Since the release of the ISA 84.00.07 technical report, I’ve received a lot of enquiries regarding mitigation effectiveness.  A lot of the questions were framed in terms of “what number do I use for mitigation effectiveness?”, which shows that we the technical report working group did not do a good job in defining the concept.  Mitigation effectiveness is not a singular number that will allow FGS analysis to collapse down into a one-dimensional probabilistic problem.  On the contrary, the term mitigation effectiveness is used as a place holder for a large series of events, probabilities, and consequence magnitudes.  Mitigation effectiveness is actually an entire event tree of its own that describes what happens at the plant after a loss of containment event is detected and an FGS activates.

The following text is what I am proposing adding to the ISA 84.00.07 technical report to address this situation…

Annex E – Understanding the Mitigation Effectiveness Concept

Mitigation effectiveness is a complex concept that is used as a shorthand to encapsulate a wide range of factors that define the amount of risk reduction that an FGS function can provide.  The FGS effectiveness model, shown in Figure E.1, represents mitigation effectiveness as a single branch in an event tree.  This representation can lead to the interpretation that mitigation effectiveness is a single probabilistic value that when obtained will allow the analysis of FGS to collapse into a simple probabilistic calculation.  This interpretation is not correct.  While there is a value in demonstrating mitigation effectiveness as a single value in the FGS effectiveness model in order to illustrate general risk concepts, in reality mitigation effectiveness cannot be collapsed into a single value.  Instead, if modeled quantitatively, mitigation effectiveness is a large collection of event tree branches that describe the range of mitigation actions that are possible upon detection of a fire or gas event and the probability of success of each of these actions coupled with the amount of risk reduction that is provided under each scenario.

Image

Figure E.1              FGS Effectiveness Model

In order to better illustrate the concept of mitigation effectiveness, consider an example FGS function.  The example process is a natural gas compressor station consisting of an enclosed compressor building containing a single compressor.  The compressor station is equipped with optical fire detectors that will, upon detection of a fire, activate a chemical fire suppressant system that is designed to extinguish the fire.  The compressor station is controlled and maintained by two staff members who are primarily located in a control room that is located adjacent to the compressor building.  The layout off the facility is shown in Figure E.2.

Image

Figure E.2              Example Compressor Station Layout

For the case of a small incipient seal fire, the FGS effectiveness model would be populated with the frequency of the seal for as the value for the loss of containment.  The detector coverage would be quantified utilizing the scenario coverage for fires, as calculated in the detector coverage assessment, and the FGS safety availability would be calculated based on the average probability of failure on demand of the function, including sensors, logic solver, and dry chemical system.  For purposes of this example, assume that the achieved coverage is 80% and the achieved safety availability is 90% (as shown in Figure E.1).  This leaves only mitigation effectiveness undefined.

The effectiveness of activation of the FGS is not a simple probability that the dry chemical system puts the fire out.  Instead it is a complex combination of mechanical and human interactions.  Some of the factors that will determine that amount of mitigation that is achieved will include the following factors:

  1. What is the probability that the dry chemical system will extinguish the fire?  This probability is a function of the size of the fire that occurs and other contributing factors.  Failure of the dry chemical system to extinguish the fire include could be caused by:
    1. A fire size in excess of the design basis
    2. Excessive HVAC action removing the chemical agent too rapidly
    3. Doors left open preventing the chemical agent from properly accumulating
    4. Other factors
  2. If the automatic fire extinguishment system fails, will an operations staff member manually extinguish the fire with handheld equipment?
  3. If the automatic fire extinguishment system fails and operations staff manually attempts to control the fire, will they be injured during the process?
  4. If the automatic fire extinguishment system does effectively operate, will operations staff still be injured as the result of entering the room prior to ventilation of extinguishing chemicals and combustion by products.

This complex series of events that is represented by a single mitigation effectiveness value in the FGS effectiveness model could be represented by the following event tree to more accurately portray the depth and complexity of the mitigation effectiveness concept.

Image

Figure E.3              Event Tree Representing Mitigation Effectiveness

When selecting performance targets, the way that mitigation effectiveness is addressed depends on whether fully quantitative or semi-quantitative methods are employed.  In the fully quantitative approach, calculation of risk is done using an event tree to quantify all of the potential outcomes of a loss of containment accident.  In order to address mitigation effectiveness, all of the factors upon which the potential consequences rely are explicitly included in the event tree.  This would require that the type of information defining mitigation effectiveness as shown in Figure E.3 would need to be included in the overall FGS effectiveness model as shown in Figure E.1.  Note that the event tree shown in Figure E.3 is only a simplified example.

In semi-quantitative approaches, the mitigation effectiveness is considered during the calibration of the charts, tables, and numerical criteria that make up the overall procedure.  No additional explicit consideration of mitigation effectiveness is performed.