Nicol 16/11/06 12:48 pm Page 1
Fire and gas mitigation
Feature
after protection fails
Robert Nicol CEng FInstMC
Senior Control and Automation Engineer, Shell U.K. Limited.
F
ire and gas detection systems are common in the oil and
gas industries. Other industry sectors may have fire and
or gas detection systems depending on their identified
hazards. Regardless of industry sector the design and life-
cycle requirements should follow the same basic principles.
Most process protective functions are intended to pre-
vent incidents from occurring; fire and gas systems
respond to incidents that are already underway and are
therefore part of the mitigation processes.
Process plant and their design can influence the types
of hazard that could occur, and hence the types of detection
and mitigation requirements.
The life-cycle requirements are to design and install a
detection system that provides mitigation (alarms / execu-
tive actions) for the identified hazards. After commission-
ing the systems require to be regularly proof tested and
maintained such that systems perform to the designed
functional requirements. Differences to life-cycle func-
tional requirements can come from the installed systems
performance (under or over perform) or from plant
changes (additions or removals).
A typical fire and gas system has multiple mitigation
response roles, such as:
l Alerting personnel to the presence of a hazardous con-
dition (fire or gas);
l Removal of potential ignition sources;
l Operation of ventilation systems;
l Shutting down process plant and removal of hazardous
feedstock;
l Depressurising (venting or flaring) of section of plant.
Automatic responses can be direct from the fire and gas
system or via another response system. Process plants typ-
ically have Emergency Shutdown (ESD) and
Depressurisation (EDP) systems; and fire and gas can be
treated as an extension to these as another suite of inputs.
The Emergency Shutdown systems can also act as con-
duits for the control of the other responses. This would
suggest that one system package could contain all the safe-
guarding functions of fire and gas, emergency shutdown,
ventilation, etc.
F&G detection design
The events that trigger the fire and gas systems can be
manually initiated or automatically detected.
Fire and gas detection instruments are not like process
detection instruments and need different design considera-
tions. Process detection instrumentation is coupled to the
process either directly (e.g. displaced level), or through
directly connected equipment (e.g. temperature sensor on
304 Vol 39/10 December 2006
pipe wall), and there are many standards that give very good
guidance on how to design for process event protection.
For fire or gas events the detection is in free spaces with-
in modules or detection zones. These areas can have dif-
ferent types of equipment and equipment density that
impact on the ability to detect events. The location of an
event can be anywhere within these detection zones and it
is generally indeterminate where this occurs.
The design should consider all aspects from the hazard
identification through to lifecycle management.
Hazard identification
A process is required to identify the hazards that a fire and
gas system would mitigate. This identification process
should be used to evaluate the appropriate level of risk
reduction for the assessed hazard, considering the conse-
quences and the event frequency.
The process of selecting risk-reduction measures will
predominantly entail the use of sound engineering judge-
ment, but this may need to be supplemented by recognition
of the particular circumstances that may require deviation
from past practices and previously applied codes and stan-
dards. In certain circumstances, risk assessment may be
able to provide useful input to the decision-making
process, providing that there are established criteria for
this purpose. Risk-reduction measures should include
those to prevent incidents (i.e. reduction of the probability
of occurrence), to control incidents (i.e. limiting the extent
and duration of a hazardous event) and to mitigate the
effects (i.e. reduction of the consequences).
The assessment method such as those in IEC 615082 and
615113 can be used for assessing the SIL and then assign-
ing the target probability of failure on demand (PFD). Like
process protective function, the fire or gas mitigation func-
tion should consider the incremental consequences of the
detection systems not operating. If using a risk graph or
risk matrix, the demand rate for the consequences should
be derived for the event, and quantitative risk assessment
may assist with this.
The assessment may consider several scenarios with dif-
ferent event frequencies and consequences, i.e. it could
include events that have a high frequency (say <10years)
and no consequences, and low frequency (say 1,000years)
events with high consequences.
Safety Integrity Levels
In practice, the detection characteristics for fire or gas
functions are such that high Safety Integrity Levels (SIL)
www.instmc.org.uk
Nicol 16/11/06 12:48 pm Page 2

Feature

may be difficult to achieve compared to process protection

function (e.g. pressure protection).
Whilst the reliability of the detectors themselves may be
high, detectors can detect only incidents that their sensing
mechanisms can access, i.e. gas detectors can detect only
the gas that reaches the sensing mechanism; dead spots in
module airflows and other related effects give a practical
limit to achievable detection performance.
Like process related functions, a SIL target PFD value is
for the complete function. This for process functions is
generally termed ‘pipe-to-pipe’ and covers the components
from the process detection through to the final element
such as an ESD valve. For fire or gas the SIL covers the
components from the area with the detection through to
several final elements such as alerting personnel, ESD
valves, ventilation, deluge, etc. Assigning the SIL target
PFD to only the fire and gas part of the function may affect
the level of risk reduction such that the overall function is
not suitable, i.e. a SIL 2 fire and gas function may only be
good for SIL 1 protection function when the whole protec-
tion function PFD is analysed.
Figure 3
Detection targets
Detection layout
The detection targets for both fire and gas events should
be set through consideration of detecting a fire or acci- The design of detector layout is of critical importance for the
dental hazardous release or accumulation before they are effective performance of fire and gas detection systems.
large enough to cause an escalating situation if not miti- There are engineering standards4 for such layouts, and vari-
gated. Detection targets should also be specified for ous techniques (including computer-aided design) in routine
toxic or asphyxiant gas events that can pose a threat to use to establish fields of view, detection ranges, etc.
health. The process used to design and assess optical flame
The identified detection targets should be based on area detector and gas detector layouts should provide an
specific events, i.e. the detection target for flammable gas auditable assessment trail of the detection system’s
clouds or accumulation events should be based on the vol- response for the targets specified.
umetric coverage for the voted detection in the area, with Figures 1 and 2 are representative of what the detection
explosion analysis used to determine the appropriate target coverage could be in the same module. Colour code is: not
cloud sizes. In the absence of this it has been common to covered (white), 1 detector (middle grey), 2 detectors (dark
use a 5 metre cloud size as target coverage. grey) and >2 detectors (light grey). Figure 1 shows that there
Fire, toxic or asphyxiant detection targets are set using are parts of the module that have no coverage or only 1 detec-
similar principles. tor, whereas by relocating the same detectors the whole mod-
ule has coverage and the majority with 2 or more as shown
in Figure 2. Detector placement should give suitable cover-
age of the areas where there can be a hazard, which may be
different from covering the whole module.
Siting of detectors should also consider the type of haz-
ardous event, how it may react, the physical location of
equipment, the ventilation in the area (forced or natural), etc.
In areas where there is extract ventilation the siting of detec-
tors should be such that the ventilation is not drawing the
hazard away from the detector, i.e. careful consideration of
the air flow is required before positioning smoke detectors.
Figure 1
Voting

An important aim of fire and gas protection functions is

that a single fault mechanism should not cause the protec-
tive function to develop a failure that, if undetected (hid-
den), would result in a serious loss of protection. A diffi-
culty with fire and gas systems is that the detectors in a
given area can be subjected to the same environmental
influences (such as fog) that may disable several or all of
the detectors in that area.
Typical voting is 2ooN (2 out of N, N being ≤ 3) where
Figure 2 there is a minimum of three detectors fitted, and no maxi-

www.instmc.org.uk Vol 39/10 December 2006 305

Nicol 16/11/06 12:48 pm Page 3

Feature

Fire and Gas system

Hazard Type of detector Typical application Typical actions
Fire Heat pneumatic Process, wellhead, utilities Alarm, ESD, EDP, closure of sub surface
safety valves, active fire protection
Heat electric Turbine hoods, workshops, Alarm, ESD, EDP, active fire protection
stores, engine rooms, process,
wellhead, utilities

Flame Process, wellhead, utilities, Alarm, ESD, EDP, active fire protection
generators, gas turbines
Smoke Control rooms, electrical Alarm, isolate power, active fire
rooms, computer rooms, protection (if present)
accommodation
Air intakes to Temporary
Refuge (TR) and control stations Alarm, isolate ventilation
Flammable gas Process, wellhead, utilitiesa, Alarm, ESD, EDP, isolate power
engine roomsa
Air intakes Alarm, ESD, EDP, isolate power, ventilation
systems
Oil mist Enclosed areas handling low Alarm, ESD, EDP, isolate power
gas oil ratio liquid hydrocarbons
Manual call point All areas, escape routes, Alarm, start of fire pumps
muster points, TRs
Note: process areas include drilling areas.
a Only for rooms containing essential safety systems

Table 1: Typical applications of fire and gas detectors for offshore installations5.
mum number (e.g. can be 30 or more in one module). For
the PFD calculations of the detection part of the function
this could imply that there is a vote of 2oo30. This is not
the case even though the vote is configured in the logic
system. Figure 3 shows nine gas detectors that for logic
configuration is voted 2oo9, but for PFD calculations is
2oo4 based on coverage of 5 metres (e.g. detector G1 with
detectors G3, 6 - 9 are not votes that meet detection tar-
gets). Furthermore, the actual shape of any released cloud
of gas is indeterminate. The identity of the two detectors
that are the first to alarm to an actual release is therefore
not known; they may not be adjacent detectors. The sphere
model is used to ensure detectors densities are sufficient.
The voting arrangement selected should consider the
detection targets and the detector layout.
Deployment
There are several types of detector that can be used for fire
or gas detection. The selection of these should provide the
required detection and mitigation for the hazard scenarios
that can occur in the area being protected. For offshore
installations Table 1 lists typical types of detectors, their
application, and actions.
Device selection
There is a variety of detection equipment available for fire
or gas detection. Detection apparatus can have very differ-
ent characteristics for the same type of detection. An
example of this is for flammable gas detection where there
can be different response times, and different responses to
the same gas, etc.
The detection selected should be suitable for the area
that it is installed (e.g. ATEX) and suitable for detecting
the predicted hazard.
Fire detectors
There are several different technologies for this, ranging
from fusible gas loops (normally air) to electronic devices
with single and multiple sensors, and CCTV.
The device selection should consider the types of fires
that can occur and the response times required from the
automatic detection systems.
Flammable gas detection
Within the oil and gas industry there are two basic tech-
nologies employed: the catalytic bead sensor that has been
used in the industries for several decades; and there are the
newer infrared (IR) technologies.
Acoustic technology detectors have emerged in the past
few years. Acoustic detectors do not detect all accumula-
tions and migrations of gases/vapours, as they require
leakage under pressure. They can, used in the right appli-
cations, provide early warning of a leak that could develop
into an accumulation.
The detector selection is dependent on the product that
the detector is required to detect. Getting this wrong can
totally compromise the automatic detection system. I.e. IR
gas detectors will not detect hydrogen, thus if hydrogen is

306 Vol 39/10 December 2006 www.instmc.org.uk

Nicol 16/11/06 12:48 pm Page 4

Feature

and control systems do not fail-safe. Survivability is not

Figure 4: Typical LFL responses.
one of the gases to be detected then another detection tech-
nology is required.
The different technologies have different responses to
the range of gases/vapours that can be present at an oil and
gas facility. IR point detectors are more sensitive to the
heavier end gases/vapours whilst catalytic ones are less
sensitive. IR beam detectors can be less sensitive to heav-
ier end fractions (see Figure 4). Note that this generalisa-
tion can be manufacturer specific and care is required to
assess the detectors’ response to the known gases within a
hazardous zone.
The selection and calibration of the detection system
should consider the expected gases/vapours to be detected
and the characteristics of the available detection equip-
ment. The display of the detected gas/vapour is usually 0 –
100%, but the percentage reading may not be the lower
flammable level (LFL) for the gas/vapour.
The alarms are set as scale values and therefore may not
be an LFL setting. The recommended high alarm is 60%,
as given in EN 617796, this may be a scale value that is
less than 60% depending on the detection technology and
calibration sensitivities.
necessarily a critical issue as regards detection, since a
major incident that damages the fire and gas detection
could hardly remain un-noticed by site personnel, but it is
important that the alarm and executive actions remain
available.
A useful measure of survivability as regards executive
control actions is achieved by including some measure of
redundancy and manual initiation; for example, a water
deluge system can be triggered automatically by the fire
detection system, by remote manual action, or by local
manual action.
Some water deluge designs have a pneumatic sensing
line that provides a fail-safe self-acting release mechanism
(loss of air) that is independent of the main automatic elec-
trical fire detection system.
Testing and maintenance
The types of maintenance required and when this is carried
out are dependent on several factors, such as the assessed
SIL level and the typical faults as identified by a Failure
Mode Effect Analysis.
The prime routine task requirement is to proof test the
installed systems (detection and executive actions).
Corrective or refurbishment maintenance (e.g. gas detec-
tion calibration) is performed after the prime proof test
task is carried out. This order of carrying out the tasks pro-
vides demonstration of the ability of the system to per-
form, as designed, when required. Any type of mainte-
nance on the systems (e.g. corrective) should only be car-
ried out after the proof testing of the function.
After corrective or refurbishment maintenance, post activ-
ity commissioning (proof testing) should be carried out prior
to taking the function back into service. One has to demon-
strate that the system will work when taken into service.
References

Power requirements 1. Health and Safety Executive - SPC/TECH/OSD/10.

The duration of the uninterrupted power supplies (UPS)
should be sufficient to allow emergency power to be provid-
ed or to complete emergency response activities. EN ISO
137025 suggests a supply time duration of 180 minutes.
Survivability
This is an issue because (typically) fire and gas detection
2. Functional Safety of Electrical/Electronic/ Programmable
Electronic Safety-Related Systems, parts 1 to 7, IEC 61508.
3. Functional safety instrumented systems for the process indus-
try sector, parts 1 to 3, IEC 61511.
4. Fire detection and alarm systems for buildings, BS 5839, 1988.
5. Petroleum and natural gas industries – Control and mitigation
of fires and explosions on offshore production installations –
Requirements and guidelines, BS EN ISO 13702, 1999.
6. Electrical apparatus for the detection and measurement of
flammable gases, part 1, BS EN 61779, 2000.

InstMC Membership Elections and Transfers

Transfers to Member Student

Cross, P E Surrey & Sussex Bunas, D Overseas

Minchinton, P Herts
Sabaliauskas, J W N Lincs The following members are now registered with the
Engineering Council (UK):
Members
Chartered Engineer
Fisher, D W Scotland
Odukunle, A London Fathy, A
Smith, E V Overseas Engineering Technicians
Woolven, R Overseas Mayhew, N S

www.instmc.org.uk Vol 39/10 December 2006 307