,
ataminimum.drefelonitgathňmteefmgasdelediunnndelhg-hstnidz

. perimn emeragentqmirgitll'eerinereoinns
. model grintdeteetinnsystemsahegúthnpenpdtdelieeňnnsystenettem aeonuntingfnr
beamatlzematim)
. presentreeutsmuueeďlnmsimsauiatausa'setededelevdimofhmrest
. present tabularrestitslhatiuiedethefracinnottheeuveredareanhere: mdeteeimsare
sighted,asingledeteehorissigrted,hvnnrmuredeteetovsareáglúed
The advantages of the geograeitic coverage assessment include an easv4e-understand graphiml
representation of results. There is no reqriernent to generate speeitic seenario—bv-soenarío
coverage results. giving an easiv repeetahle and audirahle detection layout- Computational
requirements are high for this method (as well as scenerie coverage). The method also ensures
that if the cloud size of conoem exists. it vrill not remah mrdetected. The disedvanlages of
geographic coverage assessmnt iodide the tact that it does not account for the likelihood of gas
migration and ignition, Altematively. the method focuses on the aoctu'nulations that would result Íl't
unacceptahle consecuenoes. providing detectors. to ensure these high-risk instances do not romain
undetected. This allows the designer to focus otev on those areas where gas accumulation
presents a hazard o l oonoern. therehy optim vrhere gas aocurnutatim mov he credihle. but
would not present a signilicant haaard.

5.4 Detector [scenerie] coverage assessment

The identified rislr soenariots), consequences, and event Wed are used in the soenario
coverage assessment- Scenerie coverage is a more detailed assessment ttiat is reduced for fully
quantitative risk anatysis tectmirpes: vrhereas send—quantitative risk analysis techniques generally
reljir ort geographic coverage rrrett'iuds- Evert ethen rating semi—quantitative methods. use of
scenarin enverage—esperíálvfucgas detection—em pravidle more detailed intnnnatíen about the
rising-sed hyaproeess ptantatdtheefieciveneesotditelerideteehrmjs-

wmemumm
iso-mmm _ 55 _

Consequence ztatys'n generúes itiomwtion about the potential impact of the identified tire and
gas reteae scenarios- The inpaict meines se ovettaid on the plan view of the area under analysis-
Most often, tlte impact m se based on hlhulent difusion tire models, showing flame size and
shape, or gas ďapersion. tor mooni'iied orsemi—oohtined areas. A determination is made for each
detector in the mcnitcred area se to whether it is eepabie ot detecting the scenario.
5.1.1 Procedure Iort'me detector [mdo] coverage assessment
t . Selertahazardscenarioinhiemcoitored area.
2 , setectthe first consequenceoutccmeot thescenario. F o r a tire each outconte Is represented
asonectthepoesibiettamecrientations.
3 . Detennine if the ccriseooence outoome is within the field of view of each tire detector in the
nanitcred area. For optical tire detection. enstii'e that obstructions between the detector and
the geographic location are amounted tor in matting this determination.
4 . If toctt voting is proposed. flag the scenerie outcome as covered only if it Is within the Iield ol
viewofone iornwettiredetectorsiithentcnitored area.
5. locotingispicposed.nagmesoenariocutoomeasccveredontyiiitiswithinthetieldoi
viewoftwoiormorettiedetectorsiithemonitoredarea-
E- lnuementtheatalyeisotalscenarioootomnestordteseiected hazard.
T- lnuementtheuatyeisoverdlhmdsoelmioshtthemonitoredarea.
The ratio of detectahle releases to the total "5 lie detedor [scenerie] coverage tor tire detection
itt Ete monitored sea.

3.4.2 Prooedureforgas mtaoenariol coverage assessment

t - Selectahaaaidsoenaíoitlheidentíliedmíln'edarea-
! Saied the titet wise-mim onto-ante ot the scenario- For a gas release, each outcome “es
represented as a ctoud pmie from the dispemion analysis, with possible multiple virind
tire-ctíme. meteorologiral oooritions. atd ventilation patterns-
3- Detem'ine if the oasiserpenoe otttoome cm tie sensed by each detector in the monitored area.
4. lf 1ooN voting propo-sed, ltagthe soenariooutcorneas covered only if it can be sensed above
the tltresl'told cmmeiilalion tru“ m by one (or more) detectors in the monitored area-
5- II20oN voting proposed, Iagthesoenariooutcorheas covered only if it can be sensed above
the threshold ocrioenhalion tor ahnn by tato (or more) detectors in the monitored area.
E. Increment the analysis of al see-tatto meccmec tor the selected hazard
? Increment the analysis over all hazard matice in the monitored area.
The ratio ot detectable remases to the total ts the adtieved detector tscenarlo) coverage tor gas
detection in the monitcred area

The advantages ol socha-tio coverage assessment include a graphical representatlon o l results

showing the tittelihood of gas neni-etice at a facility. However. computational requirements are htgh
for this method. Sceiiario coverage may allow the layout to be optimized based on which detectcrs
are effective against the scenaiios evaluated. The dtsadvantages ol scenerie-based coverage
assessments include conditional modetmg techniques not accounting for near field blocitagee.
varying vertical orientations of release. and. uttirnately. running a finite number of scenarios where
the outputs are entirety depei'ident open the number of scenarics evaluated. When anaiyaing
explosion overpressue hazaios, this medica may not account for certain release scenarios that
are the most hazardous viith respect to consequences. For example, a gas may only migrate to a
hcation i n tte of the samice, bot mat t'r. hay merit in the most dashuctive consequence.

wmemuwm
 .5? . EP.-WMMB

3.5 Factors considered when developing detector lagun

Where process- area tire or gas detection ls specilied. an initialdetector layout slnouid he pnoposed.
When developing a layout, the designer should consider several hey attributes that will impact the
performance of the detection system- Although mange should be evaluated for the proposed
Iaymrt. it:is important to recognize factors that intluenee a coverage calculation- This sectim lists
severni of these factors that the designer should consider in developing detector layout- This is a
oheoldist for the designer. but it is not intended to provide a cornptete technical discussion of each
factor. Further. the tactors are not to be considered as prescriptitre: rather. the weight ot each
focen- should c e detmnined by studying coverage as described etsewhere in this technical report.
These factors are ami'mahle to princess-area tire and g a s detection, a n d consideration ha been
gimn to applications where the pl'ocess is located mddoms as orel as induces.

5.5.1 Fire detection - indoor and outdoor application

1. End-user tire and gas detection and mitigation philosoúr. This add'eeses the end oseťs
oliectives tor tie detection atd mitigation. identitying saiety and less mention goals. For
smíme, does the detection od tire or gas resuit in an alum-only condition or is enemies
octim required?
2. End-user design standards tor tire and gas detection: This includes the end Liser's standards
tior ke detection, including target tire size and thresholds for adequate tire coverage.
3- Equipment of mmm for fire haaard and teak sources: Gmnideration shoutd he gimn to the
emiprnent that “es intended tio hemonitored fm'hjrdrocarbmtire hazards.-, aIIthis can be lime-d
on legal requirements, endvuser design standards. the end—user philosophy, or tire Nezadaná
risk assessment of the type of equipment am Intel.
4. Equipment that is ct possihte conoern includes the intimním:
. heat exchangers
- oohmnttowelfoontactors
. compressormrpanders
. pressure weesell'reactors
. mntgal pinnps
_ teplotou.-„stínu WEPG
. atmospheric storage tank
. LP storage taxis
. Bed heaters
. pig launchefheceitrers
. su'npisump moops
- piping maliulds
. single-wetded pipe semnou;
. production weIheads
5. Ftanunahle material

. Fuet type, timidtire, gas tie., ete: Thetypecitiammahte material deteminee tt'teeieuicn
of tire detectim required-
. inventory: A large Inventory can potenh'athr dras'dcaly change an FGB philosophy tnr
ctsenglng the seuerity ot misi consequences.

wants ISAN rights reserved.

I&A-TRMLMQLĚN& » 58.

e Volatilityillail'i point: The materiel volatilttvilloeh point con eigniiloentlv alter potentiei
hesardoue outoomee. For example. hloh llaeh aolnt iuele have a elgnlfioentllf tower
potential tor severe ooneeouencee than low ltaeh aoint fuels.
e Pfůůlli pIISl-UfiffIlMl-I VCHCIIF! Higher P ť l i i u f i l and "linii FUINÍHOI Ull'i Gli-III .
hlůhii' discharge role. Thi! can result “1 G j i t lir! ii'liliůd Cif & DNI lift.
e Process temperalure: Temperature can significantly change the trolatilttlr oi fuel and the
density of released gas. Flammabiiity limita: The flammability limits cen deten'nina il pool
fire or _iet lire are credihle outcomes., which affects detector posili oning.
Coverage area: CDrlgBSiim is a major factor to consider, a s large equipment c r highly
conguted píping mtr simitie-ntiy biocit the view of flame detectors and limit migralion of
smoke.

Boundaries of the area to be covered by fire detection: Boundaries define the extent of the
area surrounding monitored equipment that is intended to be covered rar hydrocarbon tire
hazards. Factors considered for setting the boundary area inctude existing constraints. such
ae ali equipment in a bounded area should have similar fire hazards. should activate the same
alarms and executive actions and initiate the come arocedural personnel orotective actione
lmueter or evocuationi.
Target ltre etaerdeetgn oasn tire else: eee oiauee : ot thie Tit ior guidance on target tire else.
Fuet entit contalnntent areaidroinage: Containntent and drainage influence the location of tire
detection based on containment or liquid tutti aoiila.
"ID.Ignition sources: Tha location of strong ignition sources could influence detector layout (o.o..
a pump seal fire hazard requires Iocaiized delectioni.

'11. Dbslructions (pennanentitentporary]: Dhstrucliorts include process equipment, piping, cable

trays, electric-|| cabinets, scafloiding, and Iaydovrn areas that can impede detector views- For
indoor process area (eg., a compressor building) flame detection, ohslmctions can impede
the detector's ability to “see“ the complete target.
1tltlind:
12. Ventilation characteristics - HVAC, forced ventilation, or For indoor applications,
ventilation characteristics can affect detection. This can include the ventilation svetem
preventing smoke migration or cooling emoite extraction. Small tireo can be dithcull to detect
when large ventilation svetem are inetoiied tn induelriat applications. Gonelderatione ehouid
lholude elrateglcally aoaittoned lion-te detection tnetead oi heat detection.
13.in outdoor tire detection aooltcatlone. the Initial detector layout should be iniluenoed by the
direction of the orevaillng wind out aiao addreea normal and abnormal meteorolooloei
conditions. auch ae ntghtlirne and low—wind conditions. and the tvoe ol llre ijat. tlaah. cool.
'! o . .

14. Available technologies for hydrocarbon fire detection: The inilial detector layout is affected by
the type of lire detection technology selected. Some technologies are more sensitive than
others at detecling early stage or incipient fire hazards- FEWEI' detectors are needed when
selecting more sensilive technology types. Also, spuricus alarm avoidance should be
considered, because some typ-es of detectors are less robust in certain applications where
false alan-n stimuli are present- Refer to Flv'l Property Loss Prevention Data Sheets 5-43 for
guidance about the slrengths and weairness of the various detector technologies and
applications. Typical detector technologies include the following:

e Frangiote oulo:Designed to meoond to the energy of a tire lhal increases the temperature
oi a heel-eeneillve element. A lrangloie bolo ueee a tiuid-liiied bulb.

Matti Žů'iilISA. Allrights rum

 - 55 - BFME-EHS

o Blmetalllc heat: Designed to respond to the energy ot a tire that increases the temerahre
of a heat-sensitive element. Bimetallic heat usa a tempem-sensitive strip
. Closed-circuit television [CCMlvisuak Designed to resp-cnd to the visual signatrn'e of a
flame. using onboard algorithms to distinguish between real flat-nes and cum norvvisual
background radiative sources (i.e-. flare radiation turbine exhaustsl The Wugy uses
imaging sensors in the visuallnear-IR region at the etecbomagnetic spectrum to rnoritnr
the tielo of view for the presence of flame-
Infrared i_lřtiz This technology is designed to resp-cnd to ale spectial signatue of the hot
CGE energy emitted by hydrocarbon fires in the 4.34.4- rrimtirnetas rurge- The benim
combines spectral analysis with flictcer frequency ( 1 to 2 0 Hz) ágmilrms to prevent fůr:
alanhing that results from black-body radiation-
Multispectral I R (multi-im: The technology designed to níiirize fate stana aid
increase sensitivity by analyzing signals corriig from Irree u“ tou“ sensors ttvat filter
wavelengths within the infrared spectrtm- "mrtire ratialim souoes ale rejeched umu:
the detector internal algorithms.
. Ultraviolet (Ulf) flame detection: The technologyis designed to reqmnd to ratiatim errittied
by a wide variety of fires including hydrocarbm. hydrogen. and metal based. The detector
typically operates with vravelengths shorter than 250 n m tio avoid irtecferenoefrom the srl:
and other sources of radiation present in the Ultraviolet spectrum-
. UWIR [ultravioletiinfraredlz The technology is designed to mir'mize false alanne by using
sensors that are sensitive to both Ultraviolet and irfrared radialim melenghs and by
comparing their thresholds simultaneously. For that reason. the detector has a good
i m u n i t y to false alanning and is suitable for both indoor and outdoor applications-
15- Execution Logic toohl (Alarm Coverage) versus Executive Action Coverage [EnoNk Zoo"
provides the system with robustness and reliability [smrious flip avoithiceL Int it reqies
more detectors to achieve the target coverage. 1ool'il provides aderpate áigle detectoraian
coverage with fewer detectors, but it does not consider ňre need for continued tie detection
[voted] before safety actions are taken-

15- Detector tech nologyrvendor-specilic characteristics: Glnacteristilc include the effective

viewing distance (within a detector's field of view) for a tiueslmtd tire size. This is deterrli'led
b y detector type- A smaller viewing distance requires more detectors for a parlimlarappieatim
to meet the target coverage requirements- ÚEM viewing distancee shotdd also tre
coreldered- Larger off—aids djstances mr: require few-er detectors. fora particular apptioatimi.
ll Hon-ideal conditions that limit detection coverage:'i'luae Factors tan redace the sensitivilydi
detector optics dne to dost, dirt,“fog, and steam. They also mm.—=badtgmund autu-ua of IR;
radiation that could desensit'tce detectors.
la. Application entiíronmeht:Detector peliognance can be slits-ded by sh.- temperann'e, m „
EF Interierenceů and eny site considerations Eordetecínr Magen- detectorioterhelm
l$l, False alarm shrnuti: Stimuli include sources of U V or IR radiation that could result in Edie
alarrns- The location ol normal ftarrle sources stech as [tai-e should beau-Meteo.
Eli. Electrical area classification:ElectricalEquium-1muma conferm tblocal codec and Saunde—
teg-, U-S. National Electric Code Europe-tnhmaiocai Eiectrutechnical Gomm'msionL
2+. Gross voting.behveen FGH zonesinionitorm areas? Toe alianci: mda datemine il there is
aceed to limit the detection of a lazaret outside the mamutím area more s detector-iii-

22. Detector Installation constraints tocnmtabillty and nemame-ním: There mnm

indi-Jde liiniiatíon's dn mounting“ detectionmostem on an castingsiru-sim;amos dui lu
areasthelnoadto beavoídedforvohlbieoooeca. measure duehdetectuim

*oem ĚHMHWHW
catamount-tot B . ED.

ooouolbillty lot routine moinlenonoe: or eno-um ooeollloellono to lnoreole oeleotoro lo etlow

loriho unovolloollltr ol o elngle detector due to o loult or rnolntenonoe oollvltlu.
5.5.2 Goo oeteotlon - Inooor eno outooor oopllootlon [reloronoo 2.13. 2.14. 2.15)
1. Eno-oter llre ono ooo detection ono rnltlgotlon philosophy: Thla oooreoooe the end neon
objectives tor ilommahle or toxio gae detection and mitigation, It ldentlfleo ool'ety ono Ioee
proventlon goals. The philosophy will determine. for example. if the detection of ňro or geo
results in an stanu-unii,! condition cr whether executive at::tícn is required. The philDSWhjt
guides users in detecting gas accumulaticn cr gas Ieak scenaries.
Equipment of cencem for ccmbustihle cr tcxic gas hanrdlleak scurces: Consideratinn should
be given tc the equipment that is nf concert-t, which can include the fellmiring:
: heat exchangers
- columnitowerloonlnotore
- oornorooeorrenponooro
o pneu uro 1.ro-"Ilreootore
o Gll'ltril'ltiit punto:
. reolproootlno oumoo
. etmoepheflo etoroge lenit
. LP storage tanlte
- I'íred heaters
. Iaunchen'receivers
- sumpl'sump pumps
. plplnu manlfolds
. single welded pipe segment:
- orooootlon wellheooe
Prooen elreomermotorlol
. motorlol p n e u tllqulo, npor. two ohm:
o inventory
. voletilltyillaeh polnt
. precese pressmefrelemo velocity
. precese temperature
. tiammatjilitylI limits
. toxicity limits, IDLH, DEI-lh PEUSTEL
. goa mixtureo (toxio material mixed with flemmable gas)
Bounoorieo ol eros to oe covered by go: deteotlon: Fooloro oomioeroo for oolllng the boundary
oreo inoluoo eitiotlno oonotroime. All equipment In a bounded oreo ohoulo ootivolo the name
olornio ono eneoutlve ooliono ono inltlote the oorno oroooourol oertonnol oroteotlire oollono
[multer or evoouotlonl. ln oooiuon. oounooo oreoo ohoulo lnoluoe olmtlor ooo notorde.
Teruel ooo oooun'lulolionlleolr. eleelooeign-ooele ooo homo: Boo Clouee B ol trilo Tl't tor
guldenoe on the olee ano extent or nos occumulntlon.
FlammobIIity environment Locations of oontinement and oonpeetiom where gone ore most
titulu:.r to oowmulate should be identified. For heavy pane. identitu.r low spots where

Wemalsnt Nlrighlsresewed
 - 51 - l$eRB4.W.W-ED1B

accmmlion or emiiement may occur. Fur light gasesr identify locatiurs there gases can
become happed aleve process equipmeri where accunulation lil" eoniinenlent may obul.
T. ignition sources: Sources of ignition include the fclloning:
. open iamesispatrs
. high temperatures (above atmo-igrútiaon)
. nemine sources (s.p.. vehicles)
Úbsmictions ipenrtanentiterrma'ytr Coltgeelionfcoliiernent are factors to coi'isider tor both
indoor and cutdoorgas detection, because they cat sigtilicanlyinpact gas migration atd the
behavior oi ignition-
ventilation characteristics - HVAC. forced ventilation. or wind: Ventilation has a strong
influence on the irrigation of gas indoors and affects the opt—ina location for gas detectors.
Gas detect-ars should be located slrategicdy b a s e d m known ventilation dtatacterislics, both
normal and worst-case ventilation characteristics- FGSs using forced ventilation as a miligation
action are often energized to trip systems. Fans. blowers. and air handling units require
ccnsideraoly more power than other typical tinal elements. The UPS system for the sensors
and Iog'c solvers typically does not have enough capacity to pottera forced ventilation system ,
and entergency standby generators may need to be considered-
ln outdoor gas detection applications. the initial detector layout should beintluencedby the
direction of the prevailing wind but also should address nonnal and abnormal
meteorologie-ll conditions such as nighttime atd low wind conditions, where gas can
accu-nulate in areas of partial conhnement and curgestion-
10. Available technologies for gas detection:1he initial detector layout should be sensitive to the
type of gas detection technology selected. This Is particularly important if one selects open-
path gas detection instead of point gas detection. Feurer detectors are used will more sensitive
technology types or lower alarm set points. Also spurious dann avoidance shotdd be
considered. because diferent types of detectors can be less mbust in certain applications
where the detector is cross-sensitive to nontarget gases. Many detector teclmologies exist.
including but not limited to, the tollovdng:
. Infrared (|l Gornbustible gases have a cltaacterislic absorption signatue- This
tedmology relies on the absorption of IR radiation bebveen:! source and a receiver. This
can be implemented as either open path or point intrared gas detectors.
. Caldytic bead: 'i'h'es technology relies m a catalystboxidizeany contmstíble gas elielitg
at lowtemperahl'ee.
. Ultrasonic: This technology uses the detection of an acoustic signatu'e of a leair rather
than the presence of a gas
. Meta oxide satioonductor 01051: The technoiogy is designed to measure a sigla that
1lrliien
restiled from a manga in the eiectricá conductiuiy of a hated meta colide citit
exposed to the ionic gas.
. Electrochemical cetl: This teehnoiogy is used I'OI' tootic gas detection. Tris toci-nology is
designed to measure a signal promotional to the gas dithiaed into a cell tilled with a n
eleciolyte solution.
. Laser absorption spectroscopy: This approach Mines the absorption characteristicsot the
indiyimal mciectde of the target gases to determine the concentration ol gas. Devices sro
tuned to see speríic flan'mable or tatér.: gases. Hormally impiemented as open path.
11- Target gm typeis) and detectahiity: Maier gas type targets include oombuslille and tosic gas,
Deteotahility for cornbustible gas is determined through iealt sauce cr acc.-relation detection
1i.ii'ith
the site of the leatt and the size ot accumulation being varied respectively. Toxic gas
detectabdity is determined tltmlgh Ieai-r detection with leait sine being varied.

Neumannem
ISA-TRHN.W-2018 -62 -

11mmdvdmagasmnwedtomarmedmdydmetargetgaehasam
momemmemigmňmdgasbomnqsaadm.Gasdemcmrem1dbelooded
mmmmmmmmmmmammgasmhmmmm
air. Ae the derlttil'ir of the target gde retain-e to an'lbient air increases. detector eleiietion ehotdd
be |ovmed from incipient reieaee elevations. Convereely. it dei-Bity is ligtrter than ambient air.
detector elevation shoda tie increased.
13. Execution logic tooN (alarm coverage) versus executive action coverage Boom: Zoo"
provides robustness am reliability to the system (sportem trlpavoidanceL but itrequlree more
dete-ctou to achieve the target coverage. 100" provides adequate single detector alarm
cweraoewimfewerdetedore,butndoandoonetduduneedmmmmedgee
detection-i (votedl before safety actions are taken.
14. Personnel eno-vand enitlocetione (lomiogadeteetionk Toxiogasdetedionmberemied
atpoivtsofentryandnormalexitoremergencyegmse.
15. Vendor-specific oharaoterirtioe:Detection rnits. alarm eet points, and vendor specifications
will affect the location and number of gas detectors.
16. Nonideal conditions mat limit detection ooverage: This lrtcludee dirty option on geo detectors.
potential utalyet poieone. end oroee sensitivity of gene.
17. Application environment
. OoahpadigasdeteodsogAtmheaandmmomsidWIordetecu
ooverageordeteotorireerferenoe.
. Mgadetecm:vmereeoaoeisomoeeledmdwohmmeuedooenm
detectors. more sm'taoie for unprediotaole applications and trimer rislt sees.
18- Detector performanoe odnbe affected ov site ternperoture. l'ltl'l'e'dity RF interierenoe. and my
site considerations for detector coverage or detector interference from false alarm elimuli.
!- Summit—j of detector to nonlarget gas
. "nemoc elem-ls can stem from factors such a s Wind. viiration. or dirtidut
Detectorsvvith sell-dwi“ cen lowermeoomnenoeofwcli nuisaneeelenne.
19.Eleotrit=l tea dassim Gomiderotione should hohnde Miether there are end-user
mammodetedmgasmaňonmdeidediemdmmmdm.

mnam zalomen runtime-ved

 . !$ - IEA-Witůůů'fdůtl

Annex C - Mfttgatton action effectiveness concept

Miligation action effectiveness is defined a s hovv confidence one is that the result of activating the
litá elementtjs) 1.iviII successfully mitigate the consequence of a defined hazard as expected [e.g-,
i t prevents a s m a l l h r e o r Utti accumulaticn from e s c a t a t i n g t o a l a r g e fire or a c c u m u t a t i o n l . The
PGS must be octivatedin a sufficientlytimely fashion to reduce the event severity. An FBS function
might be inefiective such that the cutom“ of the event is not significantly different than it would
bi without detection cr activation.

it is- possible to detect a hazard and haye successful calibration of the final element-[s] associated
with the FGB function. and yet the result is not complete or effective hazard miligalion. The
reduction in severi'ty afforded by a mitigation action will be related to the magnitude of the hazard
being acted upon and the fundamental Iimitations of the capability of the FGS actions to b e
effective. tn general. the effectiveness of the FES actions is tittety to be very high when the
magnituda of the detected haccrd is smalt cnd detection occurs cutcitty, which alicvie the desired
safety action to be tatren 1.velt before there is the potential tor haaard escalaticn. Conversetyt even
correct detection end activattcn of the FGB actions might be ineitective due to:
1. An excessive time delay in the initiation of the F G S action, resulting in hazard escalation. For
example:
. Gombustible gas detection that isolates a process and opens depressuri zing [blowdown]
valves can require 2 0 minutes or more before the pressure in the system has significantly
reduced. with a corresponding reduction in the discharge rate of a gas teett. During the
intervenlng period the gas already teolred from the system could tgnite.
2. Human factors that result in a degradac response action. For example:
. Personnel addreesing the hazard do not evacuate the facility In a timely fashion
. Personnel cannot evacuatie a facility as planned [e.g., temporary scaffold bloclts the
evacuation route)-
3 . Severe consequences that are associated with the initial toss of ccntainrnent event that have
a consequence magnitude beyond the design of the PGS actions. For example:
e A catastrophic pipeline rupture vnit very litreiy result in an immediate vapor cloud explosion
hazard that can cause severe censeouencas before the FGB function is able to effectively
mitigate it- The eheuing fire might be ntittgated but not before severe safety consequences
have already occurred.
. Ftupture of a tottic gas ( e g . , chlorine) storage container rapidly causes impacts beyond the
i m m e d i a t e area. resulting if't toss of life before atarming a n d precauticnary a c t i o n s bocnim
effective.
The method of evaluatihg mittgation action etfectlvenese depends on the type of FG! response
action that is tali-en. These actions can be classified in the following general categories:
1. The FGS safety action involves direct actions on the process, including isolation and
depressurizaticn. such that this action meets the intention of the rislt acceptance criteria
without further miligation. Thus, Ihe hazard is mitigated, and escalalion avoided. A hazardous
outccme may still occur. The severity could be small in magnitude ( e g . . a small flash tire
instead of a vapor cloud explosion with a severe impact to equipment and personnel). ort
depending cnother factors. it may be large In magnituda. The probability of failure of the direct
actions vrce already addressed in the FGB safety availability anatyeie. A mitigattcn action
effectiveness would be a number greater than tt and less than t.d. depending on the ability of
the direct actions on the process to mitigate the hazard.
2- The F G S safety action involves nonprocess actions tl'tat mitigate the severity of consequence
[e.g., suppression. delugei. The effectiveness of the nonprocess actions is dependent upon
the magnitude of the initial hazard being within the basis of design of the FGB mitigation

Gopytid'rt 201!IGA. Allrightereserved.

ISAPTREl.m.ů?—2018 -GII-

system- For ham cases that td Iliithin the basis of design, a nitigation etiecliveness of 1.0
maybe used if the niigation system is verihed & su'table foruse in the appioefíon thai: alias
with the FES basis of design. Considerations should iii-rhide sullicient inventory tor
suppression material and sufficient energy availability for transport of the material. Ftefer to
lGases
step 9 for guidance about the inclusion of these systems in the availability analysis. fr.:
which the hazard magnitude exoeeds the mitigation system capability [ e . g . , the seenario beg'ns
with a catastrophic equipment failure that results in an initial tire larger than the design
moabilitv of the suopression system or a large touic gas cloud that precludes safe evacualion)
where the rlslt associated with tailures exoeeds the basis of design should be anaiyaed
separatelv and addressed usinginherently safer design or risk redtiction means other than the
FGB. This separate risk analysis falls out of the scope of this TR.
3 . The FGB safety action primarily involves evawation or sheler'ng of personnel. Miligatiol
action effectiveness is tvpicaliv lees than 1 „D for lumen response to the alarm Determination
of the mitipatiori schon effectiveness can be based on demorlstrated evanration dried
performance in similar operating envionments-
In sollte cases, the uerlited safety function may ilvvdve diverse actions in response to the
activatim of the FGS- As these actions are not independent, the FGB effectiveness is evaluated
as a single complex function. ln adiiion not all of diese actions result in ful niligation of the
consequence ol concern. This can be expiicitlv incfuded by expanding the FGB risk model (event
tree) to include the range of the factors that modify the outcornes and associated severities.
Consider the following lr-mple of a natural gas compressor station consisting of an enctosed
compressor building containing a sirgle compressrx. The con'nr'essor station is emipped with
optical tire detectors that will. upon detection of a fire. activate a mamina! fire suppressant system
that is designed to entinguish the fire. The compressor station is controlled and maintained by two
staff members who are primarily located in a control room adjacent to the compressor building.
The operators have the means to manuallv extinguish the tire. The end user wants to consider
horth automatic and manual actions i n the risk analysis. For this roi-nn, the effectiveness of the
activatima of the F G S is not a simple probability that the dry oherriieal system puls the tire od.
lnstead. it is a complex combination oi mechanism and human iiteractions. Some oci the factors
that wii determine that amount of mitigaWn that is aci'iieved will niciude:
1. Wtat is the probadity that the dry ohemical system will extinguish the fire? Ttl's probability is
a filaction of the size of the tire atd other oonhiiut'mg factors. The independent review ofthe
dry diernical system identified Eaíture mdes that oor.ild resil i: insutticient performance and
the taiure to omeleteiv mitigate the hazards. Faiiure of the dry dien'iical system to entinguish
the tire could be caused by:
. massive Hvar.: action removing the charita! agent too rmidty
. doors left open, preventing the chemical ageli from pr'operty'mu'nutatíng
. odes—r l'actors
2. lf the automatic fie extinguistmrent system tais, nil an operations staff rriernher mama"
estilgu'erh the fire with handheld equipment?
3- i f the automatic lie extinguishment system fais amd operations staff athenlis to control the
tire lnanuallv, wil they be injured during the pro-sees?
4. if the automatic tire extinguishment system does elfectlvelv operate. will opel-aions staff sti
be “lime-d as the resim of entering the room before extinguishing chemicals and ocmbustion
bypluiurds are verůted.
11te mlat-"lg event free depicts mame of tt'm oompteit safetyI function.

wmsianwmm
 - UG - ISA-WDDůT-NH

I..-.nl “lil-“ltd tunel Personnel-und

Alm: Elihcuuh Ignum Elim Pelmel byFumu-Eďln' mlh" tr.-mm!

mm
m namm
u

Figure 13.1 Event tree representing enmplex mitigatinn aelion effectiveness

Guma-n 201!ISA. NI right!mm:.

 “Emmu“

wmaanmm
 _ ET _ Iamm-2015

Annex D - Application examplee

AHEI!I5M4.QD-Dt—2ůtl4 is a risk-based standard lhat aohieyes lunolional safety through rislt
reduction. Risk. per the standard. ls calculated as the product ol frequency and oonseouenoes.
Prevention systems [e.g.. SIS.) reduoe the rislt oy reducing the treouenoyn and milioalion systeme
tlilte FBS) typically reduoe the risk oy reduolnp the severity of the oonsequenoes. The following
application examples illustrate performance-nasel: FGB design as desonoed in Clou“ lt.
Examples are provided lor llre oeteotlon. oomhuslihle pos oeteollon. ano tento ona deteollon. The
example: also show a range of tire and one phllosophles and a range ol required FES rinlt
reduouone. Tahle 0.1 is a summary of example onloulntlons ln thln nnnen.
Tahle tl.-I - Example summary
hnuti Hund We Duorlptlon Fill Ill-ll litlt IGI lhal
Mortillet-d Reduction Analysis neem
Tenet mood Aone
D.! Fn Fn enim Intl tumour: ln Leu lean Sen'i- ESD—'o
enoineusnulibly to elle-tim een.
D.! m Coubunlihie pu dnteplion in | Gral- Dlnnlitm E50
p|| nohu!penprediction deltou-n thu- 10

os Tutiepaa TudolHZEJgedeleolimi-ian Grudl W Em

umim geo pioneeaing plant than 10 m

Ilt Application example - tire deteotioh and suppression ln oil and gas well bay
module
This example involves hydrocarbon tire detection i n the 1.n'ell hay ot" a n integrated offshore oil and
gas production platiolTn. 111e plationn handles flammahle hydrocarbon liquids and gases under
high pressure. An ignited release of flammaole material presents a signilioent hazard tio personnel
on the platform- The end user has a n existing tire detection philosophy that was developed to guide
the pertmnanoe—hased design-

0.1-1 Fanoilitglr information

The example is a module on an offshore oil and gas production platlorm. The module is fully
enoloseo on tin—o sides, partially enoloseo on another, and open on one side. The area is a
reotanpular shape and is 20 meters (55 tt) in length on eaoh side. The module contains 15 wellhead
assemblies (Le.. wellhead plus Christmas tree) and a wellhead control panel [instrumentalion and
oontrol cabinet) located on the north olee of the module. n SD visualization and plot view of the
module are snem in Figure DJ.

Copyright 2015 ISA. Allright:rumu.

ISK-131W .W-EDTE -' BB-

Iilinoll
Figure ili - Example: Dlishore hor m
D. 1.2 tillllgu hazard asmeh'lont
T M M inel-'s fire muahahaa Includes anonim of nepronese-lila! megahit
labuť-praetor:
. minulem-d
. panenspremleandlmnůmm
- Wmteothlhrilwolwďinalire
. neomyďthelacility
. WmWon
Emme lil—E is a ponese module oontaining Harte-name [trumf-ou průoeeeed at high pressure
with the potadial presence o f personnel o n the platform the mana! Ee llazardlrislr analysis.
deleroůted the need For tire detection, with a requiremerrt for an FES lisi: reduction target ot less
than 10. Since there is no requirement for FGS n'slr reduction emeding tl), a oerni—quantitatiue
hazardfrtshasseasmem (Annex A) was Lrs ed to establish FES pericenmrcelargels i n this example.
A.: a result. the perřormance metrics used in this example m]! indude detector coverage
lmntiiaiiwel. FGS safety availability lousiitaiiwei. and miiigaňon aolion olieotiveness louaiitauvel.
file
The aid laseťs detection philosophy is for incipient (early-ml detection. automatic shuloff
ol the process. and Matula iirowator doiugo b y aotivatinp lilie fire water plump and opening the
doing: value.
Stop 1 - ldelllhy arena of oonoorn
The open—am oompamr tor this platform has atandanliaed denim maoioeo ln place lhal require
inoiliem lie deleciion to be installed i n all areas of ollshore ladies Int Mille well production
hlida.

Step 2 — Ideliil'y marek scenarios

The hasnt! Eleusis identified the potential for lealla from the Ile—earl. ml a range o f release
were eonsidered credible scenarios- T o simlify ilia m for iuslralilre purposes, lhe
analysis of only' one rislr. soenario i s included here- The scenario inrohrec a p'nhole leak from the
wellhead rewItiog i n a potential turbulent jet tire in the modlde. The muse could be corrosion1
erosion. or niedianical failure o f t h e equipment Although there ana oo shortg sources ot“ ignition
located in the nndule (open flames, unclassiiied electric-l eqrimient. etc.), the possibility o f
iglílion cum he risoounted- This is t h e most likelyr release seenaio naturill place a demand o n
lhelire deteclim system. Other s c e n a r i o s l n o t analyzed inliis entropie) ioollidea large Iealr [e.g.„
krgefiuelallanmlureofa process connection hothewelheai.

Copyright Ellis r a m e n e m
 -EE- lea—meccaar-aaie

Step : - Analyee eoheeauehoee

The credlbte coneeduence ot ti'lte icenerio Ie a potentialiy life-threatehing injury to a elngle reon
lt preeent in the welt bai,-r module at the time of the releaee. ln lhie example. e range o eehtl-
auonlltatlve consequence factors were coneldered. including the following information gott-terce
from probability of failure on demand tPFt'Jt:
. Wellhead preeaure ia 1500 pain-
. Process. temperature ie tOD'F-
. Praceee tluid has:- a ttaah point of -1D'F-
Step 4 — Analyze hazard frequency
lh lhie exampie. frequency analyaie vran eaneidered ueing nmmntttallue tectore including:

Front facility information:

. Equipment type
Front dlecueeioh with the end ueer:
. Personnel are in the area auf die well hey epprotttrnetelzir 2 boure per day.
Fromplot planta and the plant 3D model:
. The well bay area ie moderately opngested. with grated dediny above and below.
. There are no chong ignition saturace (open frames, hot autama., etc.) in the 1.ricinity of the thell
bay.
Step 5 -— Aeeeee unmitigated hazardfrieli
The well bay contains a total of 16 production weiie. each handling hammable hydrocarbon. Each
well operator at the name temperature. are-cure. compoeition. etc. Therefore. analyeie
performance target eelection woe carried out tor a eingto well. and the reeulte were applied tor all
15 welfheade. The proceee liutde present both fire and combuetiblo goa hacarde. However, for the
europalet: of dernonetration. only analyeie of tire haaarde will be prelented ih thll application
eitanig |.
The well bay wee dehned ee :: single FGB zone. Several lecture were ooneidered when making
tbie determination; theee corteideratione include:

. Dornmonalily of hazards.: All weilheada in the well bay operate under the same conditions;
therefore, the haaard presented by a release is the same regardleaa of the source.
. Actions taken automatically by the F B E : A continued tire (200W) will cause chut-in of the wells,
iniliate platform ESD, and initiate the fixed tire auppreeaion system.
Step e _ Identity FBS perfomance target:
A eemi-ouantitativo anafyaie (Anne: A) wae carried out to determine the performance ta te for
the cancel flame detection eyetem. Performance target: include fire detector coverage. rat
key inpull are reouired to perform the semi-ouantitotiire performance target eeleotion. Theee inom
were gathered from diecueeion with the end ueer of the olatton'n and from engineering document:.
including celo-. FFDe. plot alone. and plant 3D modele.
AnFGB philoeophy wee developed to guide the deeign teamin mpeg out the perfomance-bond
design of the detection eyatem. Key inpute for the analyeie that were documented in the FGB
philoaophy include:

. Early [inoipient) detection of hydrocarbon tire hazarde ie done using optical tire detectors-

w 2018 ISA. Allright:renewed

ISA-TEMN.DT-201B .m-

. Perionnance target selection le to be carried out using the cemi-quanťiallve methodology.

- T h e design-basis tire hazald i s a n incipient fire- The design intent of the system is detecion
of a 'l-lt :: 1-ft hydrocarbon tire (approximately 50 kW) within t o ti of all maior equipment items
tor wlich performance targets have been assigned.
- Flame detector mapping i s carried out usitg the geographic coverage methMology.
. 2ooN voting ie required for the F G S to Leite executive actions. Detector coverage mapping
shoutd demonstrate adequate coverage with a Eoohl voting arrangement.

W M these inputs. the smol-quantitative hazard ranking methodologyI was applied ae described in
Annex A o f thin reporL T h e semiaquantitative methodology is a p p l i e d once for each ma'or
equipment item. In the ease of the well bay. the anatysia ia identical for all wellheada and therefore
cm be performed once and applied to aii wetlheads- The result.-. are aa toltowc:

Lňtelihood Adiuated Liltclíhood Notes

Score
Base líheň-pod 2 From Figure A2: Wellead assenidy selected
factor = 2
Tampou-cy 2 + [-1) = 1 FromFigure A4: Moderatenr.—cupancgr
aůslmatt=— selectedhaaedonpersonnelhtthealea
1 approximately 2 hou: per day. Twoof 24
hours ia approximatelyr 10% oecupmcy.
lglion 2 + (—1)+ [4.5] = — From Flgure A 5 : Lomr ignition probdňlity.
emi'cnment = 0.5 Ii applying a semi-quantitative method tc tctdc
4.5 gaa this adjustment multi only he iteluded h t
tirefcombustible g a s hazards. (per Figlre AJ).
Md -0.5 Summation oi base liltelihocd factor and al
[ioeilood score adjushn ent laobrs

Consequence Adiueted Note:

I::nns-emnence Score
Base 2 From Figure A 3 : The process fluid is a
cuteequmce “volatile“ liquidbecause the temperature ot Ile
M=2 prooessitDtlFJiag'eaterttmnthemhpoid
tl-lůF ). but less than the being point.
Pro-casa 2 + 1-5 = 3.5 From Figure LB: Wellead pleasue 'n =- moc
pressure psig.
atitrstment =
1 .5
Otter factus nm Note that for combustitie gas and tomi:gas
anatysic there are two additional consequence
modimalion factors to oona'der (per F|gure
- au _
nitrated 3.5 Summaticn ct case consequence factor and al
cumequatoe adjushnent hztors
score
Fire Adjusted H—rd Rank = Mjusted Fire Liltelihood Scope + Adinsted Fie Collsequence Score
= 4.1.5 + 3-5 = 3.1)
The tire adjusted hazard rank of 3 - 0 results in a fire detection requiem ent of Grade El- From Fig-re
A J U . the perfomance target for Grade B fire hazards is 30% detector coverage.

In addition, the desig! and implementation of the F G S function wi confonn to appliedtle

remirements ot memen-mmnnama [reIerence 2.101. consistent 'I'ilh the target F G S risk
reduction factor.

Clam 2013 ISA. Al [hhla mnu.

 _:n-
mamma-ma

mr-ummum
111: med FGB swat—tm dealer: is hned na ma W amd hwrlrtřcs through the
mm:-m nf m: pream'pthfe requiremunts of the app-rum: Itanium! mandarda and mduiw'
guidelines (Annex 3). ln the Initial design tm optical flame due-ctu: were specified. These
detecturs ar: located in apposing camera nf the we! bar a sim “m Frgure Dia and D.2h.

|
ai'řďď'.
„ii,-ff
igir ,, --"?; ; > !

Flute 0,2: - Epica! Hm m nm Mun

“wmmmnmm
immmms .n.

mna-Wmmww
alma-VHÚ? Marcum-mne
ThedesřgnafsafaguimnymemdmrFEENWh-sšm
assessment f o r h y d r m m m i m m . m m g a h l i s m t m m m
taxa-dala). with 2 m ů w m a 1 w m m a d m m m Thema
hmmwamhmmmmas.

wan 5515195“
 ___.3_ $$$—mm

.
Hmm-Well hajma-hulmana Murat-da Bare-a
gmina!
Hume lla sm the achieved mara-age fur the Initial design uf tun nama detem ln
Flame DA, areas med by hran of mara Geranium are displayed &: green: areas covered by a
single detector are snu—n m ran.-fw. má areas mt novared (tl.. 3 a: :: this Imation M ml
b= deteciahle by me FES) are ahcmn hn ned In the Image na 111: cm the deteclor cnw is
Espina-caiu:mama-tl“ hay. Whitem nametenmhmveragg mlywitlitlh:
monitor: areas.

mpmmamummm
lan-mmman -in-

Haure- IJA—Flreeleteelinnminmm initial dmdnrhrout

Beeeucm then-emu nim: m m . im mmm mat approxinmtaly
935-3 of the merutmed area ie envefed by me of nm ůelectets n e e m coverage). and me is
severe-:| byhnmmedetedotstzm coverage; Bememmnntadequaeeteachievethe
80% average targei for & Ena-H vain-g manganem, the mamma deágnxlmuld be modified tu
pravidla & htgherdegree ufůeteetu'cmaga mamutím-Gmina mmmdítinnal
hmeaeteemrs.melmmmmrigmmdmmmhmembnnfmewei hiamThe
Mhhwmmwmmmůí

“MBE-kůlů“
 — 751- mmmnnmw

Haul-l D.! - Hr- dimltnn giwmphlu cnw—raut mup. mndlllid Hilmar Ilrout
In the modilíed design it Was dehennined that approximately 95% of the mmitored area is mmm!
by unu or more nemam: Hour—I). and 52% i: covered by hw cr mora aeternam [:::-om. Ennui:
'thil dulgn nchďtm un 30% loan QM! : tnmt for th. grod- B nm:, ml: duign uhnul:
mm: ammablu platím-mnu m nm: uf ro dutuclor mnm-gu

Wright 20151845.. Allmmm—M.

amount-201 B - ?B —

sig: e _ verify Fee safety availdiily

Upm a oont'lmed tire [Eoohl vote) the FGB actives the tire suppreesiul systems heilige) i n the
orel hay. The safety.r availability was vemte-d mialilativelv, because there Iinterne nu requiemehts for
FGB risk ieduction i n excess of a facttr oi 'lD- Sensors (optical flame detectors.) :! logic solver,
and tina! elements tisoietion valve. tireweta Pill'l'ip. and deluge valves) were deemed suitable for
use in ilis application per end-Loaf approval for this facilitv. While not required. it was noted that
the FGS logic solver was certified for use "tn satety.f integrity level (SIL) 2 applications through
cunici-matice with IEG 51503. Auxiiiary systems were Included In the verification. because sorne
FBS final eiements retv on suopon systems er do not operate in a tail-safe oonliguration. For
mnie, in the case of an electric motu-driven fire water nome power supply tailure was
considered and deemed suitable for use it this application due to the treqrencyof testing and the
presence of a redu ndant power sumy-

Sim 1D —'lferif1r effectiveness of FGB actions-

The design intent is to detect a n "litipient tie IHIEI'II (50 kW tire) and itit'ale IHI-acid shut-in,
open tieluge valves and start the tire water pump T h e mitigation actions iodide isolation of
armatury [wellhead shut-in) and smereesion of! the t' re Fire protection personnel contirmed that
mese actions are highly effective- An incipient tire is well within the capahiitv of the tire water
dalee system to suppress and cool st.-romano equipment while minimiehig mental radiation
ehm to personnel evacuating the area. As it relates to the selected basis of denim of the system.
the nuitigatien eltectiveness Is continued and does not need additional W e malysis.
Step 11 - F G S effectiveness (miliaated fie-lt)
Become the achieved FGS detector covelage et 82% exoeeds the target of eos tor the 2oohl
“ding arrangement, the perfomance E||-get is snlislied and the moriied design of lou deheotors
is suitdie Ior use in the applieation.

Wmemumresenee
 J?— Isa—WWE“

11.2 Applicaiiun example —CunI|uslime gas datacliun in a llillll'il 535

production platform
TÉ. mnie involves mnm gas detection in an BiH-alma natural gas graduation mm
Thisis asn-tall platinrm that m a brge ammntni'prncm What maulu ln 31mm
Milanem and mangu-mím. I! i: a malty unmnnad mm 1115 piatform mnam
humate hydranmbun gars unum high measure. An limited gat tahani prezenta— a pntanlialtr
mm: Hr: and exptasion husa hn permnnel. vrhu may be an the pinlfnrm mm
mm:! and other Bahma—
112.1 Facility Information
Thephťmm is open tn Hammamemailařdesjtiaamqňňflhlengm and Elita
uidmnrlmhy 15 m)-“l'hedeúia Emmi—Jeď of grated M M M W E I I bay medal—Emma
rine meliheads located as shown “m Fame LLG and Figm'e D l Fmsimiřrimiíon of this analys's
ard f:: iliustratiwe DUFDDEEE. emar Murat. including umi-ng Bastuni-zm connections. and “all
mim! panels, are disregmdeď. The Enid hiring proc—essa! has been approaimated as mamina
gas fc: this mamma platům Baham-.- has & Imar Hammdlle im [LFL] uf appmximai'ely 5%
m in air.

Figura n s - Example: Utahu—ar! gua production mang-

matkami-19mm
I&hrTHBil-DQDT-mtú - TB -

i: s

“%“%“%
máš?“.
ĚŘ. %
&?

€:

Figure D.? - G a l well hay (plan triem

D.:.: Fire alia pae haaud aeeaeemant

The hazard analysis emptayed by the end ueer ai thie iecliittr tnchdn ah eretuetian ta determine
tt camauetlcte pae detectidh ehauld ce empicyed. The analysis including the talldwiha ieatdre:
. material proceeeed
. prcceee pressure and temperahrre
l patential aaurcee ct caihhuatihie pae
e DWUPHHCF df tha facility
. degree of cdnlinarnant and connection in the prcceaa areas
Because this is a production facility processing tlammahle gases at high pressure with the potential
presence of personnel on the platform during maintenance activitiem the criteria determined there
1aras
a need tor oombustibie gas detection- A risit analysis was desired to determine if the
unmitigated combustihie gas hazard posed a risit high enough to warrant further rislt reduction.
The end user's philosophy for detection and mitigation is to detect gas amumulation at an samir
iincipient) stage with automatic shutott' of all wells on the platform- Th'rs philosophy guides the
designera to use gas aocumtlation detection as the basis of design-

Fully quantitative hazardirislr analysis was selected far this applicaticn example tc determine FGB
ristt reduction requirements. The results c t step 1 thrduph step B will demonstrate a target FGB
tielt reduction greater than 10 far scenarids within the basis ct design tie.. early [incipiant] stage
pae datactlant. Hazard acanarias that exceed the FGB desi n hasta wara anal ad saparatel ti
h'iaicr haaarde analysis and addressed through means a rletr reduction c er than the c
(Annett'ct. The FBS aedcrmance metrics were detectar coverage twantitatiret. FGB eatetii
etiitiilatiiiitiir [quantitatiuet and mitigation eiiecttireneee tauanutatiiie).
Step i - identity areae c t canaem
The area of cchcern iifca identiiietl far title facility ea the entire dectt ct the piatiarrh aanteihinp the
well tray. aa ahawn in Figure DJ.

[hpm'igtrt 2018 IEA. All n'ghls reserved.

 le
TE ' '%Tmem-Dr'm1a

Step : - identity hesardelrtelr scenerloe

The hasard analysis identified a crediple potential tor ieaire to occur tram eny of the nlhe pae
wellheads. A range of release sites are considered credihle scenarioe. For simpiitloaticn ci this
analysis and tor illustratlve purposes. the analysis of only one n'slr scenarlo is included here. The
acmario involves a pinhole Iealt trorn the ticwline caused by eroaive action of the tluld tep-. sand
production) resultingin a release ot combustible pas on the platform. This is the most likely release
sic-mario that will place a demand on the gas detection system- Uther scenarils (not analyzed in
tltis example) include a large Iealt and a rupture of equipment.

The Iealr. to be analyzed was ídealized a s a 'A-in [“S-mm]- equivalent hole diameter releasing
ttammahle methane gas at 11[lltl psi and 1t_'i[l"F [TECH]ltPa and EB'CJ- Because the platform is open
to the atmosphere, the end user wanted an analysis of this hazard that was sensitive to the tel-I
meteorological conditions at the facility, including a variety of typical wind speeds and wind
directions. For the purposes ot the example. only two vrind speeds ivere considered: a typical vvind
speed at 11 miiasrhr (s mist and a low tncn-tavorabiet wind speed ort 3.4 miiesihr (1.5 mist.
Step a - Analyse consequences
in this example a ranoe ol consequence analysis options vrere considered. Including qualitative
estimates. llmorrtred hazard correlation tahlee. and one dleperslon rnodeiino, In this case. the ose
dispersion model was selected to analyse the sise of the tlammahle envelope and Its possible
location with respect to the otop-osad location ot gas detection equipment. The disperslon model
selected allowed tor analysis of the tlammahle profile. and the model was sensitive to the quantity
of material released. the rate of release and meteorological conditions.

Gas discharge models 1.vere used to calculate the release rate from the tit.-in (El-mm) diameter hole
under H D D psi and “FTF nooo ltPa and 3B"C]| process emdilions- The discharge model
ntwlated a release rate of 0-5 lhi'sec (0.23 lapis). The dispersion model results showed dispetsim
in the downwind direction to an end point equivalent to 5015 LFL. This value was chosen trs
cortelate with the sensitivity of the combustihie gas detection equipment to be nl.-sed in this
application-

ttesulie at the pae dispersion model show the potential tor a comousuple gas accumulation ot za
it to rn)in the doivnvrihd direction and approximately to it to rn)in the croeewind dlreclion. Analysis
shows an accurnulation cl isoo cumc test (55 cubic meterel. ln addition. olast modeling vrae
conducted to show that this accumulaiion can result in a pero (21 hPa) overpressure ot concern on
the structure. The results tvare obtained under credible meteorologicat conditions tor the facility at
wind speeds ot 3.4 miiesihr (1.5 mist The model was studied and deten-nlned to ide relatively
insensitive tc atmospheric stability tor this example problem and relatively sensitive to assumed
Irrrind
speed- Figure Dj! illush'ates the output of the gas dispersion and accumulalion model-

Copyright2i318l5A. Allrightsreserved.
mvnetaoareme seu.

Figure DnB - CFD nos dispersion and ecmmulation model

ll has aooumuletlon were to accu and the oombustlhle gas need was lonltecl. e vapo: Until! fire
HIM occur. A yspor cloud explosion ls oredihle ll' mis small teak o f gas per the basis d m is
im detected earl y, and the mutation come increase to the Mille maximus of 55 m1 ot gas
uhlím the hammable envelope. Dimssion of the paranlellefshnpactlng the outmrneď an “gained
vapo: cloud i s beyond the mnpe of this technical report. Rafter to CUPS Guidelines fm“ Umim!
Process Duantitatiye Rial: Mysu (reference 2.7) for me ín'íoanation.

The—neolible consequatoenfliissoenarío I s a parental loss ollife 'rfpersonnel are p'eeerúinihe

alel hay module at the line of the yapor cloud hmmm. Based on the expected personnel
slaninu the oceupancy nimi.-well hay module isomuiriered tobe no more than :! Innoutd
each Id.-how day. or oholit 8%. Tii: ls consistentuirh : namely moccupiee lnstailaaom Perthu
end user's protocols ler hazard and rlslt aeeeesmentr the use of conditional modlliers ad mi
Kam:: i s permittecl.

Eten 4 _ Analyze heren-I frequency

h lh's example a range of frequency analysis optima. were considered includ'ng rpm-fe
eelinates simplihed frequency holnip tables for galerie silrralions, and quantitaňve analyse of
iúrslry failure and teac ihta for specific equipment ilerlls. ll lh'e case the affiliate
rmirtains databases of eminem lealr frequencies, and dis database contained the Write
lei frequency,
The Iihellhood of a pinhote lest in a single wellhead Dim natural gas with the farme was
tom to b e SE-B per wellhead-year. A probehillty o f 30% llor delayed Ignition of high-neseme gas
releases was selected for this release. based on offshore einem date for similar releases. The
ieqmncy of a hash fire event is therefore 1 5 5-3 per year for a single wellheao. Since here are
line mtal wellheads the total frequency of the flash ire event is nine times the frequency of a
silgle wellheed. o r 1-4E—2 per year.

Ladrofnormal ocmpa'rcymlleplathrm reduoes Iler'ulrtnpersnrmel- l n thisme, Ileplďorrn

is miso only &% of Ile line. The lazard scenario 'n a Mariem integrity tihle lh! Ius no
went correlation

wastelsanmm
 -$'l - El.-WMHT-ENB

hsuocnmenceandtheuccunencyufthe ptaticrmJ'hereiore, there leanEttpmhabttitythat an

íg'itedretease ccuid m n m - e identified eatetjr m e to persomeltunitghme low
oceneni—,y.
FW =1E—3pajea'perwellhead15MxDDB Domino-Jr

= 1-1 E-3 peryeanůb personnel

lilo unter protection h m m iii—entitied thatwmdtt lehce-me treouencyofihe hafani

$text 5 - Aeneas umittgated huardtriett
Based on the operating cmmany's rielt criteria. the littelitcud of this consequence cementyr should
be reduced tc less than 1 mance in 10.000 per year 110“ per year Individual risttctfataltty). The
iequency of the hazard scenanc without the heneit at the gae detection ersten IES calctnated
as “HE-3 per y e a r h j dan-ce in 1.000 per year). Therisit criteria is 'iE-egeryea. 't'tleletore. the
risk uiteria have notice-m satisiied for the unmitigated hazardu-ist..

Step E — Itientifjir FGB peticím requirements

Mae-d on the results cisteni a recommendation wm najeto design a ocninuiíhiegasdetectim
anti automatic shutdown system that would reduce the tisk by & factor of 11- M shutdown
mid inwcive closing well sortace safety end wing fra-hee in the event c t gas detection. Gas
detection fcr elmllar facilities using IR edscrcticn teci'umlccy has uroven effective. initial tai-nete
lot gas detector coverage nas selected ae Elat-i with an FGB safety availability cfgreater than 93%
based on the unmitigated risk model and the target itek frequencyr ct' 1E-De per year. These are
setected ae initial concentrations based on the apphaticn of the risk model tc achieve a nett
reduction greater than *!1- Because the safety action forthis FGB safety function is procese shutoi'f
atd isntation of the segIIIatt. the confidence is high that a n effective mitigation mil oculr when the-
"liiíaiing event is meteátwitiín the basis of design. The initial selection ofmitigalíon eliectiuenlea
"s 1.0. See Step 1D fou'add'diinal considerations- hmm the quantitative tisk andel (event tree)
Im used to detemiineihe ielihouod for the unmiiímtedand mitigateo m-

í nauce-= FGESetehf ]Miigmim |

hw.—lateeemgi
. W Lin-Ihned|
|. | | i "

'— “_- „Exim—:eli—Ě

— q“fee
_ ' _..
'— -i ..- ] mms-m
|
mamma lh
.- 1 ' huci | 135112.
1 _ |
1M: _! _ ' „
| "7 | | 3355-9191
eDetectotetege-a
'FGSmultiroom FES Safety-My-
= 1153 :. 5.5! I ' HJ

'= 031141515 FES eštehtiml

Wm = Emmti—HĚW
.=-» Lammr-15h italie)
.r- IDE-l per pair

“mentace—isnaHmm„
mramor-me - BI -

“terefone a baget FES eifectiveness of approximately 0.51 IE redace lithia leveliliat satisties
the riů atria ol'no more than 1.0E-4 per year.

In addition the design and implementation of the FBS furltdion ilin & chi-ed FES risk reduction
fact: (HRH geatef than 1 0 1|r|.|ill oonfortn to the appiedie mile-HB ci "EMEA-34.91.01-
21112 (molto-e 1101 and ANStliSA-Btl-DtlDl-EUM (reference 2-1).

Shep ? — Iniial FGB design

The proposed gas detectionrshutdown system design is based on empatii-hmot and hemistics
hmm applying the presuiptive requirements of the appropriate latinu mus and industry
Mies (Aim B]- The design involves the use of open path mmm gas detection with
hee detectorsets mood on the platform as shown in Fly.-e o.s.

©
LF

...-„„z
.quote-rr-
a...........„„

?> e
Flame 0.9 - Initial nee detection system design: Open path gas detector placement
The gas detector: generate s 4-20 m signal proportiooat to me measured gas concentration and
also generate olse-“ete alarms When the combustible gas menu-aim is detected above a
tlveshotd vane as measured in LFL-meters for a detected gas level- The sensoreignal ie received
by a logic solver. which sends a command to shut down ali wels in the well hay when gas is
sensed- This mld effectively shut off the source of the oomtiustible gas from the |||-lt point and
rrilígate the Hammel-Je hazard over a short period of time as the pressure a t the source drops.
Cunhustiůe gas detectors will be contigured with sensitivity that slows for detection of a
ooninistihle gas cumenttatim of 0-5 LFL-meters or greater. This will plm'ide adequate sensitivity
to dehet the hazard seeneu'io of concern given the overal ditiatsittns of the module and the
proposed location of detectors- T h e initial design did not specify whether sty single detector in
alarm stáe 1ilrill _IIE the shutdown system to activate [e.g-. hrou voting arrangement), or if
nuliie dete-clocs are requ'md to cause isolation- Epurious activation of the FES does not result
"na m a l a t e - d e s i r e d eventfrom an economicstaimdiii.

Copyright 2013 ISA. Al m m

 aBĚ'a
.mmocoracte

etec s mihne: detector cervence

DetectcrgeogrepřlicW

A computer model wa: uttlld to analyse geographic coverage consistent with the Methodology
shown
.tietinc
ll'l Annex B oi thit. technical report. The model generated coverage factors tor both a loolti
1'doclil
arrangement lany einale detector has the capability lo inltiala a ehutdcttnl as well os a
voting arrangement ttwo or more detectore are reauired to he in alarm etate to initiate a
;hutdolšnl Graphical output cl the model that calculated geographic coverage ie" provided ln
law. Flair

.mtlwmmtm
_ E'Mn'l. 1 Drt— Dae-i|
litam-MM

Figure o n o - Gee detector geographic coverage map, initial nee detectorlayout

The geographic coverage reeults chotv that approximately ?Eitil. of the module le covered by o n e
or more open path na: detectors. The area that ie covered by both detector: is much lese, in thie
htf
dalee only 21%. in addition. 21% ct the module is not in the area covered anv- of the three
detectors. meaning :: threshold volume ol comhuetlhle gas at thcee location;cannot be aeneed by
the initial detector layout.

otec lil - Verity r c s estate availability

The satetv luncticn was initially delined to Include onlluI one detector to eense the hetero. TI'ilJl. a
too1 voting architecture woe coneldered. A shutdown cl the ieaiting eingle weiihead hat oeen
included in the hos lunclicn. ln addition. it wae eoecilled that functional testing ol eenscrs and the
logic eoiver will occur at an interval ol once cer year. Per iccai regulatory requirements. the
functional test interval cl final element volvee tviii occur at an interval ot once cer month.
Methods and eampie colculaiione on how to calculate Pl'Davc are included in isla—Tiltemmui
treterence aci. The retinolu.r inputs fcr utls activity include device failure rate data end functional
testing intervals. Shut-in ol cas vrelle uses a deenetclee-to-lri signal. Using eimplilied equations.
tůhgargsuilant PFDavg ler uie PGS function is 0.015 or an F catch.r availability al 1 - 0.111: .

Reliability dete tor the selected FGB equipment wee identified. Any tailu'e rate dete used should
be in conlonnsnce vriltr ANBllISA-Be.UD.D'l—2W4 (reference 11).

Copyright 2013 ISA. All rights reserved.

IE-A-TFHHMM - 84 -

_Device
Type šumu "wheels-rl Era-afT'eet
File Hatelm (pu hour) Interval
Gompdtilřtgadetectt “ALDE—CE 12 months
FGS logic solver 11250? 12 months
Welltitsad start-in value 1,451!— 12 months
'l'lvdudinglitá element “IHW
To calculate the FIG-$ safetyavailalíily forme fmction. the PFDavg should be ceiculated for eadi
of the FGS motion cornbonenls
The iool PFDavgeriuaionwas used. The FFDavg for the open path IFt gas detectors ls calculated
as icllovn's:

„tw-rr
PPD“ = :

Siwiec equationlnr 1oo1 vaha corigrlaion from ISA-TR84.0EI.02 (reference 2.81

For this emnple, the enom beenrnes:

EPDM =t = l.W£—06*(I*8Tm]u= SBE—03

Fortlte Smernice lojem. the PFDavg atlfte prescribed test interval vras tůminmlhe
veruiur's safety rue-tuti as 4.454-

For lie línal element (ESD value). the FFM is calculated using the simplilied 10:11 equation
fmm ISATRBLWHE (refetuvce 2.5).

PFDJIE :l—nííí : lÁ-E—Ěánmm) =6JE—Ú3

FGB
dele-chora

Step 10 _MEneohveness ofFGS Actions

Actions takenby the FGS cen be manuallyor automatically Initiated and cen affect a wide variety
of systems. This example outside-rs automatic shutdowns that invoive the closing ol' well satana
safety and wing valves in the event ot early [incipienti gas detection. If successful. this action vn!
result in a state that meets the rislr acceptance criteria (i.e. a email flash fire instead of a vapo-r
cloud explosion with a severe mtpact to the platform ano personnel). The probability of failure ot
lhese actions is inoorpcrated in the FGS safety availability analysis. Therefore a ntitigation
effectiveness of 1 0 is used in this design
Step 11 - FGB effectiveness [Hitiualied Risin
The frequencyot the haaanf scenariowim consideration ofthe bent of the gas neliecim sychr-
(detector coverage, FGE estery avaiabiity. and nvbgaticn action effectiveness) was calculated as
ehm ii Fogln'e 0.1 |. The im Minas performed using the detector [scenerie] coverage
aid Ino" vulňig manganem.

wasmnmmm.
 __uE-_ _ E!E!
mempmmmmmw

=d,řB;EBEEst.ll
=nmmsřmm
Fali—Fam
Wiki: =
"= l_iE-llparwarxt'l—DJ'É)
31514e
=
magnmmmumwmwamďml—muammm
Dfahnu'l 4-
The overall Iihelihuad ufths hazardsuauzinuas Mas EEE-:gayeartalňdmmil
1D.Dliliperyearj.11iís m a n a m u u m m m m m m m m m m r
Ibis scenaňd u“ Blancem iEDDilperysarUFpuysaritdiuidmlňstdm “Ela-fara,
heúskhasimprwsdoverdeumnidgáeddaigmhlmstitummlnlbeensufmňadm
ihe initial design-

Modify FGB design literation afStsp ? Ihnmgh Step 111

Since the n'sic mtedmwasmtsaňsňedbydmiihlgammtemmm
to meet this objective- Dpiinns lhal would be ambra-d musili: m

. adding aneurmaadnílhdgasdeladmshbumddamrm
. inueasingmehaqumdíhmmdmeeňsňmsmmhmřůs
safety availability
I n this case, the and use: mladtomalyza hewúlmwůmapmpahgasdetsdumled
suuth nftha nine m ů s h ů ů m m m m m m m w m m k
positioned in a mai-maf that would detect gas Bun Eels in an misii-Draha wind colitidou (eg..
wind blnwing frmn the noru-mast). Figure D J I slim the maxim delam tsm Tha mays
mudai was ranu-| furthis mario. and mtmnsnsmmbshwhřm 0,13.

wmsanmm
 „ “ “%% %

3
k...?

Elm 11.13 - Gu danem MMM: mer-ig! nur-l. nadhled na: dunctnr hm

The rar-til: for the Mind detector Iayuut shon M the BMI? ET?- tl passíbíe halami
scanu-iu Witt-DNES ale covered by the detector laymtand can hesmsed by atm Dne dekdu:
121mb! wing). Tha aspiration of the quantitative ást mda! tmm tme) aim Ina calmlaňnnnf
the W of the mmm and milanted m.

Minimum-nwm
 .:.-». Emma-m1:

amu

UNE-DE;

iii—neni“

$$$ wwwasw Deram Guarana;:FESmmmm :: Wim-Adin! .W

fam-s
0535 x 170
==.0-35ťi talm- Esa-mamma;
magi-1m Hřib = Emmu H _ m s m m
= 1.153paf rara [1-ů'.5$).
15.455
=;- par ina:
Tha- design redum the :ía'k'tiy 'a fattnf 1:w — Hamm a'ti'ák radarům ui Ebdut 25.

Tha-memu likelihund ofthe hamrumnam wasmmm the mnďlňed lava—mta 435.5pan-aw

(& 4.4 :hanne ih. 100.000 per year)- This. is helim'f the maximum risk that Was S W fm: Elis:
mnam: uf í-man'lne ln 10.000 par year PID—'L per yalr indivídunl' risk nf W031- W. Hiv:
link miterřá have ham-Satiaňedúůh lhs mama ůes'rm using Imu- avatara

ayl'lnht 2018IBA. Allrights m.

[EA-MMM“ -BB-

0.3 Application example -Tomic 0115) gas detection In onshore gas processing
prat
Ttisexanmieínvduestmicgasdetedioninanonshoregas processmgptmt'i'heptunea
MMgasmmmnsumdetHzS)-Amel—garmmm
arnospherepraemsatmrtetnicityhazammwmters.

5.3-1 Faciňtf inform

mattmmopaalingmtQasis processedunderpreeswneTher-i'ee
apumůrnatety 100 11 in length and 100 it in width. The piant contains him separator vaseho, a
pump and a maser. as sim in Figure ELH, For simplification of this maly-sis anti ler
ítiustiative Fit-1111055. other eqtúprnent. including pioing, instrument connections. and watt docent
donate. are disregarded- The ttoid being processed has been approximated es propan-ie gas with
1% Hai-'t ttůýůit ppm li.-$ mt tor this attempts. s has an acute toxicity concentration ol' ovocem
of too porn (tt—rt. iii-lidi is the mimino immediately dangerous to life and heatth [int-tl. res
can be detected at aromatic-ns as tow as 10 ppm using available detector Melatonin.

G
,; být i
tme

IIÍIHIF|IÍ||II
Fiume 0.14 - m:
-|?=s onshore gas processing focal!
DJ.! umre mem-ent
The end usu's ptiosochy of toa-dc gas detection is to detect oonoentrattons ot gas that could be
hazardm to genomu, so mat action can tte taken to evaooete personnei to saty mm 15
Wes. Eerty [umeni-tt aid effective detection aliows personnel to evacoate- take sheiter, snu!
reapend by satety shutting down the process. The |::hilosooh).r requires identifying Ieaiďreiease
some-es end size and locating detectors in the correct proximity and orientation of release sni-eee
in order to provide early [asistent] indication of a hazard. Based on these philosophy eiemeru.
the decision to detect lze-lime releases by slrate-gicalljur placing detection eqnňpment'll m
to leiease soclees to nu'ligate the size, extern. and duration of the HzS gas name.

Etepi—Hentřfyaleasufeoncem
Dnealeaofooeeanuasidemitiedmrtiúseamnpteprobtemjhe gas oornwessorů—1M.Becmse
Hůfaciilyeolmsipiiieuimmermations of HIE in the proc.—ga,scree|ůgclie1h
ůelemitediheeeedimhiicfl-lzajmsdemciřon.

mediem All rights reserved.

 —89 — [MW.DUBT—EU'IB

Step 2 — Identity hazardsfrí sk scenarios

"the hazard analysis identit'led a credihle potential for Iealts to occur from the compressor seal,
resulting in the release cf flammable and tcxic gas- Personnel are potentially subject to an acute
tosic hazard due to routine occupancy in the process area. Because the proc-es is open to the
atmosphere the actual hazard at the time of a release will he sensitive to the local meteorologie-l
conditions at the facility, including a van'ety of typical wind speeds and wind directions.

A range ot release sizes are considered l::redihle. To simplify this example, the analysis of only
one rislt scenario is included. The scenario involves a release from the compressor seal [tull seal
failure. annular release). resulting in a release ot propane gas containing 1% HzS. This is the most
tikety release scenario that will place a demand on the gas detection system- The tealt to be
analyzed is represented as a 'r'i-in [12-mm) equivalent hole diameter releasing process gas at
compressor discharge pressure of 500 psig and 1DD'F. Gas discharge models were used to
catculate the release rate. The discharge model calculated a total release rate of 3 lpfsec [t.-t
tigris) ot process gas containing 15“- Hes.

Step :! _ Analyse consequences

Gas dispersion modeling was conducted lo analyse the sise and extent of the tosic pas hassrd
and compare it with the proposed location ot HeS gas detection equipment The dispersion model
selected allowed for analysis of the toi-tic concentration in the downwind direction and cross—vhod
direction based on similority modeling, and the model was sensitive to the quontity of material
released. the rate ot release. and local meteorological conditions. For the purposes of the example,
daly one wind speed of 3.4 milesih (1.5 mis) was evaluated. The dispersion model results showed
dispersicn in the downwind direction to an end point ot 1D ppm His. This value was chosen to
correlate with the sensitivity at the l-hS as detection equipment to be used in this application.
Lilothreatenino concentration (TDD ppm :S) and injury concentration n o o ppm Hiei end points
were also modeled.
Results at the pas disperslon model show the potential tor a tosic as envelope ot dimenslons
:D'tt to rm in the downwlhd direction and approximately :! ft tt mi to t e crosswlnd direction. This
result was obtained under “typical" meteorological conditions for the lacillty wtlh vrlnd speed
a.stmlleeth (1.5 misi and neutral atmospheric stability. The model was studied and determined to
be relatively tneensltive to atmoephedc etaaility to: this example problem and relatively sensitive
to assumed wind speed.
Figure 0.15 illustrates the output of the pes diepereion model. including the aloud taolptint in the
daivhwihd and prosel-vino directions.

Copyright 2013ISA. Allrightsreserved.

 _m—
mmm

FH
Wm-
HMU"

h-w— F-Ta'l-rn-P
: T. [1- [ -F T* '-

'
I'
'a
l.-
.:
__
.'_
=“.
I:.- ;
1- E
5' .=
|-

|:

» v ,.
1 |

"=*-*="'==.r-Ptrtuzrw-H : "“L==Éířiíčiiiíššiili
rll'nll'Hb-I-l..1 -.- '

Figure 0.15 - “15 na: Eupen-hn madari: Fmtíle ňumdfnatprinliim

tfthls film aaa-una! má tui aumbusiibte gas chun! was nat igma“ . the autumn: muk! ha :
bula gas hazard The diaparS-an model shaw: a hazard: distance a! approximatew 150 ft in the
dawnwma mmm to the lm ppm IDLH and ala-nt. Furlhar. the datech-able cam—atm uf
1Ú*ppm Bitte-11.15 furthar tu a Galance af apprnmnatel'y EDD it. and "marea about BU ft maximum
in the cross—'n! diractinn a l a instance of 300 ft Milánu. TIE- utedíble came-cim of this
s::enaríu Esa pntentíally [HE-EME: injury h a m e persia iřprasem naar lila masar at
the time GI the release.

Stag 4 - mu:: haaarcl hmaty

tn this. ataman-, a quantitative analysis of mmm Ialtura ana lea data far apaatů: aqmpmmt
items wm: 35:1 “ma likeimaaduf seal faitura tmm a aantrifugal Mar was huma to ha 15-
2 parfem: Perth:-end Laara pmtnccrlsfurhaard and risk 355mm. the HEEEČ amni'tinnal
mihal-a am“ enabling tam.—=. ia permitl'ad. The tank of nam-lit mangy FBÉIICEE the [is:-L b'.:
p::aannei. In this casa, the pra-mala area Is mm ani? 4% nf the time. The hazard saam ím
?; mentalit-at Negril? failure that has na appa-3m correlatían bahnem ita americe m the
maupancy at the area. Therefore. there is a 43: arahahíiity tm: : aaa talent-E mms in tha
Hanuma sam; :anaaquenoa m ta tha law maat-lay.
Slap 5 — mm uagalad Wrtak
Fun-mnu = “l_E—E p_al'yaafxali't-DGWPÉIICIW
ř—
iE-l par jaar fish: tu gamma—|

mama martina 'Iayars ware Hama that nabuduce the imf af tha haaalt

53526 an me operating Baumax-'s na: urna-tn m: “stihnou Drais uuma wanna semta- smulu
ba reduced tn Esa than “was—cimca: Tn mam.-ups yaar [BE-5 net masti Miniunidatu: titulů!;
Thefreqmanq afthe hazard EEEIÍEÚD mmm Itebenatít Mihai-HE madatadíaw W m :
alaulatéi as ati-1!- par yaar tím: :hances "m m.— par read. Therm: uf the sua-mňa & :: taatar
am túgtťrm tha HEH uit-aim nf 3EěpammT1HEFmt- t'fEtíEk criteria Hra:-lat ham
mmm farmunmftlgateuMn.

mamtnůmmm
 .n.. room-m or-aio
Step 5 „ _ _ Montty roquíromonts
FBE parliament:
The ono between Unrtiitiooted end totemhte risk "is a factoriit 15. Thommihopottoononoo target
is ňlh Fota otiootivonono ot asto. roooirinpo rloti induction tootor l'ttttFt-ot t o or more in the Fisti-
loit ormonoo-

Tho cotton ono Implementation o f this Foo function 1.littt'l clplmod FGS HRF ln onom ot t o Ilil'lll ho
ln GBHÍÚI'ITIBHGB with Uli applicable itoquirerncnta of meines—cost
_:too-t
tui-2012 tvarovanou atol-.
AMElllEAABELEDtE iretormce 2.191. andAhlEll'lEA M_oILD'I [retarence LIL
Etch ? .. Initial F GB design
Tits initio! po: polootion option to osm on footer: in Anno: 5.5. Tits onion lnvolvoo inc ulo ol
polnt H:! o : d l t l c l i o n idootroorrontiooi tri-"lil Wlth thin ostnem III. piooto |F| the pom II
ohonu In ipm oto.. This to the protorfoo nouipmont uno otf-this facility-. Hopu" hoo-ptlof

Bi-
|_
qli'lir-1I-—+Ir1iřr' I|+1++POQIr—Iqii-ů

Plnou-citit --lnltI-i lisi tiu ort-om llt'out. polotolntrothmionl His ou Hunter.

placlrheht

HzS gas detectors generate a 4-20 m A signal proportional t o the measured Has gas concentration,
and also generate alarms when the to:-tic gas concentration i s detected above a Ih reshold value of
10 ppm turu). Tho sonoor signol ls roooivoo by o logic solvor. which annunoiotos ouoiolo ono visual
claims ln tno proont orca ono control room. This pivu porsonool tnc opportunity to ovoouoto tnc
tncllitv ono woulo mltigoto tno ionic ho.—raid. Toxic gps dotootoro will oo oonfuguroo with a sonoitlvlty
that allows tor detection a t a gas concentration of 1 0 ppm of greater. This will provide adequate
sensitivity to detect the hazard scenaric o f concem- The design specifies that a single detector i n
alarm state will cause the alarm system to activate ( e g - , tocit! voting arrangement)-

stop : - vority ootootof oovorogo

A ronpo ot ponlolo soonorio outoornn wo! oonslooroo that p o o r - o n o tnc poutoiiltv thot tho p l s
olouo would oloporoo com-immo from the roloooo location ono oouto oo oder-too in city of the 1!
gostulated wind directions- In each case. the determination tvas m a d e Iivt'iether or not a n y of the
gas detectors were posilioned to sense the toxic gas. A computer model was used to aid in
conducting coverage mapping. T h e results of detector [scenalio] coverage method was selected
because it i s sensitive to the layout ot lite detectors with respect to t h e prevailing wind.

Gopvligl'lsmsIEA. Allrm: reserved-

Hmmůíéiml Jíz-
mm mnohe-I _
Hm hulmani neumi mor nemn-
slaanarin (pam Mama bankam wins Merino Prem
Eee!Failure mm u. .us-lu ru ulic-1
5aalFailure lidi ale Agfa-ln na na mila-oo
SealFailum ili-IE nz iaE—ollin n.ll malate
SeaiFlilure ne:—mE!E Los—oz na. lili musm
5a Fallura 1555! E il.-iso?Tei Lo 93503
E_eillFailure nem a! SHE-ů!- m LU mm
Sul Fallura „toe-ol! 5! 5541 ve: Lo : .liE-Gl
sil.-llF-IIILII'I eos-oo ESI: IQE-ni m LU "Lia-BI
iaal Fallura Lue—oo i usa na lm eos-oo
SealFailure 1m il. lit-nl Ho DJI D M
sealFailuna mm 59.- SJB-il!na mil n.llErm
SealFailure LEE m LiE-El ru Lu 115g:
SealFailuna 11:55! W ert—m f= LE! .aisoz
5aalFailure usne m me:-mHe .nl; mnam
SealFailure 5541! ul: usa: ve: 1.5 155451
SealFailure 1:55! new 93551 Te: LD“ 3.153
Tou! 15540! nemam-ie tmp $a
Figure DJ? - Snem-io Dover-ge malym lot Mol mar hnul -
Amanu-silo “die-itím ohm-: mo ohmlnedam:onomlrl MIME.

Figuren_1e„nneaeiiistiewinummtuindmael
Mmaoomm

A Wer model woe used to mlyn coverage mlekem with the methodology shown ii
M52 ofthlo leotlmoulrepon. The model generatednowemgetootorfora mnm
Wlan? oinglemrmneealarm).

“melanomu—ae
 -se- mmmmaw

Wanted risk of tui: gas heard Illigated risk ot-tosic' gas hurd, mrte
coverage Ito-cln

__ _ __ tlamu
w l'—
_I-I H tu.-|- 1-- lbl
uhne-use
_. | . ... . luh-|

..."
mm“ |

Egure U_m—Tůň: gas [H:-5) detector scenerie coverage map. init'ul dete-etiorhpou'l

“the coverage calcinaiicn remus cnw that spornou-stedy 35% of the pueblo orloomes are
coveredby detectors. His means the detector coverage is 3855.
Step ! - 'v'erlfv F G S satety availabil
The safety function was iriumly detineni to include a sriliciency criteria for one detem to sense
a hazard- Thus, a tou" voůlg architecture vfas muideeed- I n addition, it was. assumed that
tlnctimal testing of sense-s and the logic sohrer neule- ai an interval ct mice per year. Final
element taudibte and visual ahrms) functional testing necurs at an interval of m per month.

Helt'iods fcr calculating the PFDavg are adequatehr desu'med in lSA—TRBálDGDÉ [reierence 2.81.
I.ls'ltg simplified egmtiuns, the reeultant PFDavg t'cu' the FGS function is [l.tl'l or an FES safety
availability of 141-01= 0.99- This includes sensors ttoo1 gas detector with ciagnoslics). logic
sotver (SIL 2 certified). and the final element [tooz visual and audible annmciatioot.
Step 10 - Verttv effectiveness o t FGS actions
TIistaciiitv undergoes annual evacuation drills. Basedco me orill performance record. on average
ale or more individuals do not evacuate in a timety runner 205% at the time. A5 & I'ESI, the 'l'iitřal
design uses a mitigatim action effectiveness of BDT- fcrthe evacuation resp-orma.

Step 11 — FGB effectiveness (mřtigated risk)

Thetrequenev ofthe Emmu acetate considering the baleitdíthe gas detectinspdemtrhtector
coverage and FGS satelyavahbiitvi was calculated * 51mm in Figure 0-15.

Wight 2013 laikům Helwett.

IBA-TRB-l-BDŠT'QMB . 94.

PGS ofiooiivonou ' Dotoolor Dov-nul ii Sal-ty Avalinbiliiy lt Mtilgailori Aotlori Eflooiivonm
. 0.3! ii 0.59 ii D.!
. D.IGB listi FGB oiioolivihnll
Unmiiigalod Rlllt = F..-num. l'l - FGB oilooihronml
' GDE-4 par year :: (1 - 0.285)
= 2.1E—4 per year

The overall lilrelihccd cf the h—d scenaric was ealmdated a s 2.1E-4 per year (a 2-1 chance in
10,000 per year). This is above the maximum likelihocd that was selected for this scenario ct“ two
cl'lanees in 100_0110 per year [amo—=* per year individual risk nl fatality)- Therefore, the risk has
improved over t h š unmitigaled design, b u t the risk criteria rave not been iůtiilied will'i the
proposed FGS design.
Tan. ll inruiiioioni io oohlovo lho dulrod porforrrliinoo larooi. Dni-olo: oovorool and millgoiloii
ooiion oflooilvonua should o. lmorovod.
lilodliy FGB d u l g n (ilorolo Stop ? through dtto 11)
Slnoo iho ridi orlloriori was not satiahod bylho Initial gali doloollon dorign. ihr onion wu n'iodii'iod
io moai thls objocuvo, Gallons that should bo explorer! include iho following:
- adding ona or more additional gas detectors to increase detector coverage
. increasing the frequency cf functional tests cf the existing system design to increase F G B
safety availability
. increasing the rigcr associated with evacuatidrdsheltering of personnel in the event o f Hoa
alarrning
In this ease, the end user wanted to analyze the problem wilh three additional paint gas deteetdrs
mnou in proximity io mo oompresoor it.“-„litai1In additlon to lho oxaling ihroo dolooloro.

Figura ooo - Modiliod ooo dolnolor uvolil

Thi modliud dmoior lo oui allowsior doingiion of oddiuonolimmo outwrriu: thin il'rholvn ll'i -
rum-om linii i'iovrl „.a

mm-ala-iaA-Nimmmm
 +55? ISAFTRBHJD.W—2HB

mr!
hun—hradním
nwm—I-Iů
mnu: Ml.-Wiki

Figure 0.21 —Tm|:ir. gas (HEB) scunan'o coverage map for modified detector layout
Init-Hru nim.-Huml
Hum—ty indium-I Deum hrach Bum
it:-mil [pu-m “Hr-nim hlinitý mms Emrnpn Fun—if
BaH-allm- 111.01 hl UE,-13.1! Yu IDE-01
Smířiihn Laa-ul Mali 1135431 Yet Lu mm:
551Falun LEM Hi TIE-DI Yu LD ISE-01
Hail—r! mam “EME IQE-úl iu m 1 na:
inIFJIII-r! 10543: E uma vu 11: nm
5mFain" 15502E E.?E-Dl'n: Lu all!-03
immun- ine-mi; mm m m 5a m
5-11Flílhl'l' mm iii 11155: m u: mm
Sumín-';! mm 5 uve-uuu url: Ulli-m
kamna-u 1am:aw Um: “Ihr m : 5m
Whill-n !:IIB—Dl SW HEJL: tu 11: nm
Snu—“airw- xm: W LlE-m- Ya LU LIS-ul
Eniřiílw- & mm w iii-ml ?a- m nm
Email“- 1 am W HEI! ve.: Hr IIHF!
summitu-_: MBE-Di Mir Uli-91m „m nm
mann Lue—nz MIW NEM ťa u: WWE
Tui : iE—UI .wqrtm.: |:m mm.

Figura Url! _ Eman-iu manga malym: fur nad HH. dnlngtnr hrani
m: [&=q rar lm: modlila: datemr iam! :huw that 515.435 nt Quintal: hmm! IGEFIÍÍID nun-mm
ar: mama by th: dnlmmr ln you! and Dan b: samu by nt In:! un: duteťmr.
Th impmvl the n\ltlgauun nztřnn nl'faůtiuaneaa aunquntlnn route tnbeling hn: bann enhnnm
hmminnqnn detail: tmu; hlen added tn parum-mulbvnnuptián trnminu, grid qmduýdml: mn.-q

Gummi—unum. tghltmmd.
IBA-TRHMWT-iů'l! - BB -

0m utnbllihod with an imumation ol lnlul'flcllnl m m . . A: | ruull. lh. 001mm

Hanuman "rim-nu hn improwd 10 ma luna-n.
FGB minimu" . Dit0010f Emmu- n Sum? Availability :: Hulman Antlan Eft-000ml"
' 0.954 x 0.99 :: 0-0?
= 0.926 (92.6% FGB eHe-ntiweness)

Unmiligeted Risk = F_r-um (1 _ FGB effectiveness)

* 4-0E—4 per year :: (1 - 0.520)

' 2.0?8-5 per year

1110 mrnll Iiholihond nf lhl hmm tunlrlo w u comme u ESTE-0 plr ynr il 2.0? china
in 100.000 pll' year). Thll unum u“ filk mttrla nf 02-0 M f mr 10:10" plr yur Indivbduol ml:
of utility). Thtrlforl. IM memu FGB dnlnn i: lltilflůlůfy.

0003601“ 2010l$l..Nl duhu m

 - SIT — [SA-THBč'I-BQDT-HJÍB

Annex E — Evaluation of computational fluid dynamics vs. target gas cloud

for indoor gas detection design (reference 2.171
Domputalional fluid dynamics (CFD) has been applied in a wide range of indusb'ies and has a wide
reach in applications. With respect to engineering, this tool has been applied by professionals in
safety—related tields for decades, notably in building design for complex stmclures mvt-He
compliance with preccriptive building codes is problematic- This is an important point to note when
determining an appropriate application of C F D with respect to gas detection design.

In 1593, the UH. HSE released DTD 93 002 (reference 2.12), which subsequently became (and
is still widely regarded as) the standard document with respect to gas detection guidance for
partially enclosed volumes. This document allows a geographic gas detection placement process,
whereby the potential explosion overpressures of a given area can be correlated against a gas
cloud that provides these. This is a standard process for indusb'y external applications with an
allowance for a performance-based approach with respect to the target cloud one needs to detect-

It is relevant, however, where the environment is reasonably predictable and fully enctosed, to
explore other avenues of design, one of which is the application of IIBFD modeling to analyze gas
cloud behavior. This also corresponds to the overarching philosophy of CFD application ii
determining a specialized application where other methods are not suitable, or the time and lost
required to perform detailed CFD analysis is not of benefit.

An example of this is a standard external offshoreionshore congested processing facility. Ifthe

suitable number of |CFD scenarios run reach a number that is recognized as sufficient for the
design (accounting for environmental conditions, number of Iealt locations, and orientationsi, the
designer will discover that the gas can and does migrate to all areas of the congested zone,
whereby this time and cost would have been better spent determining what cloud can cause
damage, and applying gas detection to detect it. Evidence also shows that in these standard
applications, nil wind conditions with slow release rates provide the greatest risk of large vapor
cloud explosions (reference 2-15)- This does not exclude the use of CFD, however, a s this analysis
is based on standard extemal applications for which the geographic approach is suitable.

Specialized applications, such as internal processing units with predictable airftow, can be a
potential route for the use of CFD. An example of why this application is specialized includes the
fact that airtlow is relatively predictable, meaning the designer can run a limited number of
scenarios with changing environmental data, and which can be classed a s a sufficient spread to
account for the diflering environment- This cuts the number of scenarios required down to a
suitable number of CFD scenarios from which to assist with gas detector placement-

E.1_1 Computational fluid dynamics modeling

Fist and foremost, applied CFD modeling tools must be used with caution, and Iimitalions in design
must be fully understood-

111lce tools allow the user to analyza gas dispersicn and the results of ignition of various gas
accumulations based on the surrounding environment (explosion modeling)- There are signilillnt
differences, however, between t h e s e tools a n d the inherent capabilities o f the model a n d how the
Hevier-Stokes equations are solvedfconverged. Certain models, for example, are better suited for
momentum-driven releases than others, and certain models cannot account for buoyancy as well
as themially driven fluid flow in transient assessments. Ensuring that an appropriate model is used
is oucial.

Practicing CFD consultants will be aware of these Iimitations, and it is important to note that many
assumptions are included with any CFD modeling project. As a result of this, engineering judgrnent
is still vital i n achieving an appropriate model and subsequent design . Therefore, these
assumptions must be fullyjustitied and, where appropriate, provide a credible worst-case scenario-
to ensure the resulting design is tit for purpose and all associated risk is reduced to a s low as

Copyright cmsrss Nl rightsrenewed-

vMTHEÉM—EHB _mf

mamnhblw prawa-aula :_ALARP mean He named nul u m r e remaining me implleniiůne u! 1113

modni of an: Mun design IM damn pm.—.us:: to hin npumm CFD maulu be rue-ian
IDF spada! er ambitu-nun: areas of nahrat. (3t ln mala.-Lal space: or aréas &: mad.
WHEEEEEEÚ'. m m l a w the maiden-:e eF the FES eaíety pmfeasiunai and Is generally applřed
mr emmermi pmpnaee mily- íhe reialee hack te- int example. Mania:! engineering “uhne
mese tenis se applied.in mm mmm: lem-imma; where parfum-besed methods se
Wired far design approval. but !tíe m m m are predictahle emgh fm“ CFD fire undefmg
m be an Emmi-mie taal.

Fur Interna! humana. gun-d W W puncem: ml nnnw fm : min thai Will be :an- buh
when l_he mm a m operation úr applmahiel and wem i: na nat. Therefore. for nemam-ns whee—
me;WAE is nam-ng. CFD can be Wired Ie rewew the probable behavior of the nioud aiu: aha
Efliljl'IE' whether the target gas doucí is eredíhte “nim me WAG mnm-;- This. “thefeíure gives
insíuht iran lnu: tn dee'lgn the ge detection, Símílz assessments can be carried out mm the
HVAC is nat running nr where Hlava: are signíflmnt dead zones in the m . How—ever due tn the
lac-k nl forte:! ventilation. the patrem oí mammalian becomee la: umre Unpredlmle. Gas
detaetínn new-n bar"-nd nn Then- aqalyies became; hl more :llfflcult an: inould :unslu'u mm:
hmmm :::-tam ta fr.-icq::one-mmm and plum: turbulence (=== Fiume E „+ The: hh:mm mu
specific luk samce rdentlfřed will pmvjde ; mmm hearing on the behavior nf the m;
melaďqre, aan he uhalfengimg tus-etec!& Gamble ml—mse Teak Irelhmae 115).

Tllhllerljet
EiihipuWanganui—use-
—.
sl.-mmmm-
Gash-msuwmm

mtfmmtimhvmm
pumrdtdarnuůdůedbn

Faire islam-sim phase

Finn E:! - Example Fiume behavior

Mawe-lanwma—m
 - 95 -- 1313430111313

Tomidealieqiiimehthtamodelmiginbetooiahorinaanasseeunentandthereioredie-CFD
teter'llílomderpiimmttrmntheassmltisinmiantlhatreuiewersofheanalyása'e
me of this. and the CFD deeigner aware of he impact tim! removing shrne ofina-ce
obahuciímswídhaveonfhemetic gasdetection strategy.
it is aiso relevant mat incompiete geometry models are a significant cause o i enor h C F D design
that very difticutt to design out- i t is not ntriside the realm of pumila-Trh; that a dangerous cloud
can be mpmaded as “safe“ nr 'adeqttaely detected' in a CFD reňew, when "nt actual fact lie
blockagcs that ctntld cause the problem hatte been excluded from the model. What appear to be
n'iimie changes in boundary conditions can have a large effect on hid dynamic mncomes.
Minitar important point to note i s that the applied CFD moi must be appropnately 1irellidatend on an
apginpúate scaletitr the speciňt: application. tfan onshore refineryis being modeied. forexampie,
it “ot- uucial not to use ar: tmyenlied CFD tool, as it wii Eitely provide differing results from the
typical industry standard tenis. which have undergone signiticant full—scale yaiidation and testing
by Wooden: third-party testing facilities. Much of a CFD tool's 1tratidatlon ls carried out dirough
the product life, aid therefore CFD models in their iiiancy cen provide misleading residta sid
potml'mlly restdt "m an inaderpcete design.

The application examples present simtiations of a simplified internal enyiroruneni in order to

represent how CFD modeling can be used to analyae cloud propagation and migration in
amiospheric and HVAC-driven circumstances- What diese analyses show is that C F D can be a
uaehd tool i n reuiewing the ta'edible behaviorni the gas clouds in audi a n eiwirornnent wherelhere
are planetek-ie circumstances and the cornitions of reieme can be uedihly delined to delernile
die credible oust—case swriario iealt with respect to Medion.

E.1.2 Reconwendation o n application

'u'd'iltrespect to internal applications where atrfiow tliclated bytheair change late provided by
lite HVAC system, good gas detection design should be such that it wiii operate effectiuetywhen
the HVAC is woming and ariien it is not in operation. Thereíore. one example o f a good pracdoe is
to allow for CFD modeling to give an mderstanding of the nature of the airiiow in an indoor
ei'iyironment. which would provide insigrit as to Meu-iu the target gas cloud that could generate
m antilosion ouerptessure could crecIy exist. Thisr would Hien dictate whether to apply a
vohnoetric detection dnign None thatfomsed moreonthe Hammer! within m e 1|||-icinity of WAE
Mig (reference 2-19).

The issue of competence is one that must be addressed, as simply having access to the soi'twate
is not a ouaiiiication to carry out the analysis discussed- The detailed analysis required to
adequately apply CFD modeling to t h e gas detection placenaent pnoHem i s not addressed in ilia
TR, and therefore ensuring that the analysis is performed by personnel competent in both FGB
desig methodologies and practicolities, as well a s the intricacies of CFD analysis. is critical to the
appropriateness of this' methodology.

magie SHEBA. Al mlh mental

lan.-mmm -1m'-

gamma-luna
Flnun- E.: - Ambit nt, gu hmm at m LFL Mutina)

WMÉDÉÍERÉIWM
 .. 1:11 . mamma-mm

Figure E.:! _ H'Mc design 1 (mechanical enfant left and right sian)

Figura E j _ HVAC (1), Ga: mncantmtinn tun—surface a t GML L F L indian)

mm 201!l$l.. All duhu film

 FlmlmEG-MMMHEWGHMMĚMH

1=L i
i,
MET-WEiuGasmnmmmm-iurhwimmw

mamma-mm
 — 103 - IEA—M.WIJFEHB

EgleeEfl to ETgivesomemEsdastothedispersionandmisisgbeeeh—otthe gas i n a c h

veratiornegime. Figure E.?stnmsleeiso—sortace foraEů'itlona'thmrabityimitiLFnas
cutoeeůation in the ambient ease. llcan beseen that a large uoltnrecíthe oorrmartment contains
EntsLFL.

Finite č - 5 shows the carne gas Wooden iso—surface utilities tor ac design 1. As
Wed previously. the majority cí lie gas Iealr seems to be calcined into the exhaust lion
generated beheeen the left side iiitetleorhaustd as the eos LFL dotud has been slonllicanlty
reduced tn volume and area from the anibient case.
1i'tlriat
Figure E.? shows the gas eoiicenuation iso-surface lcr WAG design ?. is immediately
merit is that even though a greamr bull: ttuid movement is achieved mass the width of Ete
mtment. because this Iealr octa-ted on the left side [and lost nunerimn rniickly) this left-to-
rigtt HVAC design appears to distrinde the gas throughout the oompatmenl to a greater extent
than l-NAG design 1. This is certainly true in the case of Bitti. LFL

Tlis outocme is of course biased based on the details of this particiiar & teak- A similar gas
lati: comming on the right side tí the coinpartment would likely be etrtsausted much more
Elie-clively by HUAC. design S! tim the cin-rent lealr- Gonsider further. however. that if the Iealt did
ccctir on the right side of the cornpamnent but was in the left-side dream. and did not impinge
won a solid surface. the let itself cerno distribute the gas across the meteorit-neni lrom right to
leti. HVAC design 2 would redistribute that gas ageln from Iei't to right to a similar fashion as
deinoosuated here. but with a poteiitralty tess desirahle concenlrobon distribution.
Ween be concluded from a brief overview of these results is that the physical layout of the
ata-ce. lilie attributes and ler-tiun ofthe lealt, and. of course, the des'gn ot'me HVAC system (and
Ilaettier or not it is operational) can each have a profound inpact upon the evolution and
maequence of gas cloud formation fouoning a teak in a process area- me cert understand how
mention might affect species migration and cloud formation and how a i currents i n d u c e d by
WAG systems cen affect concentration distribution- One could filttidf sbidy the possibility of
indian-ventilation, wherebythe WAG system i s designed with gadoud action in m i n d , and one
cutid gain insight into “dead anna“ within the space where dEuticn ot hui ii.-Td is not suflicieolty
actieyed.

ln metical ten-ns. understanding the inherent limitatlons c l the BFD outlet results tooth the
irilierent assumptions and user-tim 1i.isii'latitlityl. as well as an triu-nisic appreciatlon tor the
underpinning science behind diegasdetectionmethodology. allows lhewer to interpret the results
as an additional piece ol information contributing to the best holtstic detection arrangement.
W is not advisable, or arguably even practical from the point of yiewot' a safety practitioner is
to use it percentage scoring system from a small number of leak smriarios as a n'slt-based
indication for detector location- Tlisnmy result m leaving large wok-na ofthe connartrnent with
no gas detection- The question ot“ acuiimting for an almost inlinite matter of potential teak
onbornnee with a finite number of (ndterently uncertain) models is an emeinety difficult ona to
me and to validate- To demonstrate that all credible Iealr scenaiios lnice been accounted for
with a limited number of CFD niodets would be difficult- Dne mld Imre lio categorize teak
soeiarios based on a range of arbiriitas. such as oritice siee. pre—strie. direction. location.
inpinging upon congesticn or minpeded _iet. atmospheric conditions. and inventory details.
Siniseouently. an appropriate rame of leatt models that represent a sufficient cross section cl a l
orectibte tealrs wlthin each category nwst be analyzed. Gestil—,tng the dehútion ol what oonstitutes
a 'sutfirient cross section“ ol potential credible cases is a painting prosp-ert alone. and ln all
ireliriood- building. analyzing (sensitivity analysis). and running the range of realistic model
acetate-s will be a very time—consulting endeayor- Consider furtherthat tor even a relatively small
iaciityreyiew, there can be zem [liethe one considered here- "menosts atd time requirement
hamr-e risproporlionately lage fortbe enpected yield or beneltt of the medy.

Wmeaumghsm
 This page ínlnenlímally left m

Gundam 2018 ISA.NI duhu mama.

Dum and minima saunu mmm nwm. mnm-rm: Mm. and nanic-1
ripu-ls ia m: of ISA! pti-nany nada Team thls goal the Shnduda andPractlm Daparinunt milu
on lha hadnidal axpertise and affouia of “ihntaer mmmřttae members, imámem and rande-wara.

IEA is an American Naiional Standards Institute (ANSI) acuta-cited organizatim. ISA administer: Unitad
sam “radnic,—.nl Advisory Groups (usum) and pravím materia support for Intomatinral
MIWMI Commissionnm:) and Imm mnam fur mammalian (ISO) mnu-nim"
thul dunlop procent mmmmunt und mlrd standards. Todutin additiomlinfnfmutlnn nnih!
Gandalfa standards program pian write:

ISA
Aim: Standards Umm-tant
BT Marian Driv.
PD. hx 1227?
March Triangl. Pula M.D. m

ISBN: STB-134331535?