An Oven Explosion: Lessons
Learned on PSM Applications
Michael D. Cazabona and Kirby Ericksonb
a
FM Global, Heath, TX 75032; michael.cazabon@fmglobal.com (for correspondence)
b
GAF-Elk, Ennis, TX 75119
Published online 12 August 2009 in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/prs.10346
An explosion occurred at one of our customer’s
locations in late 1998 involving unburned and par-
tially burned natural gas while the unit was in high
fire mode. Investigation of the incident led to many
contributing causes, most of which can be catego-
rized broadly as lack of process safety information,
failure of a fuel combustion control system, contrac-
tor control and lack of management of change.
Combustion systems are found throughout all
industries and homes. Code-based safeguards are
thoroughly and adequately described in NFPA. But is
the spirit and intent of the code always applied and
interpreted safely? Instrumentation application and
installation are similarly well described in manufac-
turer’s literature and the ISA standards. But are these
systems installed and arranged properly? Is it impor-
tant to manage change in something as mundane as
fuel fired equipment? Is explosion venting on indus-
trial ovens a sound way to limit damage? Is it even
possible in all instances? Are there alternatives?
This article highlights the investigation activities,
answers these questions, presents conclusions and
suggests remedies while showing the applicability of
PSM concepts to industries other than the CPI.
This article will describe, in general terms: the pro-
cess, critical changes in design, key components
involved, applicable codes, discoveries during the inves-
tigation and solutions deployed during the rebuild to
address these issues. Ó 2009 American Institute of
Chemical Engineers Process Saf Prog 29: 87–93, 2010
Keywords: explosion; fuel; combustion; safeguards;
instrumentation
THE PROMISE
In many incidents, there is no single issue that
causes the havoc associated with a sudden generation
of heat, light, and sound. Many systemic failures
come into play, which is why there are so many com-
Ó 2009 American Institute of Chemical Engineers
Process Safety Progress (Vol.29, No.1)
ponents to Process Safety Management. We will see
how these come into play here, at a facility not gov-
erned by 29 CFR 1910.119. This article suggests that
PSM ideas should be applied via the general duty
clause throughout all facilities by suppliers, contrac-
tors, and employees to assure profitable, reliable, and
safe operation.
A common thread through most industrial proper-
ties is the mundane process of burning hydrocarbons
to generate controlled heat for the purpose of doing
work. The nature of fire has been with mankind for
millennia. We have many prescriptive codes with altru-
istic intent—no explosions, and no ‘‘unfriendly’’ fires.
We are familiar, generally, with both fire and the codes.
And, as we know, familiarity breeds contempt. We
think we can out-smart the code, bend the laws of
physics and chemistry and make equipment do fan-
tastic things. As for the codes themselves, blind appli-
cation of the letter may not fulfill the intent. Or
worse, it may bring on undesirable affects.
This article will describe, in general terms: the pro-
cess, critical changes in design, key components
involved, applicable codes, discoveries during the
investigation and solutions deployed during the
rebuild to address these issues.
THE PROCESS
Making Glass Fiber Mat
This operation takes chopped glass fibers, blends
them with a water soluble binding agent, and distrib-
utes the solution on a ‘‘wire’’ to form a sheet. This
sheet is then dried with hot air in a multizone oven.
The sheet is rolled and used in the making of roofing
shingles. This process resembles the making of arti-
cle. We will focus on the Zone 1 dryer section, as
shown in Figure 1.
The Dryer
The four zones, gas fired dryer removes moisture
through evaporation. Each of the four zones is direct
March 2010 87
Figure 1. Process flow diagram. [Color figure can be viewed in the online issue, which is available at
www.interscience.wiley.com.]
fired with natural gas as the fuel. These zones qualify
as Class B ‘‘furnaces’’ in NFPA [1]. Each zone exhausts
to a regenerative thermal oxidizer for environmental
compliance. The exhaust zone is also provided with
a direct fired heater to assure the stream is above the
dew point at all times. From here, the exhaust is sent
to a regenerative thermal oxidizer for environmental
compliance.
Zone 1 is by far the largest of the four in terms of
BTU input and air flow rates. The single burner for
this zone had been rerated to 40 MM BTU/hour from
the design specification of 30 MM. The recirculation
air flow was rated at a maximum of 196,000 scfm.
Make up air is provided via combustion air and
inward leakage around the dryer hood. This unit
operates nearly balanced, but with a slight negative
pressure (20.03 to 20.3 in. water column (WC)).
System control is achieved via a distributed control
system (DCS) of proprietary design. The DCS func-
tion is to provide an overview of all devices and
provide general commands to field mounted pro-
grammable logic controllers (PLC). The PLC provides
actual commands to motor control centers. The com-
bustion system has one more layer of control: a hard-
wired combustion safeguard interlock system. This
system is completely independent of the PLC and
DCS system control input. The combustion safeguards
only communicate status to the PLC. The PLC also
communicates status to (in addition to taking orders
from) the DCS system.
About Fans
Combustion air fans are often centrifugal fans with
forward curve blades. They develop peak static pres-
sure at some flow rate, typically between 30 and 50%
rated flow. The static, or zero flow pressure, also
88 March 2010 Published on behalf of the AIChE
corresponds to the pressure found at 70–90% of the
rated flow yielding the possibility of two flow values
for the same pressure.
About Combustion
To get complete combustion of natural gas, one
needs to have about 10 parts air per 1 part fuel by
volume. In the case of natural gas, the flammable
range is 5–15%, so near-stoichiometric conditions
exist at a 10:1 mixture. Standard engineering contin-
gency estimates of 130% in design apply here. It is
typical to specify the fan capacity at 130% of the
demand created by maximum gas flow.
Natural gas has a requirement to supply 1000
BTU/scf. Therefore, a 30 MM BTU/hr burner would
require 500 scfm of gas. Thus, the rated air flow
should be about 6500 scfm.
About Burners
A manufacturer developed a burner that would
have a 15:1 turndown ratio, pushing the envelope of
stable flame range. To achieve a huge turndown ratio,
a creative design was developed. The main ring burner
was supplemented with a ‘‘low fire’’ burner which
would take over when the demand for heat was scaled
back. This low fire burner amounted to a 3=4 in. line
from the main gas supply piped independent from the
throttle assembly. This burner provided about 7% of
the total heat input (per NFPA 85 [2], a Class 2 igniter).
NFPA 86 [1] shows many burner arrangements and
specifically states that pilots within the cone of the
main burner flame need no separate flame detection:
(a) A burner in which the pilot fuel is issued from
the same ports as the main flame or merges with the
main flame to form a common flame envelope with a
common flame base and (b) each pilot and main
DOI 10.1002/prs Process Safety Progress (Vol.29, No.1)
burner flame shall be equipped with flame supervi-
sion in one of the following ways:
a. Main and pilot flames supervised with independ-
ent flame sensors
b. Main and interrupted pilot flames supervised with
a single flame sensor
c. Self-piloted burner supervised with a single flame
sensor.
The intent of the burner operation was to have the
igniter light the pilot and the pilot to light the ‘‘low
fire’’ burner. Once the proof of ignition took place,
the high fire burners began to flow gas and ignited
from the ‘‘low fire’’ burner. Because this is a ‘‘self-
piloted’’ burner, only one flame sensor—focused at
the low fire burner—was provided. As this burner
ramped up to 40 MM btu/hr, the flame moved further
from the spokes and cone. This flame was reportedly
22 feet down the duct and about 4 feet away from
the cone! Yet the code allows a single sensor.
Intuitively, the advice in NFPA 85 on boilers seems
to make more sense:
a. The main burner shall be equipped with a perma-
nently installed igniter.
b. Where a Class 2 igniter is used, it shall not be
used to ignite main fuel under uncontrolled or
abnormal conditions.
c. The burner shall be operated under controlled
conditions to limit the potential for abnormal oper-
ation as well as to limit the charge of fuel to the
furnace in the event that ignition does not occur
during light-off.
d. If the Class 2 igniter is not shut down once the
main flame sequence is successfully completed,
then the main burner flame shall be proven by a
flame scanner independently of the igniter.
About Venting
NFPA 86 and FM Global Data Sheet 6–9 [3] recom-
mend venting for ovens, regardless of the presence of
volatiles generated by the process: (a) Fuel-fired fur-
naces, and furnaces that contain flammable liquids,
gases, or combustible dusts, shall be equipped with
unobstructed explosion relief for freely relieving inter-
nal explosion pressures. . ., (b) the minimum design
shall be at least 1 ft2 (0.093 m2) of relief area for each
15 ft3 (0.424 m3) of furnace volume. (NFPA) [1], and
(c) provide explosion vents for ovens where there are
fuel or vapor explosion hazards (FM global) [2].
Uncontrolled or Managed Change?
In any project, if we let change occur without man-
agement systems, unknown outcomes will result. Since
this site is not governed by PSM regulations, formal
management of change (MOC) is not practiced or
established. A series of unmanaged changes occurred,
resulting predictably, in an undesirable event.
The Combustion Issue
The original machine specification was to produce
X feet/minute of glass fiber mat. As with many proj-
Process Safety Progress (Vol.29, No.1) Published on behalf of the AIChE
ects, economic predictions changed resulting in a re-
vised specification of 1.5X feet/minute. To remove
the water from the mat, the heat needed to be
increased. This resulted in greater demands on the
gas fired burners and the installation of an additional
drying zone. The original 30 MM btu/hr burner was
rerated by the burner manufacturer to 40 MM btu/hr
by merely increasing the gas and air pressure and
thus throughput. As seen from above, this has a
significant impact on the combustion fan size require-
ment. The change should have resulted in a require-
ment of about 8500 scfm. Lacking a formal MOC
process, this critical item was overlooked. The origi-
nal fan specification remained at about 6500 scfm. To
compound this oversight, the burner design itself was
a bit suspect.
When operating by itself during periods of low
heat requirements, the low fire burner did not pro-
duce a stable flame as the input from the combustion
air fan kept blowing it out. The first attempt to cor-
rect this was the installation of a weighted relief valve
on the combustion air line to truncate the fan pres-
sure curve. This appeared to meet the following
items from NFPA 86:
a. All burners shall maintain the stability of the
designed flame shape, without flashback or blow-
off, over the entire range of turndown that is
encountered during operation. . .
b. Burners that cannot be ignited at all firing rates
shall have provision to adjust the burner firing rate
during light-off to a level that ensures ignition of
the main flame without flashback or blow-off.
Unfortunately, this was a noisy way to meet the
aforementioned conditions and yet another change
occurred. To eliminate the noise associated with the
venting of several hundred (or thousands) of cubic
feet of air, a butterfly valve was installed in the com-
bustion air duct and controlled by a pressure trans-
mitter. This too appeared to be allowed and encour-
aged by NFPA 86. The code is not clear regarding
where the control needs to reside for this ‘‘provision.’’
In this case, the control loop for the pressure trans-
mitter and valve actuator resided in the basic process
control system instead of within the combustion safe-
guard system.
The Venting Issue
No explosion vents were provided and the struc-
ture was not designed to support their inclusion nor
their operation. This occurred despite the presence of
published and recognized engineering standards.
The Instrumentation Issue
As many of us have witnessed in our careers, ‘‘as-
built’’ and ‘‘as-designed’’ often have some differences.
Fortunately, these are usually minor and do not play
into the hands of Murphy’s Law. In this case, of
course, the differences did.
Many recommendations and standards [4–6] have
established certain commandments which the wise
should heed. One of these says that instrument taps
should engage the fluid which they are measuring.
DOI 10.1002/prs March 2010 89
Figure 2. Damaged oven enclosure. [Color figure can Figure 3. Damaged supply duct. [Color figure can be
be viewed in the online issue, which is available at viewed in the online issue, which is available at
www.interscience.wiley.com.] www.interscience.wiley.com.]

Thus, for gasses and vapors, taps should be at the
top of the pipe or duct while for liquids, they should
be located at the bottom. Another commandment
states that condensate should be considered where
present and the tap should be arranged to drain
away from the instrument via gravity. These bits of
wisdom got lost along the way between the design
prints and the installation.
The low combustion air interlock—a differential
pressure switch—had its tap located about 30 feet
above the switch and at the 6:00 position on the
duct. The ‘‘elegant’’ solution to the noisy relief valve
had its pressure transmitter taps located a foot or so
above the instrument. Considering that the fluid in
the duct was air saturated with water at 4708F, con-
densate was guaranteed in the instrumentation lines.

The Undesirable Event

The following events are based on the DCS time mark (CDT; 9/15/98):
21:15 The line is shut down due to poor quality mat. In this process, shutdowns require rethreading
from a low speed and thus the oven heat load resets to a very low demand. Zone 1 would
have been operating at or near low fire.
20:30 to 21:15 Two failed attempts to thread up the machine are made.
21:33:47 Incinerator temperature is 15048F (normal operating temperature)
21:34:27 Machine is successfully rethreaded and operator orders a 12 min ramp-up from minimum
speed to 8X min speed. Temperature set point is 4708F; oven supply pressure is 0.7 in. water;
exhaust is 0.73–1.0 in. water.
21:39:11 Zone 1 leakage high alarm. This is a calculated number, which assumes normal combustion
air based on measured gas flow rate (shown at 667 scfm) and other parameters. If all non-
measured parameters are as assumed, this would mean air is leaking out of the oven and into
the building. Operators noticed no fumes (formaldehyde smell would have been strong).
21:39:16 Incinerator temperature excursion begins; data from RTO.
21:41:36 RTO high temperature shutdown (18008F).
21:41:37 RTO alarm initiates machine shutdown and bypasses all zone exhaust to atmosphere.
21:41:55 Incinerator bypass valve in position for full vent to atmosphere.
21:41:58 Sheet break alarm indicating residual product has exited the ovens.
21:45:33 Operator ‘‘clears’’ sheet break alarm (acknowledged alarm).
21:46:04 Zone 1 pressure control disturbance (onset of explosion).
21:46:06 No information; all computer components have been knocked out of the cabinet.

The aforementioned events are generally con-
firmed by the operators. One operator (in control
room) observed a ‘‘bright flash’’ in the vicinity of the
elbow in the supply duct near the west wall of the
building. The rewinder operator only recalls getting
up from the floor, but not how he got there. Other
operators heard an explosion and were knocked
down. Indeed, neighbors reportedly heard the explo-
sion 6 miles away! As shown in Figures 2 and 3, the
consequences of this accident were significant.
Despite the magnitude of the event, there were no
injuries.
The Evidence
A detailed investigation followed the incident im-
mediately. Instruments were sequestered, valve posi-
tions were noted and operability tests were per-
formed. Instrumentation tubing was disassembled
and conditions noted. Damage was photographed
and assessed.

90 March 2010 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.29, No.1)
Instrumentation
Calibration tests were conducted on switches and
transmitters. One significant anomaly noted was the
low combustion air pressure switch. This device
showed that adequate differential pressure existed
when none was applied. Subsequent destructive
examination revealed the switch had corroded in the
‘‘made’’ position (e.g., contacts corroded closed).
Thus, one defense against too little combustion air
had been removed from the combustion safeguard
system. We suspected as much when we removed
the switch from the ¼ in. instrument line and many
tens of milliliters of water drained out. Whether the
contacts had corroded together or not, the conden-
sate WC would have provided enough pressure to
close the contacts.
We had noted that the butterfly valve in the com-
bustion air duct was mostly closed. This position was
intuitively incorrect; the data from the DCS indicated
the unit was on high fire. This valve should have
been wide open. Examination of the wiring in the
operator and stroke testing confirmed this valve oper-
ator was a ‘‘fail-last position’’ device. On disassembly,
we again noted several milliliters of water in the
instrument line. We took careful measurement to
assure proper orientation for testing purposes. We
also ran a full calibration on the pressure transmitter,
finding its read out to be true and accurate. We then
conducted tests on the effect of water in the instru-
mentation line.
The line connecting the low pressure tap to the
DPT had about 10–15 ml of water in it. This line was
removed, and two calibrators were provided to simu-
late the input ranges this device would normally see
(8.5 in. WC on the high side, 4 in. WC on the low
side). Water was injected into the sensing line in vari-
ous amounts. We observed that the variations were
due to the capillary effect taking place in the 1/4 in.
diameter instrumentation lines.
A 50% error can occur resulting in a false high read-
ing. This would then drive the butterfly valve toward
closure (about 30% more closed than it should have
been). A DCS air pressure calculation assumed a 14:1
air/gas volumetric ratio. About 13:1 is the minimum
prudent engineering design guideline. About 10:1 is
theoretically necessary to support combustion with
essentially no excess oxygen. Since the combustion air
fan was not properly sized for the rerated burner, only
a 10:1 air/gas mixture was available with no restriction!
With the condensate-induced error, the volumetric ratio
is depleted to 7:1 or 14% natural gas in air. This is the
upper flammable limit as suggested in NFPA, though
other sources indicate the UFL is as high as 17%.
Regardless of the actual UFL, it is clear there was
very inefficient combustion and a buildup of
unburned material was occurring. This is confirmed
by the RTO temperature excursion and shut down,
moments before the explosion.
The flame detector was proven functional, so there
must have been a flame. But where was it? Why was
the gas not consumed? Why did an explosion hap-
pen? A flow chart, developed during the investiga-
tion, is attached.
Process Safety Progress (Vol.29, No.1) Published on behalf of the AIChE
The Answers
• Because the changes to the base design require-
ments were not managed, the burner was
rerated without a commensurate increase in the
combustion air blower capacity. Under best case
conditions, there would be only a slight oxygen
excess.
• However, the best case was eroded first through
the pressure relief valve and subsequently the
combustion trim damper, both of which allowed
adjustments to the flow/pressure of combustion
air downstream and thus were unmonitored by
the pressure safety switch. This certainly
reduced the actual flow through friction losses.
• Because the fan curve was truncated, we had a
continuum of flow rates at a given pressure differ-
ential, from near zero to near rated. Because the
instrumentation lines were improperly arranged,
condensate at least partially filled them. This had
the affect of blinding the low combustion air
interlock switch and distorting the controller for
the combustion air butterfly control valve.
• Because of the ‘‘self-piloted burner’’ design, we
only needed to monitor one flame—the low fire
flame which is burning regardless of the main
flame throttle position. The main flame base,
according to reports from numerous sources, was
several feet away from the burner nozzle at high
fire and extended 201 feet down the combustion
chamber. The flame monitoring system never saw
that flame. So, when the main flame went out, the
flame scanner never noticed it missing.
• Because of the specific design of the burner, the
combustion air, though inadequate for the main
flame, was ample to support the low fire burner.
This flame stayed lit and the annulus of combus-
tion air prevented the flame from contacting the
increasing concentration of unburned or partially
burned gas in the dryer duct work—for a few
minutes. Eventually, the diluting affect of the
combustion air was overwhelmed by high con-
centration of gas and ignition occurred.
CORRECTING THE PROBLEMS
Is Venting the Answer?
NFPA requires explosion venting for applications
that do not use refractory or tubes (e.g., high temper-
ature furnaces and boilers). Yet these devices are
exposed to the same fuel explosion exposure as low
temperature ovens. These low temperature ovens are
typically located inside buildings. It seems a bit dan-
gerous to vent any overpressure into a building. FM
Global Data Sheet 6–9 [3] offers some solace by
showing that only minimal pressures would be
observed if the vents were ever called on to deploy.
Still, minimal pressure would lose its meaning if you
were standing in front of the vent when it deployed.
Requiring venting as a needed layer of protection
suggests that prescribed combustion safeguards are
insufficient protection in low temperature applica-
tions. Exempting refractory lined equipment and
DOI 10.1002/prs March 2010 91
boilers suggests that this risk may be acceptable as
the operating temperatures in these applications are
usually above the AIT of the fuel.
An Alternate Path?
ASME Code Case 2211 [4] suggests instrumented
systems may be used to replace the need for physical
venting in reaction systems. We reasoned that com-
bustion is an oxidation reaction and that there should
be a way to achieve suitably reliable, controlled oxi-
dation to avert the need to provide vents. We turned
to NFPA 86 to see if such an approach might be
allowed. Lo and behold: Nothing in this standard is
intended to prevent the use of systems, methods, or
devices of equivalent or superior quality, strength,
fire resistance, effectiveness, durability, and safety
over those prescribed by this standard.
Would you instrument an oxidation reactor as
poorly as current codes suggest we do for the oxida-
tion of fuel gas in an oven, furnace or boiler? The
need to provide venting suggests that the prescribed
methods for controlling oxidation are insufficient. In
certain cases, it is deemed impractical. We believe
this gap can be closed, making fuel oxidation safer in
boilers and furnaces while offering an alternative to
venting explosions into a building.
Gas Supply
We know that with fuel in the proper flow range,
and air in the proper flow rate, a stable flame will be
maintained. So let’s look at a typical fuel train as a
safety instrumented system.
A double block and bleed system is used in the
gas feed line. To control oxidation, we need to have
the gas at the correct flow rate. We measure this
indirectly through pressure constraints (hi/lo limit
switches). Then, all we need is to assure a flame is
present and the proper amount of air. If the gas pres-
sure is too high or low or the flame goes out, the sys-
tem shuts down by closing both block valves. This
provides two safety functions. To protect against low
pressure gas causing flame problems the PSL and
flame sensor are voted 1oo2 to shut the block valves.
To protect against the regulator or control valve fail-
ing open and the resulting high pressure gas flame
problems, the PSH and flame sensor are voted 1oo2
to shut the block valves.
Air Supply
To assure we have enough air, we again rely on
pressure. A combustion air low differential pressure
interlock is provided. As described earlier, we have
additional detection for loss of flame. All are arranged
so that failure of one will trip the system (1oo2). The
output from the wiring terminal is arranged to
de-energize solenoids holding open two gas valves.
Thus, we have two outputs.
Control
We modified the DCS to conduct a few additional
checks to cover the start up conditions and provide
a layer of protection we deemed necessary. Should
92 March 2010 Published on behalf of the AIChE
the various switches (position, pressure, etc.) be
improper before the purge starts, the DCS will lock
out the start up command. This feature assures that a
false positive signal from the combustion air differen-
tial pressure switch will result in an alarm and no
start up. Assurance for purging the oven prior to light
off is controlled by the combustion safeguard system
with the DCS backing up this system. Should the
purge timer fail in the safeguard system, the DCS will
also lock out the start up command.
Regarding the reliability of the flame detection sys-
tem to detect high fire flame, we replaced the ‘‘self-
piloting burner’’ with a conventional burner that is
provided with an interrupted pilot and no integrated
‘‘low fire’’ burner. We found that the original 16 in.
flame rods were too short to detect flame at high fire
and replaced these with 24 in. flame rods.
All instrumentation lines were arranged to assure
condensate would flow back into the oven duct work
and we upsized these from ¼ to ½ in. diameter to
assure no capillary affect would occur.
Finally, detailed quarterly testing of all combustion
safeguard functions as well as annual calibration of
all pressure switches and tightness testing of all gas
valves was established. Management reviews these
completed documents and retains them for annual
auditing by a third party.
Are We There Yet?
Although we addressed some areas that had no con-
trol safeguards, we still rely on a single flame detection
system and mechanical linkage between the air and
fuel supplies. We are still vulnerable to gas build up
under high fire conditions should the burner fall out of
‘‘tune’’ due to linkage slip or combustion air obstruc-
tion downstream of the pressure switch tap. Flame can
be present and can satisfy the flame detection system
even with partial combustion. We do not have separa-
tion of the control system and its supervisory functions
to the degree necessary to count as a layer of protec-
tion. The combustion safeguard system only qualifies
as a SIL 1 system. We are not yet measuring what we
want to measure: the ratio of fuel to air.
Can We Get There?
There are many opportunities available to get us
to a much safer place. We can:
• Measure fuel/air ratio by using flow measure-
ment devices (mass or volumetric), make these
redundant and arrange their output to trip the
fuel valves closed when dangerous out of ratio
conditions exist.
• Measure products of incomplete combustion
(CO) and/or excess oxygen. These can also be
arranged to trip the fuel valves if key parameter
are exceeded.
• Employ an additional means of flame detection.
• Make the logic solvers more robust and/or
redundant.
We can also accept that explosions happen and
that providing enough venting on the enclosure will
DOI 10.1002/prs Process Safety Progress (Vol.29, No.1)
allow us to conform to codes and standards. How- 2. NFPA 85 Boiler and Combustion Systems Hazards
ever, we find this gives us little comfort. Code, 2007 Edition.
3. FM Global Property Loss Prevention Data Sheets
6–9 ‘‘Industrial Ovens and Dryers’’ (2003).
CONCLUSIONS
4. ‘‘Pressure vessels with overpressure protection by
• MOC, process hazard analysis, prestartup safety
system design,’’ Section VIII, Divisions 1 and 2,
review, and process safety information are
ASME Code Case 2211, 1995 Boiler Pressure Ves-
essential for safe and reliable operation in all
sel Code, American Society of Mechanical Engi-
industry sectors.
neers, 1995.
• There is no substitute for adequate engineering.
5. ANSI/ISA S84.00.01–2004, Functional Safety:
• There is no substitute for adequate installation.
Safety Instrumented Systems for the Process
• There is no substitute for adequate testing.
Industry Sector.
• We believe that the NFPA allowance of ‘‘self-
6. IEC 61511, Functional Safety: Safety Instrumented
piloting burners’’ in Chapter 86 is a contradiction
Systems for the Process Industry Sector, 2004.
to a requirement to assure flame is present at all
7. M. Cazabon and K. Erickson, ‘‘An oven explo-
burners as spelled out in Chapter 85. Addition-
sion—Lessons learned on PSM application,’’
ally, neither of these resources considers partial
Loss Prevention Symposium Proceedings, AIChE,
flame failure due to inadequate combustion air
New York (2009), pp. 663–680.
at high fire conditions.
8. J. Kauffman, T. Oakey, K. Price, and R.W. John-
• Given a typical fan curve, a low combustion air
son ‘‘Combustion safeguards test intervals—Risk
pressure switch may not provide useful informa-
study and industrial survey,’’ American Institute
tion—downstream obstructions could result in
of Chemical Engineers, Paper LPS-5e, LPS 2001
no flow, but adequate combustion air pressure.
Proceedings of the 35th Annual Loss Prevention
• We believe that measuring what you want to
Symposium, AIChE, New York (2001).
measure is critical. Measure mass flow or volu-
9. A. Summers, ‘‘Using instrumented systems for
metric flow of reagents and use this to assure
overpressure protection,’’ American Institute of
proper fuel to air ratios are met throughout the
Chemical Engineers, Paper No. 4A, LPS 2000
full firing range.
Proceedings of the 34th Annual Loss Prevention
Additional details of this article are in LPS Proceed- Symposium, AIChE, New York (2001).
ings [7]. Also, there are relevant teachings in other 10. J. Kauffman, T. Oakey, K. Price, and R.W. John-
AIChE publications [8–11]. son, Combustion safeguards test intervals—Risk
study and industry survey, Process Saf Prog 20
LITERATURE CITED (2001), 257–267.
1. NFPA 86 Standard for Ovens and Furnaces, 2007 11. A. Summers, Software-implemented safety logic,
Edition. Process Saf Prog 21 (2002), 161–163.

Process Safety Progress (Vol.29, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2010 93