Ip model code of safe practice part 19 2nd ed. jan. 2007 part1

Dear EI Customer,
We have been notified of an editorial change to Model code of safe practice Part 19: Fire
precautions at petroleum refineries and bulk storage installations (2nd edition, ISBN 978-
0-85293-437-1)
Details of erratum:
Section 4.8.3, paragraph 5 should include the word ‘operational’, as follows:
When planning tank bunds and bund walls, the bund should be capable of holding a
volume equal to 110 % of the maximum operational capacity of the tank.
Please ensure that your copy of this title is updated with the correct information.
If you have any questions, please don’t hesitate to contact me at the address above
Yours sincerely
Erica Sciolti
Publishing Manager
Energy Institute
e: esciolti@energyinst.org

Model code of safe practice
Part 19
Fire precautions at petroleum reﬁneries and
bulk storage installations
2nd edition
An IP Publication
Published by the Energy Institute

IP MODEL CODE OF SAFE PRACTICE IN THE PETROLEUM INDUSTRY
PART 19: FIRE PRECAUTIONS AT PETROLEUM REFINERIES
AND BULK STORAGE INSTALLATIONS

IP MODEL CODE OF SAFE PRACTICE IN THE PETROLEUM INDUSTRY
PART 19: FIRE PRECAUTIONS AT PETROLEUM REFINERIES
AND BULK STORAGE INSTALLATIONS
January 2007
Published by
ENERGY INSTITUTE, LONDON
The Energy Institute is a professional membership body incorporated by Royal Charter 2003
Registered charity number 1097899

The Energy Institute gratefully acknowledges the financial contributions towards the scientific and
technical programme from the following companies:
BG Group
BHP Billiton Limited
BP Exploration Operating Co Ltd
BP Oil UK Ltd
Chevron
ConocoPhillips Ltd
ENI
ExxonMobil International Ltd
Kuwait Petroleum International Ltd
Maersk Oil North Sea UK Limited
Murco Petroleum Ltd
Nexen
Shell UK Oil Products Limited
Shell U.K. Exploration and Production Ltd
Statoil (U.K.) Limited
Talisman Energy (UK) Ltd
Total E&P UK plc
Total UK Limited
Copyright © 2007 by the Energy Institute, London:
The Energy Institute is a professional membership body incorporated by Royal Charter 2003.
Registered charity number 1097899, England
All rights reserved
No part of this book may be reproduced by any means, or transmitted or translated into a machine language without the
written permission of the publisher.
The information contained in this publication is provided as guidance only and while every reasonable care has been taken
to ensure the accuracy of its contents, the Energy Institute cannot accept any responsibility for any action taken, or not
taken, on the basis of this information. The Energy Institute shall not be liable to any person for any loss or damage which
may arise from the use of any of the information contained in any of its publications.
The above disclaimer is not intended to restrict or exclude liability for death or personal injury caused by own negligence.
ISBN 978 0 85293 437 1
Published by the Energy Institute
Further copies can be obtained from Portland Customer Services, Commerce Way,
Whitehall Industrial Estate, Colchester CO2 8HP, UK. Tel: +44 (0) 1206 796 351
e: sales@portland-services.com
Electronic access to EI and IP publications is available via our website, www.energyinstpubs.org.uk.
Documents can be purchased online as downloadable pdfs or on an annual subscription for single users and companies.
For more information, contact the EI Publications Team.
e: pubs@energyinst.org.uk

v
CONTENTS
Page
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Key technical changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.3 Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.4 Risk-based fire and explosion hazard management (FEHM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.5 Legislative trends in FEHM assessment and provision of fire risk reduction measures . . . . . . . . . . . 3
1.6 International application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.7 Risk drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.7.1 Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.7.2 Life safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.7.3 Environmental effects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.7.4 Asset loss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.7.5 Business interruption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.7.6 Reputation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.7.7 Insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Fire-related properties of petroleum and its products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Combustion of petroleum and its products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.2 Fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.3 Explosions/boiling liquid expanding vapour explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Smoke and gases from fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

vi
Contents Cont... Page
2.5 Fire and explosion scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5.2 Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5.3 Unignited product releases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.5.4 Pool fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.5.5 Atmospheric storage tank fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5.6 Jet fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.7 Boiling liquid expanding vapour explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.8 Vapour cloud explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.9 Flash fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.6 Consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6.2 Thermal flux – consequence assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6.3 Overpressures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6.4 Flammable/toxic vapour clouds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.6.5 Blast effects/missiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.7 Fire and explosion modelling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.7.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.7.2 Types of model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3 FEHM procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2 Fire scenario analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2.1 Identification of major fire scenarios, hazards and hazard characteristics . . . . . . . . . . . . . . . 20
3.2.2 Typical scenarios for various installations/areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.2.3 Design/credible scenario selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2.4 Fire and explosion modelling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3 Risk reduction options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.4 FEHM policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.5 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.5.1 Practices and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.5.2 Fire systems integrity assurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.5.3 Inspection and testing of fire systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.5.4 Fire response preplanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.5.5 Competency development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.5.6 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
4 Fire prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2 Control of flammable substances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2.1 General principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2.2 Liquid releases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2.3 Flammable atmospheres . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.4 Isolation/depressurisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.5 Flammable gas/vapour dispersion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.3 Atmospheric monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.4 Control of sources of ignition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.4.2 Static electricity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.4.3 Lightning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.5 Permit-to-work systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

vii
4.6 Maintenance practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.6.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.6.2 Hot work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.6.3 Electrical equipment used for maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.6.4 Hand tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.6.5 Chemical cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.6.6 High pressure water . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.7 Housekeeping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.8 Site layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.8.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.8.2 Boundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.8.3 Storage tank layout/secondary containment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.8.4 Process plant layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.8.5 Fire-fighting access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.8.6 Drainage systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.8.7 Fire protection and other safety critical equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.9 Buildings fire precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5 Fire and flammable gas detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.2 Principles of fire and flammable gas detection – Options, applications and design issues . . . . . . . . 39
5.2.1 Flammable gas detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.2.2 Fire detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.2.3 General design guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.3 Control system executive actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.4 Fire/gas alarm and warning systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6 Fire protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
6.1.1 Passive and active fire protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
6.2 Passive fire protection – Options, applications and design issues . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.2.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.2.2 Applications and design issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.3 Active fire protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.3.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.4 Extinguishing media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.4.2 Water . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.4.3 Foam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.4.4 Dry powder (dry chemical) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6.4.5 Gaseous agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6.5 Fixed systems – Options, applications and design issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
6.5.2 Water spray systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
6.5.3 Fixed monitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.5.4 Sprinkler systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.5.5 Water mist systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.5.6 Foam systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.5.7 Dry powder (dry chemical) systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
6.5.8 Gaseous systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
7 Response strategies and options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

viii
7.2 Incident response strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7.2.1 Unignited gas release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7.2.2 Flammable liquid pool fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
7.2.3 Gas/liquid release, flash fire and jet fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
7.2.4 Unconfined/semi-confined vapour cloud explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
7.2.5 Fireball/boiling liquid expanding vapour explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.3 Occupational fire brigades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.3.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.3.2 Options for site fire response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.4 Organisation of occupational fire brigades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.5 Competency standards for site fire responders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.6 Fire equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
7.6.1 Portable and mobile fire-fighting equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
7.6.2 Responder personal protective equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
7.6.3 Inspection and maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
8 Maintaining FEHM policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
8.2 Organisation of emergency procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
8.3 Incident preplanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
8.4 Recognition of hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
8.5 Control of incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
8.6 Training of personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
8.7 Pre-fire plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
8.8 Scenario-specific emergency response plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
8.9 Maintaining incident response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
8.9.1 Training and emergency response plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
8.9.2 Dynamic risk assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
8.9.3 Fire systems integrity assurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
ANNEX A – RELEVANT UK AND EUROPEAN LEGISLATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
A.1 Nature of legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
A.2 Seveso II Directive and COMAH Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
A.3 Complementary regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
A.4 Licensing and enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
ANNEX B – FIRE-RELATED HAZARDS OF PETROLEUM AND ITS PRODUCTS . . . . . . . . . . . . . . 91
B.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
B.2 Boiling points (or ranges), flash points and ignition temperatures of petroleum products . . . . . . . . . . . 92
B.3 IP classification of petroleum and its products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
B.4 Flammable limits of petroleum products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
ANNEX C – TYPICAL INSTALLATIONS/AREAS – FIRE AND EXPLOSION HAZARD
MANAGEMENT (DETECTION AND PROTECTION) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
C.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
C.2 Storage tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
C.3 Process areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
C.4 LPG storage installations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
C.5 LNG installations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
C.6 Marine facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
C.7 Buildings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

ix
ANNEX D – TYPICAL APPLICATION RATES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
D.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
D.2 Water based systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
D.3 Control of burning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
D.4 Extinguishment using water only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
D.5 Storage tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
D.6 Water supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
D.7 Foam application rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
D.8 Pool fire foam application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
D.9 Tank fire foam application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
D.10 Gaseous systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
D.11 Incident experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
ANNEX E – EMERGENCY RESPONSE TEAM MEMBER – EXAMPLE COMPETENCY
PROFILE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
E.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
E.2 Competency mapping profile for ERT member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
ANNEX F – CLASSIFICATION OF FIRES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.2 Class A – Fires involving solid materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.3 Class B – Fires involving liquids or liquefiable solids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.4 Class C – Fires involving gases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.5 Class D – Fires involving metals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
F.6 Class E – Fires involving electrical equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
F.7 Class F – Fires involving cooking oils . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
F.8 Other classification schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
ANNEX G – EXAMPLE SITE-SPECIFIC EMERGENCY RESPONSE PLAN . . . . . . . . . . . . . . . . . . . 121
G.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
G.2 Explanatory notes to text aspect of site-specific ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
G.3 Effects maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
G.4 Radiant heat examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
ANNEX H – GLOSSARY OF TERMS AND ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
H.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
H.2 Glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
H.3 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
ANNEX I – REFERENCES, BIBLIOGRAPHY AND FURTHER INFORMATION . . . . . . . . . . . . . . . 135
I.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
I.2 Key publishers of FEHM publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
I.3 Codes of practice, design standards, specifications, guidance, etc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
I.4 Industry organisations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
I.5 Other safety organisations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
I.6 Standards and approvals organisations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Figures
Figure 1.1: FEHM process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Figure 2.1: Typical pool fire analysis and fire-map aspect of scenario-specific ERP . . . . . . . . . . . . . . . . . . . 16
Figure 3.1: Design/credible scenario selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 3.2: Scenario risk matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 3.3: FEHM risk reduction options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Figure 3.4: FEHM policy options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

x
Figure 5.1: Open-path flammable gas detection used as perimeter monitoring . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 5.2: Catalytic flammable gas detection in process area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 5.3: Catalytic flammable gas detection in LPG storage area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 5.4: Heat detection in enclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Figure 5.5: LHD for open top floating roof tank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Figure 5.6: Pneumatic LHD in LPG storage area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Figure 6.1: Stages in foam production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Figure 6.2: Fixed foam pourer system for fixed roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Figure 6.3: Subsurface foam system for fixed roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 6.4: Semi-subsurface foam system for fixed roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 6.5: Foam pourer for open top floating roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 6.6: Catenary system for open top floating roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 6.7: Coflexip system for open top floating roof tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 6.8: Total flooding gaseous system schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Figure 6.9: Example schematic of a CO2 local application gaseous system . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Figure D.1: Efficacy of foam application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Figure G.1: Example fire map aspect of site-specific ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Figure G.2: Example scenario worksheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Tables
Table 2.1: Heat flux consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Table 2.1: Overpressure consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Table 3.1: Risk reduction options guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 6.1: Comparison of foam properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Table B.1: Boiling points (or ranges), flash points and ignition temperatures of petroleum products . . . . . . 92
Table B.2: IP classification of petroleum and its products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Table B.3: Flammable limits of petroleum products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Table C.1: Location and spacing for above-ground tanks for storage of petroleum and its products
in Classes I, II(2) and III(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Table D.1: Minimum application rates for water based systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table D.2: Minimum foam solution application rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Table E.1: Unit 1 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Table E.2: Unit 2 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Table E.3: Unit 3 Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Table E.4: Unit 4 Skills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Table G.1: Example of text aspect of site-specific ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Boxes
Box D.1: Example calculations sheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

xi
FOREWORD
IP Fire precautions at petroleum refineries and bulk storage installations ('IP 19') provides guidance on selecting,
implementing and monitoring the continuing performance of site-specific justified risk reduction measures – from
prevention through detection, protection systems to mitigation measures – to reduce the risk from design event fires
at installations that process and store petroleum, intermediates and refined products.
In line with recent legislation in the UK, Europe and elsewhere in the world, IP 19 does not set out prescriptive
practices for adoption. Instead, it provides good practice guidance on options that may be appropriate to implement
in order to satisfy pertinent risk drivers such as legislation, safety, environmental protection, asset protection,
reputation and business continuity. The publication is based upon a framework of risk-based fire and explosion
hazard management (FEHM) to achieve this, although it recognises that other approaches can be used.
The guidance in this publication should assist process safety engineers, safety advisors, designers, emergency
planners or others with responsibility for fire and explosion hazard management to meet the pertinent requirements
of the European Seveso II Directive, whether sites are classified lower or upper tier.
This publication is based primarily on the UK and European legislative framework, publications and good practice.
However, its guidance is internationally applicable provided it is read, interpreted and applied in conjunction with
relevant national and local requirements. It can be used as a basis for establishing a consistent fire and explosion
hazard management policy for companies with multi-site operations within a country or across several countries.
The second edition of IP 19 was commissioned by the Energy Institute’s Distribution and Marketing Safety
Committee, contracted to Resource Protection International and directed by a Steering Group. It supersedes the first
edition, published in 1993. Whilst amendments have been made throughout, major changes have been made to:
— Clarify the scope and exclusions, and how users should apply the publication internationally, whether using the
FEHM approach or another approach.
— Arrange sections in a logical, sequenced order of: fire-related hazards; the FEHM approach; fire prevention;
fire and flammable gas detection; fire protection; response strategies and options; and maintaining an effective
FEHM policy.
— Set out a portfolio of FEHM risk drivers.
— Enhance the guidance on fire and explosion scenarios, consequences and modelling.
— Capture improved knowledge of risks associated with fires in large storage tanks.
— Recognise that hazard identification and incident prevention are usually the primary concern.
— Capture the experience gained and developments in risk reduction techniques and equipment for use in various
installations/areas.
— Provide guidance on maintaining FEHM policy through emergency planning and fire systems integrity
assurance (FSIA) by outlining typical approaches.

xii
— Revise guidance on typical fire-fighting media application rates and provide a commentary that recognises
incident experience and recent good practice.
The technical content of this publication was being finalised at the time of the Buncefield bulk storage installation
major accident in December 2005. Whilst only some findings of the investigation have been released, thus far the
FEHM process described herein has not been technically compromised. However, this publication does not fully
reflect the unprecedented consequences of the seemingly partially confined vapour cloud explosion. The decision
to proceed with publication of the second edition of IP 19 was based on balancing this issue and other issues that
may transpire from the Buncefield investigation against the value of the rest of the updated guidance, which replaces
the first edition published over ten years ago. The integrity of this publication will be further reviewed on release
of additional findings of the Buncefield investigation. Similarly, readers of this publication should keep abreast of
technical issues contained in those findings.
The information contained in this publication is provided as guidance only and while every reasonable care has been
taken to ensure the accuracy of its contents, the Energy Institute and the technical representatives listed in the
Acknowledgements, cannot accept any responsibility for any action taken, or not taken, on the basis of this
information. The Energy Institute shall not be liable to any person for any loss or damage which may arise from the
use of any of the information contained in any of its publications.
This publication may be further reviewed from time to time. It would be of considerable assistance in any future
revision if users would send comments or suggestions for improvement to:
The Technical Department
Energy Institute
61 New Cavendish Street
LONDON, W1G 7AR
e: technical@energyinst.org.uk

xiii
KEY TECHNICAL CHANGES
This section sets out in a generalised form, the key technical changes between the first and second editions of IP 19
(IP Fire precautions at petroleum refineries and bulk storage installations). Note that the second edition of the
publication also contains numerous editorial amendments.
The key technical changes are to:
— Clarify the scope and exclusions, and describe how users should apply the publication internationally, whether
using the FEHM approach or another approach.
— Arrange sections in a logical, sequenced order; thus, the fire-related hazards associated with petroleum and its
products are discussed first and this is followed by general guidance relating to the FEHM approach.
Thereafter, fire prevention, fire and flammable gas detection, and fire protection systems (both active and
passive) are covered in separate sections. There are also sections on response strategies and options, and
maintaining an effective FEHM policy.
— Set out a portfolio of FEHM risk drivers; in particular, legislation, life safety, environmental protection, etc.
— Enhance the guidance on fire and explosion scenarios, consequences and modelling.
— Capture improved knowledge of risks associated with fires in large storage tanks, e.g. from the large
atmospheric storage tank fires (LASTFIRE) project.
— Recognise that hazard identification and incident prevention are usually the primary concern. Thus, risk
reductionmeasures andmethods ofcontrollingresidualriskareusuallyconsidered once fire preventionmethods
have been fully addressed.
— Provide guidance on fire scenario analysis, credible scenario identification and design event selection in support
of hazard identification.
— Capture the experience gained and developments in risk reduction techniques and equipment, such as by
providing more guidance to assist implementation of detection systems (e.g. flammable gas and fire detection
and their application) and protection systems (e.g. fire-fighting media and its application using various fire
response equipment) in typical installations/areas.
— Provide guidance on maintaining FEHM policy through emergency planning and FSIA by outlining typical
approaches. This is supported by typical incident response strategies, an example site-specific emergency
response plan (ERP) and an emergency response team (ERT) member competency profile.
— Set out the requirements of pertinent UK and European legislation, such as the COMAH Regulations and the
Seveso II Directive respectively.
— Revise guidance on typical fire-fighting media application rates and provide a commentary that recognises
incident experience and recent good practice.
— Update the glossary of terms and abbreviations.
— Illustrate technical issues with diagrams and photographs, as appropriate.
— Update the listing of references and bibliography (e.g. codes of practice, design standards, specifications,
guidance, etc.) and provide a new listing of contact details for pertinent organisations.

xv
ACKNOWLEDGEMENTS
The 2nd
edition of IP Fire precautions at petroleum refineries and bulk storage installations was commissioned by
the Energy Institute’s Distribution and Marketing Safety Committee. The project was contracted to Resource
Protection International, whose contributors were Paul Watkins, Niall Ramsden and John Frame. It was directed by
a Steering Group that also comprised:
David Athersmith Consultant (formerly MoD Defence Estates) (member, Distribution and Marketing Safety
Committee)
Kevin Westwood BP (Secretary, Joint Oil and Industry Fire Forum)
Ken Palmer Consultant (member, Distribution and Marketing Safety Committee)
Gerry Johnson Fulcrum Consultants (member, Joint Oil and Industry Fire Forum)
Paul Evans Chevron (member, Major Hazards Working Group)
Mark Scanlon Energy Institute (Secretary, Distribution and Marketing Safety Committee and Observer,
Major Hazards Working Group)
The Institute wishes to record its appreciation of the work carried out by them in providing technical direction to
the project.
Comments on the draft of this publication were received during its technical review from several organisations;
significant contributions were made by:
Phil Chatfield Environment Agency
David Hughes Chevron
Mike Longman ExxonMobil
Dave Carter Health and Safety Executive
Dr John Sawyer Health and Safety Executive
Such comments have been considered and, where appropriate, incorporated. The Institute wishes to record its
appreciation of the work carried out by them and others who participated during the technical review.
Project co-ordination and technical editing was carried out by Mark Scanlon (Energy Institute).

xvii
OVERVIEW
Section 1 clarifies the scope and exclusions, and describes how the publication should be applied internationally.
It introduces the concept of risk-based FEHM, which is the framework upon which the publication is based. It also
notes the legislative trend towards a risk-based approach and sets out a portfolio of other risk drivers.
Section 2 outlines the fire-related hazards of petroleum and its products (including their IP classification) and
common fire and explosion scenarios that should be considered as part of a risk-based FEHM approach.
Section 3 expands on the key steps in the FEHM procedure: fire scenario analysis – typical scenarios are outlined
for various facilities/areas; review risk reduction options – a listing of options is provided; define FEHM policy
between the limiting cases of burndown and total protection; and implement FEHM policy, by referring to a range
of measures from FSIA through to staff personnel competency development and emergency planning.
Section 4 describes several means of hazard avoidance that aim to prevent unplanned releases and avoid their
ignition.Fireprevention measures described include: control of flammable substances; control of sources ofignition;
maintenance; site layout; and operations.
Section 5 describes the use of fire and flammable gas detection to give early warning of a fire event in critical
installations or where there is a high emphasis on life safety. Their use should enable immediate investigation and/or
fire response. The section describes the various types, their application to various facilities/areas and design issues.
Section 6 describes passive and active fire protection measures, which are intended to reduce the consequences of
fire. Options, applications and design issues are reviewed for passive fire protection materials in limiting temperature
rise and preventing excessive heat absorption. The capabilities of active fire protection media are reviewed for
controlling a fire, extinguishing a fire, or preventing ignition during an emergency in typical installations/areas. In
addition,mediaapplicationisreviewed,whetherusingfixed or semi-fixed systems and portable/mobile fire response
equipment.
Section 7 provides incident response strategies for various fire and explosion scenarios to maintain FEHM policy;
it includes options for mobile and portable fire response, including the specification, use and maintenance of fire-
fighting equipment ranging from fire monitors to responder personal protective equipment (PPE). The guidance on
incident response strategies reflects experience and good practice in fire response; it can be used as a basis for
developing site-specific fire response strategies accompanied by ERPs.
Section 8 sets out the requirements for maintaining an effective FEHM policy, in particular through emergency
planning from high-level incident preplans through to scenario-specific ERPs. In addition, it covers personnel
competency development, emergency plan testing and FSIA for fire and flammable gas detection and fire protection
systems.

xviii
Annex A reviews the requirements of pertinent UK and European legislation, such as the COMAH Regulations and
Seveso II Directive, respectively.
Annex B provides the IP classification and physical properties of petroleum and its products, which should be used
when assessing their fire-related hazards.
Annex C provides typical applications of the most common fire and flammable gas detection and fire protection risk
reduction measures for various installations/areas.
Annex D provides guidance on typical fire-fighting media application rates for various equipment types and fire
scenarios, focusing mainly on applying water and foam to large petroleum fires for extinguishment and/or cooling.
In addition, some guidance is provided on incident experience and recent good practice.
Annex E provides an ERT member competency profile based on four units: operations; maintenance; procedures;
and skills.
Annex F details the European basis of classifying fires and reviews other classification systems.
Annex G provides an example site-specific ERP and an example scenario worksheet. In addition, some benchmark
radiant heat levels and their effects are provided.
Annex H provides a glossary of terms and abbreviations.
Annex I provides details of publications referenced and a bibliography of additional ones (e.g. codes of practice,
design standards, specifications, guidance, etc.). It also provides a listing of contact details for pertinent
organisations.

1
1
INTRODUCTION
1.1 INTRODUCTION
This section clarifies the scope and exclusions, and
describes how the publication should be applied
internationally. It introduces the concept of risk-based
fire and explosion hazard management (FEHM), which
is the framework upon which the publication is based.
It also notes the legislative trend towards a risk-based
approach and sets out a portfolio of other risk drivers.
Generally, the petroleum industry is successful in
minimising fire incidents and containing their effects.
This should not lead to complacency, however, and this
publication aims to help maintain and, indeed, improve
fire and explosion hazard management.
1.2 SCOPE
IP 19 provides guidance on selecting, implementing and
monitoring the continuing performance of site-specific
justified risk reduction measures – from prevention
through detection, protection systems to mitigation
measures – to reduce the risk from design event fires at
installations that process and store petroleum(e.g. crude
oil), intermediates (e.g. naphtha) and refined products
(e.g. gas oil). The publication provides a framework of
good practice which should assist attainment of legal
compliance, in particular with the pertinent
requirements of European Seveso II Directive, and
satisfying other risk drivers.
Its scope includes petroleum refineries and bulk
storage installations (e.g. terminals, depots and larger
customer storage installations). In addition, it can be
applied to bitumen refineries and bulk storage
installations, blending and storage at lubricants
installations, and similar petroleum industry
installations. Installations excluded from scope are:
— filling stations;
— smaller customer storage installations;
— natural gas storage installations (at ambient
conditions);
— processing and storage on offshore installations.
Whilst the publication is built upon the principles of
FEHM, the focus is on fire aspects; whereas, explosion
hazards,preventionandprotectionare specialisedtopics
and are outwith the scope.
1.3 APPLICATION
In line with recent legislation in the UK, Europe and
internationally, this publication does not set out
prescriptive practices for adoption. Instead, it provides
good practice guidance on options that may be
appropriate for users to implement in order to satisfy
pertinent risk drivers; in particular, legislation, safety
(e.g. to personnel and society), environmental
protection, asset protection, reputation and business
interruption.
Reducing the frequency or consequences of fires
may assist in risk reduction for any risk driver; yet,
when a measure is considered for risk reduction, it
should be justified using cost benefit analysis (CBA)
and as low as reasonably practicable (ALARP)

MODEL CODE OF SAFE PRACTICE PART 19: FIRE PRECAUTIONS AT PETROLEUM REFINERIES AND BULK STORAGE INSTALLATIONS
2
principles. The reasons why any particular fire risk
reduction measure is provided should therefore be
understood, appropriate performance criteria for it
should be developed, and it should be ensured that it
meets those criteria on a continuing basis. Thus, site-
specific risk reduction strategies should be adopted and
this publication provides guidance on their selection,
implementation and monitoring.
This publication is based on a framework of risk-
based FEHM, hence its guidance is therefore provided
in support of that approach; however, the publication
can also be used independently by applying guidance of
relevant sections, as summarised in Table 3.1.
IP 19 is based primarily on the UK and European
legislative framework, publications (codes of practice,
design standards, specifications, guidance, etc.) and
good practice. However, its guidance is universally
applicable provided it is read, interpreted and applied in
conjunction with relevant national and local statutory
legislation and publications. Where the requirements
differ, the more stringent should be adopted.
This publication can be used as a basis for
establishing a consistent FEHM policy for companies
with multi-site operations within a country or across
several countries. The FEHM approach can
accommodate variations in risk drivers in determining
the levels of risk reduction measures; for example, in
justifying higher levels of risk reduction measures
where an installation is critical to a country’s economy
or of major strategic importance.
This publication is based on the premise that the
general design and construction of petroleum refineries
and bulk storage installations are in accordance with all
relevant legislation and publications (codes of practice,
design standards, specifications, guidance, etc.).
The guidance in this publication should assist
process safety engineers, safety advisors, designers,
emergency planners or others withresponsibilityforfire
and explosion hazard management to meet the pertinent
requirements of the European Seveso II Directive,
whether sites are classified lower or upper tier.
Whilstthe publicationprovidesguidancerelating to
fire prevention and protection measures to assist
implementation,whereappropriate,usersshould consult
relevant publications (codes of practice, design
standards, specifications, guidance, etc.) for further
information. The legislation, publications, etc.
referenced are correct at the time of writing; however,
users should keep abreast of developments by
contacting the pertinent organisations.
1.4 RISK-BASED FIRE AND EXPLOSION
HAZARD MANAGEMENT (FEHM)
For the purposes of this publication risk is defined as
the product of incident frequency (or probability) and
consequences. Thus, it is possible to reduce risk by
implementing frequency reduction (prevention)
measure(s) or consequence reduction (mitigation)
measure(s). In practice, both are applied.
The term risk-based FEHM is used to describe an
auditable, integrated approach to risk reduction by the
provision of prevention and consequence reduction
measures appropriate to the levels of risk. It should be
viewed as one method of addressing fire safety issues at
an installation and may form an integral part of an
installation’s overall safety, health and environment
management system (SHEMS). The key stages in the
approach are:
— Fire scenario analysis.
— Review risk reduction options.
— Define FEHM policy.
— Implement FEHM policy.
This sequence is shown in Figure 1.1, which also
includes details of typical input tools at each stage.
The basis of the decision on which risk reduction
measures are to be put in place is based on the actual
risk determined following a risk assessment which
includes an evaluation of typical fire scenarios. Once it
has been decided that a particular measure is to be
provided then, and only then, are publications (codes of
practice, design standards, specifications, guidance,
etc.) on fire protection system design used to give
guidance on its implementation. In addition, it should be
noted that implementation does not just mean the
installation of fire systems; it includes system
maintenance, preplanning, competency development
and assessment of system operation and fire response,
exercises and training. Site management should thus be
involved on a continuous basis to ensure
implementation is continually effective.
The final decision on the most appropriate fire risk
reduction options should depend on site-specific
conditions. In theory the options can range from no
provisions to a totally integrated package of automatic
process shut down, depressurisation, fixed automatic
fire detection systems and fixed automatic protection
systems, backed-up by a full-time occupational fire
brigade with mobile equipment. In practice, most
installations typically adopt a combination of fixed
systems for critical items and mobile response for other
areas.

INTRODUCTION
3
Figure 1.1: FEHM process
By demonstrating the link between potential
scenarios and the risk reduction measures implemented,
the FEHM process, if carried out properly by competent
personnel, should result in a strategy that is consistent
with both legislation and business risk reduction
requirements.
1.5 LEGISLATIVE TRENDS IN FEHM
ASSESSMENT AND PROVISION OF
FIRE RISK REDUCTION MEASURES
Following experience from major incidents, UK and
European legislation and that in many other parts of the
world has moved away from prescriptive requirements.
Instead, a risk-based approach has been taken putting
the onus on duty holders to demonstrate to the
competent authority (CA) that they are taking all
necessary measures to reduce risk to life safety and the
environment to acceptable levels. This may be achieved
by a number of options including both prevention and
mitigation measures.
The key European legislation is the European
Communities Council Directive 96/82/EC on the
Control of Major-Accident Hazards Involving
Dangerous Substances (commonly called the Seveso II
Directive, named after a major accident at Seveso,
Italy), as amended by Directive 2003/105/EC of the
European Parliament and of the Council of
16 December 2003 amending Council Directive
96/82/EC on the Control of Major-Accident Hazards
involving Dangerous Substances. Each European
Community country implements this Directive through
national legislation. For example, in the UK it is
implemented as the COMAH Regulations, except for
land-use planning. See annex A.2 for more information
regardingtherequirementsoftheCOMAHRegulations.
For enforcement in the UK, the CA comprises the
Health and Safety Executive (HSE) and, for England
and Wales the Environment Agency (EA), for Scotland
the Scottish Environment Protection Agency (SEPA),
and for Northern Ireland, the Northern Ireland
Environment and Heritage Service (EHSNI).
In the UK, all petroleum refineries and most bulk
storage installations are subject to the COMAH
Regulations, although only lower tier duties apply for
some smaller bulk storage installations. Smaller
installations would, in any case, be subject to the
Dangerous Substances and Explosive Atmospheres
Regulations (DSEAR), which implement European
C o mmu n i t i e s E x p l o s i v e A t mo s p h e r e s
Directive 99/92/EC and the safety aspects of European
CommunitiesChemicalAgentsDirective98/24/EC. See
annex A.3 for more information regarding the
requirements of DSEAR.
Fire
scenario
analysis
CONSEQUENCES
Life safety
Environment
Business interruption
Asset value
Other issues
Incident descriptions
Ignition sources
Hazardous materials
Review risk
reduction
options
Evaluate alternative
prevention, protection
and mitigation measures
Define
FEHM
policy
Formalisation
Legislation
Implement
FEHM
policy
Equipment maintenance
Preplanning
Exercises
Fire training
Update
POSSIBLE INPUT TOOLS
HAZOP
QRA
Incident experience
Fire engineering
Fire modelling
Cost benefit analysis
Publications
(codes of practice,
design standards,
specifications,
guidance, etc.)
POSSIBLE INPUT TOOLS POSSIBLE INPUT TOOLS

4
A duty holder may, of course, decide to provide
additional levels of fire risk reduction to reduce
business and reputation losses. For example, a minor
fire incident in a critical part of an installation may have
minimal life safety or environmental effects but could
cause considerable downtime; hence, additional fire
detection or extinguishing systems may be included, not
as a matter of safety, but to reduce business interruption.
Thus, there is no conflict between the approach
required by regulators to demonstrate the reduction of
risk to acceptable levels and that of duty holders to
reduce business risk. However, the types of risk that are
important to regulators and those additional ones
important to duty holders should be defined.
1.6 INTERNATIONAL APPLICATION
Due to the nature of the petroleum industry, many users
of this publication will have operations in several
countries. This publication can be used to give the basis
for fire risk reduction measures under different
operating conditions, thus ensuring consistency in
approach from location to location. It can therefore be
used as a basis for establishing company FEHM policy.
On an international level, the FEHM approach is
particularly appropriate where an installation is critical
to a country’s economy or of major strategic
importance. In some areas, oil-related revenues
represent the vast majority of national income. This
should result in the justification of higher levels of risk
reduction measures. Indeed, in some countries these are
prescriptively applied. This does not conflict with the
guidance in this publication but reflects the levels of
risk for such installations.
In some cases, users should seek specialist
expertise regarding requirements for, and design of fire
precautions and protection systems; for example, where
operations are situated in adverse environments.
1.7 RISK DRIVERS
The FEHM process and the consequent provision of
cost-effective, justified, risk reduction measures
requires a comprehensive review of actual risk,
including downstream issues as well as immediate
consequences.
Legislators/regulators are concerned about risk to
personnel on the installation, to society living around it
and to the environment. Whilst duty holders should also
see these as their priorities, they should also consider
other risk drivers, such as business interruption and
reputation (especially for large multi-national
companies).
A formal quantitative CBA may ultimately be
required to determine whether or not a risk reduction
measure is justified, particularly where the major risk is
to business interruption and reputation. In other cases,
a more straightforward experience-based decision may
be used.
The main risk drivers that should be considered are
set out in the following sections.
1.7.1 Legislation
Local relevant legislation should be considered as the
ultimate risk reduction requirement; if it is not met, then
the duty holder may face enforcement action.
As noted in 1.7, regulators should not request duty
holders to put measures in place where there is no
significant impact on life safety, property and
environmental protection. Duty holders who have a
robust risk assessment and consequent FEHM policy
should be in an advantageous position in such
circumstances. Another legislation-related risk to be
considered is that of downstream cost repercussions in
terms of investigations and the imposition of additional
legislative requirements.
1.7.2 Life safety
Life safety is clearly the primary risk driver. This should
not only consider the risk to individuals due to the
incident itself but also to fire responders, given the
chosen response strategy. In addition, life safety risk
due to escalation should be taken into account. For
example, in a full tank surface crude fire, escalation to
a boilover (see section 2.5.5.7) could lead to multiple
injuries and/or fatalities if the response strategy did not
include evacuation of personnel from the potentially
affected area.
Life safety is often the subject of high levels of risk
quantification.
Typically, results are expressed as risks either to
personnel (individual risk) or to population groups as a
whole (societal risk).
When evaluating the need for risk reduction
measures to life safety, risk criteria should be set and
agreed with local regulators; they may comprise criteria
for personnel and societal risks. Criteria may be based
on company standards or regulators’ criteria such as
those in HSE Application of QRA in operational safety
issues or HSE Reducing risks, protecting people.

INTRODUCTION
5
1.7.3 Environmental effects
Fires at petroleum installations can have environmental
effects in terms of causing loss of product containment,
or producing smoke and other toxic combustion
products. However, inefficientorincorrectfire-fighting
actions can also result in escalating environmental
effects. For example, over-use of fire-fighting water
can carry petroleum products outside bunded areas and
overload wastewater treatment plants.
EA Environmental impact of controlled burns
recognises that in some cases, subject to a risk
assessment (which should be done, in any case, as part
of the FEHM process and to satisfy legislation), and
under certain conditions, the strategy with least
environmental impact may be a controlled burn. The
final decision on whether such a strategy is acceptable
depends on such factors as potential escalation (e.g.
boiling liquid expanding vapour explosion (BLEVE)
(see section 2.3.3.3) or boilover (see section 2.5.5.7)),
long-term smoke production and reputation.
One issue that is becoming an increasing concern
is the potential environmental effects of the use of fire-
fighting foam. This has mainly, but not solely, been
associated with the use of fluorosurfactants which give
foams resistance to petroleum product contamination.
Some fluorosurfactants have been found to be
particularly long lasting in the environment and have an
effect on aquatic and other life.
At the time of writing of this publication, no
definitive guidance has been issued on which
fluorosurfactants (or other ingredients) can be used and
under what circumstances. However, users should
monitor developments as it might affect the decision on
which response strategy should be adopted.
1.7.4 Asset loss
Every fire results in some damage to an installation and
hence direct asset loss and subsequent repair or
reinstatement costs. In practice, the direct asset loss is
usually much lower than the consequential loss. In
addition, asset loss is often covered by insurance but
consequential loss may not be.
1.7.5 Business interruption
Fires usually lead to short or long term business
interruption. This may only be limited to stoppage
during the incident itself but, if the damaged installation
is critical, then the down time may be prolonged. An
example of this is a fire incident at a petroleum refinery
jetty which could prevent import of crude and/or export
of refined products, thus effectively closing down the
refinery.
1.7.6 Reputation
The reputation (i.e. public image) of a company and its
perceived capability of being in full control of its
installation can be severely affected by a fire incident.
This is particularly true for companies operating
internationally and for long-duration incidents (such as
the controlled burn of a full surface tank fire).
Television footage of incidents can be quickly
transmitted around the world, often with ill-informed
commentary, and to the detriment of reputation; this
may be evidenced in a company’s share price.
1.7.7 Insurance
An incident may have a significant effect on the ability
of a duty holder to obtain insurance cover at competitive
rates. However, insurance cover may also be used to
limit the overall financial consequences of an event,
particularly if environmental damage and business
losses are covered. (In other words, insurance can be
viewed as a risk reduction measure by limiting the
financial consequences of an incident.)

6

7
2
HAZARDS
2.1 INTRODUCTION
Storing, handling and processing petroleum and its
products invariably carries a risk of fire, or in certain
cases explosion, with threats to life, the environment,
assets, business interruption, etc. (see section 1.7).
Combustion and its potential consequences should
be fully understood when developing appropriate,
justified fire risk reduction measures and fire response
strategies.
Petroleum and its products are stored, handled and
processed in different ways and this can have a bearing
on the type(s) of fire and explosion scenarios and their
consequences. Their fire-related properties should also
be understood because they influence the probability of
combustion as well as fire (orexplosion) characteristics.
For example, crude oil and certain petroleum
products with a wide range of boiling points may
undergo boilover (see 2.5.5.7) during an incident giving
a potential escalation route as well as posing a major
hazard to fire-fighters. Other petroleum products might
not pose a significant life safety hazard if allowed to
burn in a controlled manner, but might require special
mitigation measures if extinguishment is to be
attempted (e.g. using alcohol resistant multi-purpose
foams for polar solvents (see section 6.4.3.4)).
This section outlines the fire-related hazards of
petroleum and its products (including their IP
classification) and presents key principles relating to
their combustion, as well as common fire and explosion
scenarios that should be considered as part of any risk-
based FEHM approach.
2.2 FIRE-RELATED PROPERTIES OF
PETROLEUM AND ITS PRODUCTS
Crude oil and its derivatives are hazardous substances.
The degree of the hazard can be characterised by
volatility (as indicated by boiling point/range), flash
point, flammable limits, ignition temperature and IP
classification.
The flash point of a flammable liquid is the lowest
temperature, corrected to a barometric pressure of
101,3 kPa, at which the application of a source of
ignition in a prescribed manner causes the vapour of a
test portion to ignite and the flame propagates across the
surface of the test sample under the specified test
conditions.
Flash points are dependent on various factors,
including the test method used; the latter should be
specified when a value is quoted. For the purposes of
this publication, when reference is made to flash point
it will be to a closed cup non-equilibrium test method.
For liquids having flash points below 40 °C the test
method to be used to determine the flash point should
be IP 170; whereas, for liquids having flash points
above 40 °C the method used to determine the flash
point should be IP 34.
The ignition temperature of a substance is the
minimum temperature required to initiate or to cause
self-sustained combustion independent of a spark or
flame. The vapours of petroleum and most petroleum
products have ignition temperatures in the range 250-
500 °C. Combustible cellulosic materials (i.e. non-
hydrocarbon materials such as paper and rags) have
lower ignition temperatures. Oil that has soaked into

8
insulation may ignite at a reduced ignition temperature.
See Table B.1 for typical ignition temperatures.
The ignition temperature data in Table B.1 should
be regarded as approximate only, since they depend on
the characteristics of the test method used. Some of the
variables known to affect the results are: percentage
composition of the vapour-air or gas-air mixture; shape
and size of the space where ignition occurs; rate and
duration of heating; and catalytic or other effect of the
material of the container.
The system of IP classification of petroleum and its
products is based upon their flash points (see
Table B.2). When handled above their flash point, there
is a greater risk of ignition; accordingly, their IP
classification will change.
Flammable substances are also characterised by
upper and lower flammable limits, between which gases
or vapours mixed with air are capable of sustaining
combustion. These limits are referred to as the lower
flammable limit (LFL) and the upper flammable limit
(UFL), and are usually expressed as percentages of the
substance mixed with air by volume. For flammable
liquids and combustible solids, however, they may be
expressed as a mass or volume (e.g. in g/m3
for dusts).
Flammable limits for commonly encountered petroleum
products are provided in Table B.3.
2.3 COMBUSTION OF PETROLEUM
AND ITS PRODUCTS
2.3.1 General
The three essential conditions that must co-exist before
a fire can become established are a sufficient supply of
flammable vapour, a source of ignition, and a supply of
oxygen (e.g. from air).
The mechanisms of burning in fires and in
explosions are different. In a fire the plume of vapour
evolved by the fuel has been ignited and continues to
burn at the interface with the surrounding air. The rate
of burning, which affects the flame length, is controlled
by the rate of diffusion of oxygen from the air to the
burning vapour; the flames involved are termed
diffusion flames. With petroleum and its products the
flames are typically yellow or orange in colour, and are
usually accompanied by the emission of black smoke.
Damage to neighbouring structures is due almost
entirely to heat transfer by convection and radiation.
Damage by pressure effects is negligible.
In an explosion the fuel vapour becomes mixed
with air before it is ignited. Flame then propagates
through the mixture, burning the fuel, with the rate of
burning governed by the chemistry of the oxidation.
The flame is termed a pre-mixed flame. The rate of
burning is relatively fast, and the rapid releases of
energy can generate sufficient pressure to damage
neighbouring structures. Associated heating effects are
transient. For petroleum and its products, explosion
flames are blue or pale yellow, depending on the
stoichiometry of fuel and air. Smoke emission is much
less than in fires.
The characteristics of fires and explosions are best
considered separately.
2.3.2 Fires
Once a vapour has been ignited it will usually burn as a
diffusion flame, which will stabilise in the vicinity of
the fuel. The flame travels to all exposed surfaces of
liquid above its flash point, providing there is sufficient
air supply.
Nearly all the heat produced is distributed by
convection and thermal radiation; the majority is
convected away. The significance of the convection
component is that it forms an upward moving fire plume
that rises under the influence of buoyancy.
It has been estimated that up to one third of the heat
from a fire is lost as thermal radiation from the flames
and accompanying smoke and soot. Radiation from the
flames can greatly hinder the approach to the fire by
fire-fighters and cause the heating ofneighbouringtanks
and other installations, requiring cooling water to be
applied to keep temperature low. See Section 6 for fire
protection measures.
Anticipated wind velocities should be considered
when designing risk reduction options. Wind velocity
has contributed to transporting petroleum vapour from
a neighbouring tank heated by radiation, to a burning
tank, leading to flashback of flame to the neighbouring
tank and to its ignition.
A consequence of the upward velocity within the
fire plume is the effect on fire extinguishing agents
applied to the surface of the petroleum fuel. When the
agent is fire-fighting foam, it may be swept upwards by
the plume instead of falling onto the petroleum liquid
surface and so provides neither the desired covering nor
cooling effects.
2.3.3 Explosions/boiling liquid expandingvapour
explosions
2.3.3.1 General
Firstly, a air/vapour mixture must be within the
flammable limits, e.g. in the case of liquefied natural
gas (LNG) vapours, not less than about 5,0% or more
than about 15,0% of vapour by volume in air. Data on
flammable limits are widely available. Table B.3 gives

HAZARDS
9
typical flammable limits under ambient conditions of
some petroleum products. Flammable limits are
considerably wider if the vapour is oxygen-enriched or
if substances are processed at elevated temperatures and
pressures. The special case of hydrogen should be
noted, it being flammable between the wide limits of
4,0% and 75,0% volume in air.
Secondly, a source of ignition must be present.
Ignition can take place anywhere in the cloud where the
fuel/air ratio is within the limits of flammability; the
flame then travels through the vapour cloud, pushing
unburnt gas ahead of it and generates a 'shock' wave.
Also, a vapour cloud may ignite if any flammable
portion encounters a hot surface and is locally heated to
the ignition temperature. Alternatively, the whole
flammable vapour may be brought up to its ignition
temperature. Examples of typical ignition temperatures
are given in Table B.2.
If explosion takes place in a confined space, the
heat release may result in a pressure rise greater than the
walls of the space can withstand. Examples of locations
in storage installations where confined explosions have
occurred include drainage systems and storage tanks. In
addition, explosions have occurred at petroleum
refineries in process areas, furnace combustion
chambers and flare systems.
It is also possible for explosions to take place in the
open air when a large volume of flammable vapour is
ignited. Such volumes may accumulate, e.g. from a spill
of highly volatile product, or release of high-energy
product such as LPG. Where such volumes are confined
or there is a degree of congestion (e.g. in a process area)
the flammable vapour/air cloud can become very
turbulent and explosion severity increases.
Confined and congested explosions are
characterised by high flame speeds and overpressures;
localpersonnelcannotescape. Thesecontrastwithspills
leading to flash fires where flame speeds are generally
much lower and escape may be possible.
Explosions may be classified into physical and
chemical explosions:
(a) Examples of physical explosions, in which there is
no chemical reaction, are over-pressurising a vessel
and the explosive vaporisation of water due to very
rapid heating. Although a flame may not be
involved in the explosion, the result can give rise to
a flammable atmosphere.
(b) Chemical explosions may be divided into uniform
(or homogeneous) and propagating explosions:
— In a uniform or homogeneous explosion the
chemical reaction occurs throughout the
mixture simultaneously, e.g. uncontrolled
exothermic reaction.
— In a propagating explosion, the chemical
reaction occurs in a flame front, which
involves only a thin layer of flammable
mixture. The flame then propagates through
the remainder of the mixture. If the velocity of
the flame is subsonic, the propagation is
termed deflagration. With a deflagration in a
closed volume the pressure rise is effectively
uniform throughout the volume. If the flame
velocity is sonic or supersonic, propagation is
termed detonation. The flame is accompanied
by a shock wave that causes localised high
pressure, and the pressure rise is not uniform
throughout the volume. Detonations and
deflagrations are very hazardous, and
preventing their development is a main
purpose of explosion protection.
2.3.3.2 Pressure effects
For the deflagration of petroleum vapour in air, in a
closed vessel initially at 1 bar absolute pressure, the
explosion pressure can typically rise to a maximum of
8 bar absolute pressure, unless containment is lost.
If the enclosure is vented, the maximum pressure is
reduced. As pressure is equal to force per unit area, a
modest pressure exerted over an extended area such as
a door or wall can generate a high total force. The
strength of the attachment of the door or wall to the
remainder of the structure should be adequate.
If a deflagration can accelerate over a long
distance, as in an extended pipelines system, it may
undergo transition to detonation. In a detonation in air
the maximum pressure at the shock front may be as high
as 20 bar; the pressure is exerted over a smaller area and
for a shorter time than in a deflagration. Detonations
have a much greater shattering effect than deflagrations.
Although the total amount of energy released is similar,
it is concentrated at the shock front and venting does not
give protection.
2.3.3.3 Boiling liquid expanding vapour explosion
A BLEVE is usually a consequence of prolonged
heating of a pressurised (normally LPG) vessel by an
external fire. The vessel may heat up rapidly and fail,
spreading burning fuel as it ruptures. The initiating fire
may be a pool or jet fire, which heats the vessel,
increasing its internal pressure. During the fire, a relief
valve may operate and result in an additional jet fire.
Regardless of heating mechanism, as the liquid level in
the vessel drops due to combustion, the vessel above the
liquid level is weakened and can eventually fail due to
a combination of continued flame impingement, high
heat flux and overpressure. The sudden relaxation of

10
pressure on the liquid inside causes massive
instantaneous boiling and release of vapour, which is
ignited by the fire. The resultant fireball can take the
appearance of a large 'mushroom cloud' (sometimes
called a 'ball on a stick') and fragments of the vessel
may be projected over several kilometres.
2.4 SMOKE AND GASES FROM FIRE
2.4.1 General
Smoke consists of particulate matter suspended in the
gaseous products of combustion, i.e. fire gases. Smoke
is formed by the products of partial combustion of the
fuel, as well as the products of thermal decomposition.
The composition and quantity of smoke generated
by a fuel in a fire are not solely characteristic of that
fuel but depend upon fire conditions. Amongst other
factors, smoke emission depends upon the air supply,
the temperature of the fire and the presence of other
materials.
Moisture affects smoke emission in a complex
manner. Dampness in solids slows down the rate of
combustion and reduces its completeness, and can cause
increased generation of smoke. The addition of steam to
a flare burning gaseous fuels can reduce the burning rate
in the flame, but may also reduce the smoke generation
and change its appearance. Addition of water to a liquid
petroleum fire either can reduce smoke emission if the
fire is subdued, or can increase emission if splashing
enhances the fire.
Smoke and fire gases present the following serious
health hazards to life:
— Reduced visibility results from obscuration by the
smoke and from irritation of the eyes; consequently
escape from the fire and efficient fire-fighting is
difficult.
— High temperatures of smoke and gases cause
damage to the lungs and to exposed skin. They
may inhibit attempts to escape from the fire.
— The inhalation of toxic or oxygen-deficient gases
can cause death, collapse, or chronic damage, and
smoke inhalation can severely damage the trachea
and lungs.
Smoke also has the potential to damage the
environment, especially if the fire is sizeable and
volume production is large.
It is also worth noting that large smoke plumes can
also damage company reputation if seen from afar (see
section 1.7.6).
2.5 FIRE AND EXPLOSION SCENARIOS
2.5.1 General
The first step in the FEHM process involves fire
scenario analysis. Credible fire and explosion scenarios
should be identified at each installation on a site-
specific basis.
As introduced in Section 1, one way to define and
implement appropriate and justified fire and explosion
hazard management policies is to adopt a risk-based
FEHM approach. This process is increasingly being
recognised worldwide as an alternative to prescriptive
means of providing fire and explosion prevention and
protection measures. NB: The term FEHM includes
'explosions' but it should be noted that explosion
hazards, preventionandprotectionare specialised topics
and are outwith the scope of this publication.
As part of this, fire and explosion scenarios should
be evaluated for probability and consequences (i.e. risk)
so that appropriate, justifiable risk reductionoptions can
be selected.
Scenarios selected as posing appreciable risk, and
meriting risk reduction measures may be included in a
COMAH safety report used to demonstrate FEHM
policy and its implementation. In most cases,
documentation should be provided to show that credible
scenarios have been identified, and risk reduction
measures are in place and maintained as part of the
installation’s FEHM policy.
Fire scenario analysis can be achieved through a
combination of various qualitative scenario analysis
tools including hazard analysis (HAZAN)/hazard
identification (HAZID)/hazard and operability
(HAZOP) and quantitative methods such as event or
fault tree analysis. Quantified risk assessment (QRA)
can also be used. Industry databases giving incident
probabilities can be employed to assist quantitative
methodologies. These can be combined with fire and
explosion consequence modelling tools to gain an
overall assessment of risk.
Incident experience may also provide a useful tool
for assessing incident probabilities and consequences.
For example, it might be shown that certain types of
incident have occurred or are more likely because of
certain failure modes, initiating events or even human
factors and inadequate practices and procedures (e.g.
inappropriate maintenance). Similarly, consequences in
terms of life safety, asset loss, environmental impact
etc. can be estimated from documented incidents.
2.5.2 Scenarios
A range of fire and explosion scenarios should be

HAZARDS
11
considered. In most cases it will be impractical to
consider every possible scenario and a balance should
be struck between addressing larger, less frequent
scenarios that would cause more damaging
consequences to personnel, business and the
environment, and smaller, potentially more frequent
events that could lead to escalation or significant
localised damage.
Scenarios should include:
— unignited product releases;
— pool fires;
— atmospheric storage tank fires:
- vent fires;
- full surface fires;
- rim seal fires;
- spill-on-roof fires;
- bund fires;
- boilover;
— jet fires:
- gas jet fires;
- liquid spray fires;
— BLEVEs;
— vapour cloud explosions (VCEs);
— flash fires.
As well as the above, potentially toxic product releases
should be considered, and it is worth noting that these
may have the potential to result in fires and/or
explosions if ignited.
The probability and magnitude (i.e. consequences)
of these events depend on a number of product factors:
— Release characteristics (e.g. whether the product is
released as a gas, liquid or mixture; whether it is of
short duration or prolonged).
— Whether the substance released is toxic, flammable
or both.
— If flammable, whether ignition occurs, and if so
where and when.
— For ignited gas releases, whether overpressures are
generated on combustion (this depends on the
degree of confinement or congestion, as well as
fuel reactivity and strength of any source of
ignition).
In addition, incident probability may be increased
during activities such as maintenance and start-up
operations.
2.5.3 Unignited product releases
Paradoxically, ignition source control measures
routinely adopted at installations mean that releases of
flammable liquids and vapours (whether pressurised or
at atmospheric pressure) have the potential to
accumulate and remain unignited. Consequently, the
amount of flammable product may be large with
potential to create damaging fires and explosion if
ignited. For flammable liquid releases, the extent of any
fire depends on containment measures, as well as any
mitigation such as spill response carried out at the time
of the release. For gaseous releases, atmospheric
dispersion is of importance. As part of any fire scenario
assessment, potential release rates should be determined
with the help of a ‘source’ model. The results of these
can be fed into pool fire, jet fire and VCE consequence
models to determine fire extent and characteristics.
Also, there are a number of gas dispersion models
available that can be used to evaluate the magnitude of
any vapour cloud.
Unignitedproductreleasesgenerallyrequirecareful
mitigation and response actions to remove the hazard.
These can include containing, neutralising and
disposing of the product, or achieving gas dilution or
assisted dispersion with the use of water sprays and/or
curtains. Such measures are discussed in Section 7.
It is also worth noting that in addition to fire and
explosion, unignited releases can pose environmental,
toxic and asphyxia hazards and these should be included
in any scenario analysis.
2.5.4 Pool fires
Pool fires can be contained (e.g. atmospheric storage
tank or bund fires) or uncontained (e.g. unbunded or
because of bund overtopping). The ignited fuel usually
has very little or no momentum (i.e. it lies in a static
pool) and combusts as heat is fed back to the product
and it evaporates from the liquid surface. A pool fire
can occur in areas such as in bunding below a vessel. If
unconfined, the spread can depend on the surface
characteristics (e.g. whether hard concrete or
permeable), nearby drains and the presence of water
surfaces. Pool fire flames are often ‘tilted’ due to wind
effects and can ‘drag’ downwind for some considerable
distance. In addition, they can be accompanied by large
quantities of smoke.
Pool fires present a thermal hazard dangerous to
personnel and installations. The potential heat flux in
the flame of a pool fire may be in the order of
250 kW/m2
.
Fire escalation under pool fire conditions would
normally involve direct flame impingement on adjacent
tanks, vessels or pipework and valves or prolonged
exposure to heat fluxes in excess of 8-12 kW/m2
near to
the fire if there is no protection. Escalation may be

12
much more rapid if exposures are subjected to fluxes in
excess of 32-37,5 kW/m2
nearer the flame.
Pool fires may be preceded by a jet/spray fire as
installations or process plants depressurise, and this
should be taken into account during any fire scenario
analysis.
Note, in many cases, the level of thermal flux from
a pool fire determines personnel safety, levels of fire
protection that should be provided and emergency
response requirements. See later in this section, as well
as Sections 7 and 8.
2.5.5 Atmospheric storage tank fires
Atmospheric storage tank fires are, essentially,
contained pool fires and can vary from being relatively
small rim seal fires (in the case of a floating roof tank)
to spill-on-roof fires and full surface fires. The RPI
LASTFIRE project (see annex I.3) – a joint petroleum
industry initiative reviewing the risks associated with
large diameter storage tank fires – provides a
comprehensive review of tank fire scenarios, as well as
typical incident probabilities and consequences based
on incident experience and a comprehensive industry
database.
The type of fire scenarios to be considered depends
largely on the tank construction and to a lesser extent on
the product:
— For fixed roof and internal floating roof tanks, vent
fires and full surface fires (see 2.5.5.1-2.5.5.2).
— For open top floating roof tanks, rim seal fires,
spill-on-rooffires and full surface fires (see2.5.5.3-
2.5.5.5).
— For all tank types, bund fires (see 2.5.5.6).
— For tanks containing crude oil and wide boiling
point products, boilover (see 2.5.5.7).
2.5.5.1 Vent fires
A vent fire is a fire in which one or more of the vents in
a tank has ignited. Flammable vapours are always
present in the vicinity of vents, either because of the
tank’s daily breathing cycle or during tank filling
operations. Most vent fires are attributed to lightning
(see section 4.4.3), although instances have occurred
when sources of ignition outside the tank have started
vent fires.
When addressed properly, vent fires can usually be
extinguished with minimal damage and low risk to
personnel. Losses of containment associated with vent
fires typically occur as a result of overfilling due to
operator error, failure of level instrumentation or in
normal tank operation.
2.5.5.2 Full surface fires
A full surface fire in a fixed roof tank can be brought
about by vent fire escalation. A vapour space explosion
can occur if the vapour space is within the flammable
range at the time of flame flashback, especially if vents
and/or flame arrestors are defective. If the tank is
constructed to a recognised publication such as
API Std. 650 then the roof should separate from the tank
shell along a weak seam. Depending on the force of the
vapour space explosion, the roof may either be partially
removed or fully removed.
2.5.5.3 Rim seal fires
A rim seal fire is one where the seal between the tank
shell and roof has lost integrity and there is ignited
vapour in the seal area. The amount of seal involved in
the fire can vary from a small localised area up to the
full circumference of the tank. The flammable vapour
can occur in various parts of the seal depending on its
design.
The most common source of ignition for a rim seal
fire, as determined by the RPI LASTFIRE project (see
annex I.3) is lightning (see section 4.4.3). Clearly, the
probability of ignition is increased in areas of the world
where ‘lightning days’ are more common but ignition
probability may be further increased if tank
maintenance is poor. Other notable sources of ignition
for documented rim seal fires include hot work on a
‘live’ tank where permit-to-work (PTW) procedures
(see section 4.5) have failed to identify fire risk.
2.5.5.4 Spill-on-roof fires
A spill-on-roof fire is one where a hydrocarbon spill on
the tank roof is ignited but the roof maintains its
buoyancy. In addition, flammable vapours escaping
through a tank vent or roof fitting may be ignited.
2.5.5.5 Full surface fires
A full surface fire is one where the tank roof has lost its
buoyancy and some or the entire surface of liquid in the
tank is exposed and involved in the fire. If a roof is well
maintained and the tank is correctly operated, the risk of
a rim seal fire escalating to a full surface fire is very
low.
2.5.5.6 Bund fires
A bund fire is any type of fire that occurs within the
secondary containment area outside the tank shell due
to pipe fracture, corrosion, etc. These types of fire can
range from a small spill incident up to a fire covering
the whole bund area. In some cases (such as a fire on a
mixer) the resulting fire could incorporate some jet or
spray fire characteristics due to the hydrostatic head.

HAZARDS
13
2.5.5.7 Boilover
Boilover is a phenomenon that can occur when a fire on
an open top floating roof tank containing crude or
certain types of heavy fuel oils (which contain a range
of fractions), has been burning for some time. It can
result in large quantities of oil being violently ejected,
even beyond the bund. Boilover is a potential escalation
route to multiple tank/bund incidents and a major hazard
to fire-fighters.
A boilover can occur in crude oil tank fires when
the hot zone of dense, hot crude oil created by the
burning of lighter ends descends through the bulk and
reaches any water base, which may have been
augmented by fire-fighting or cooling actions. The
water turns to steam, expanding in the order of 1 500:1.
This steam pushes up through the bulk, taking crude
with it and creates a fireball above the tank. Boilovers
have spread burning crude oil several tank diameters
from the source, thus escalating the incident and
endangering fire responders.
The phenomenon of boilover plays a key role in
decision making on the most appropriate and cost
effective strategy for crude oil tank fires. Although such
events are very rare due to normal operating and design
controls, when they occur they can cause major asset,
business interruption and reputation damage. Boilovers
have been known to cause multiple fatalities as well as
fire escalation to adjacent installations.
2.5.6 Jet fires
A jet fire is a stable jet of flame produced when a high
velocity discharge catches fire. The flame gives varying
amounts of smoke depending on the product and degree
of air entrainment during discharge. For example,
gas/oil jet fires can produce more smoke than both gas
or gas/condensate fires and may also feed pool fires.
Jet fires can result because of ignition of a high-
pressure gaseous release, or otherwise because of the
combustion of a liquid spray (e.g. a high-pressure crude
release).
The proportion of the release burning as a jet or
spray tends to increase with the pressure and the
volatility of the liquid.
By their nature, jet fires are very hot and erosive
and have the potential to rapidly weaken exposed plant
and equipment (even if passive fire protection (PFP) is
provided) as well as pose a serious thermal risk to
personnel. The potential heat flux in the flame of a jet
fire can be in the order of up to 350 kW/m2
. Escalation
from jet fires would normally involve direct flame
impingement or prolonged exposure to high heat fluxes
in the region of the flame.
2.5.7 Boiling liquid expanding vapour explosions
See 2.3.3.3 for an explanation of BLEVE.
Pool and jet fire scenarios should be assessed for
their capacity to create potential BLEVE situations;
these are more likely where fires can burn directly under
or close to pressurised vessels containing Class 0
products.
2.5.8 Vapour cloud explosions
A VCE involves the explosive combustion of
flammable vapours released to the atmosphere. The
consequences of a VCE depend on factors such as the
reactivity of the vapour, degree of congestion and
confinement and ignition characteristics. Also,
characteristics such as vapour density can affect the
travel, ease of dispersion and therefore extent of the
cloud.
Potential release areas in petroleum refineries are
typically very congested with pipework, process units,
vessels and other equipment. Ignited releases there have
the potential to be major, generating damaging
overpressures because the vapour/air mixture becomes
very turbulent and the combustion rate increases very
rapidly.
Installations and structures within the blast zone
may be demolished or severely damaged, depending on
the extent of overpressure generated. Personnel may
also be at risk from the overpressure, as well as flying
debris and blast/heat effects.
For assessment purposes, the probability of vapour
releases should be determined along with the likely
extent of dispersion. As well as this, the potential for
damaging overpressures should be ascertained. A
number of explosion modelling techniques are available
to carry this out, and some of these are configured to
provide 'lethality' data to assist in assessing personnel or
societal risk.
2.5.9 Flash fires
A flash fire can occur when the combustion of a
flammable liquid and vapour results in a flame passing
through the mixture at less than sonic velocity.
Damaging overpressures are usually negligible, but
severe injuries can result to personnel if caught up in the
flame. Also, a flash fire may travel back to the source of
any release and cause a jet or spray fire if the release is
pressurised.

14
2.6 CONSEQUENCES
2.6.1 General
The consequences of the fire and explosion scenarios
include:
— Thermal fluxes hazardous to plant, buildings and
people.
— Potentiallydamagingoverpressures affecting plant,
buildings and people.
— Flammable and/or toxic vapour/air 'clouds'
hazardous to people and the environment.
— Blast effects and missiles (e.g. because of BLEVE)
hazardous to plant, buildings and people.
Depending on release size, and extent of fire or
explosion, consequences may be restricted to site areas
or the effects may be felt offsite, endangering the public
and the environment. Fire and explosion consequence
modelling can assist in the assessment of hazard
distances. Most models give hazard contours
representing the levels of heat flux, overpressure,
vapour/air concentration, etc. as a function of distance
from the fire or explosion centre. Such models are
described in section 2.7.
As well as the above physical consequences, other
impacts are possible, such as asset loss, business
interruption, reputation etc. These can be very difficult
to quantify and are best assessed on a site-specific basis.
However, as a guide, some insurance industry estimates
place typical consequential incident costs in the order of
at least ten times the initial incident cost.
In terms of life safety, fire and explosion
consequences have the potential to cause injury or even
death; in most cases, additional risk reduction options to
eliminate or reduce them should be taken.
2.6.2 Thermal flux – consequence assessment
Both pool and jet fires have the potential to create
hazardous heat fluxes in the region of the flame and
outside it, and damage or injury to plant and personnel
can be a consequence.
For consequence assessment purposes, and to
determine fire response resource requirements, times to
failure of unprotected plant and potential fire escalation
may be in the order of:
— 5 – 20 min. for reactors and vessels at 250 –
350 kW/m2
.
— 5 – 10 min. for pipework at 250 – 350 kW/m2
.
These data should be used for guidance only; times to
failure and/or escalation may vary depending on the
extent and duration of exposure, as well as the
characteristics of plant and equipment. For practical fire
response purposes, equipment/plant exposed to
8 – 12 kW/m2
for a prolonged period will generally
need cooling at some stage, possibly provided by
mobile means. Fixed cooling equipment should be
considered for equipment/plant likely to be exposed to
32 – 37,5 kW/m2
. Fire responders wearing appropriate
personalprotectiveequipment(PPE)wouldnormallybe
able to carry out very brief (<1 min.) tasks if subjected
to no more than 6,3 kW/m2
.
Table 2.1 categorises the potential consequences of
damaging radiant heat flux and direct flame
impingement. See also IP Guidelines for the design and
protection of pressure systems to withstand severe fires.
2.6.3 Overpressures
VCEs can result in damaging overpressures, especially
when flammable vapour/air mixtures are ignited in a
congested area. Personnel may be killed or injured by
blast effects, and buildings, plant and equipment could
be damaged or demolished.
Assessing consequences for VCE scenarios
involves considering the release size, and potential
fireball and overpressure effects generated by the
explosion. As a guide, the overpressures given in
Table 2.2 are often used as a basis for damage
assessment.
Table 2.1: Heat flux consequences
Thermal flux
(kW/m2
)
Consequences
1 – 1,5 Sunburn
5 – 6 Personnel injured (burns) if they are wearing normal clothing and do not escape
quickly
8 – 12 Fire escalation if long exposure and no protection
32 – 37,5 Fire escalation if no protection (consider flame impingement)
Up to 350 In flame. Steel structures can fail within several minutes if unprotected or not cooled

HAZARDS
15
Table 2.2: Overpressure consequences
Static overpressure
(barg)
Consequences
0,01 10% window breakage
0,03 Injuries from flying glass. 50% window breakage
0,15 Partial collapse of brickwork, roofs lifted. 100% window breakage
0,3 Destruction of steel-framed buildings, ear-drum rupture. Severe roof damage,
people killed by falling masonry
0,5 People in the open picked-up and thrown. Severe masonry damage, rail tank
wagons overturned, trees snapped in half
0,7 Severe structural damage to heavy steel and reinforced concrete buildings. Rail tank
wagons ruptured and reactors overturned
2.6.4 Flammable/toxic vapour clouds
Accidental releases of flammable and/or toxic
substances can have wide ranging consequences
including:
— Incapacitation and/or death of onsite personnel and
offsite populations.
— VCEs if ignited.
For example, a release of highly toxic substance such as
acrylonitrile or hydrogen fluoride might require
immediate evacuation of affected areas or sheltering in
a temporary refuge to safeguard personnel. If the release
has potential to travel offsite, further emergency
procedures should be considered. Also, there may be
localised depletion of oxygen after an ignition and this
should be taken into account if personnel are trapped in
wreckage.
Vapour dispersion modelling can help to assess
potential consequences (i.e. hazard distances and
vapour/air concentrations) associated with such
releases.
2.6.5 Blast effects/missiles
In some cases, events such as BLEVE or pressure vessel
burst will result in fragments of plant and equipment
being projected with obvious danger to people and
structures. The consequences of this are more difficult
to assess. However, documented BLEVE events and
incident experience have shown that fragments can be
projected over several kilometres, and some
consequence models now include ways of assessing this
potential.
2.7 FIRE AND EXPLOSION MODELLING
2.7.1 General
In an area where flammable liquids and gases are
processed, handled or stored it is often possible to
predict the physical effects of fires and explosions to
assess the threat to personnel and to consider whether
incident escalation is possible.
Recent advances in fire, explosion and gas
dispersion modelling techniques enable fire protection
engineers to determine with some confidence the
potential effects of accidental releases of flammable
fluid through the use of sophisticated computer
programs or simulations. However, fire and explosion
modelling alone cannot act as a substitute for an overall
FEHM approach, in which incident experience, fire
engineering and process awareness all play a significant
part.
Fire and explosion modelling can be used to:
— Quantify the physical effects associated with fire
and explosion such as heat radiation, explosion
overpressure and flame shape or length. These
calculations can be used to assess whether
personnel and fire responders will be placed at risk
in the immediate or surrounding environment.
— Determine the response of plant and equipment to
heat radiation and blast loadings and estimate the
likelihood of incident escalation due to factors such
as the erosion or failure of vessels and
piping/equipment by flame or heat radiation.
— Determine the response of buildings to heat
radiation and blast loadings, and estimate what the
consequences may be for the occupants, if either
they remain in the building or attempt to escape.

16
— Highlight the need for fire protection or mitigation
measures such as PFP or water spray for cooling
purposes. Additionally, analyses can be used to
underline the requirement for additional fire-
fighting resources.
Results of modelling can be included in scenario-
specific ERPs to provide guidance for technicians and
fire responders in the early stages of an incident.
Information such as heat radiation or overpressure
contours can be superimposed on installation plot plans
to assist incident response.
2.7.2 Types of model
2.7.2.1 Pool fire
For the purposes of assessing risk to personnel, plant
and equipment it is most often the heat radiation
component that is modelled although the amount and
toxicity of smoke can also be addressed. Most models
express levels of heat radiation in terms of kW/m2
,
representing these as contours in the final output. Also,
the degree of flame tilt and drag due to wind effects can
be shown, since this can bring the fire closer to
downwind objects and engulf them. A typical pool fire
model output might appear as shown in Figure 2.1, with
the results of an analysis being used in an ERP, shown
opposite. In this example, the contours produced by a
pool fire model have been superimposed on a storage
tank in order to represent the levels of heat radiation and
their distances, from a full surface fire. (It is worth
noting that this type of analysis or 'firemap' could
equally be used to show heat radiation emanating from
pool fires beneath vesselsand other process equipment).
2.7.2.2 Jet fire
From a modelling perspective factors such as flame
length and fire duration should be addressed, since they
determine the degree of flame impingement, subsequent
heat transfer and therefore escalation potential. Jet
flames tend to be extremely erosive due to their
significant momentum, and so modelling jet fire
behaviour can assess the likelihood of PFP damage. A
typical jet fire model gives similar contours to the pool
fire model, enabling risk to personnel and equipment to
be considered. Recently, more sophisticated computat-
ional fluid dynamics (CFD) models have evolved
allowing more in-depth calculations of flame
temperature in specific regions, and detailed
breakdowns of convective and radiative heat transfer.
A typical jet fire analysis also requires modelling of
fuel release rates. These should be found by using a
separate 'source' model, which may be part of the fire-
modelling package. Release rates invariably have a
bearing on fire duration and flame length, and should be
estimated from credible scenarios, e.g. as a result of
small-bore pipe work, pump seal ruptures and larger
equipment failures. Also, it is possible to model jet fires
(and subsequent pool fires if liquid 'rains' out of the
plume) whilst taking into account a plant’s blowdown
strategy.
2.7.2.3 Gas dispersion
It is also possible to estimate the likely size,
composition and flammability characteristics of
accidental gas releases by modelling release rates. This
should be carried out if the gas release may threaten
large areas of process plant and personnel due to the
risk of a VCE. Gas dispersion models are especially
Figure 2.1: Typical pool fire analysis and fire-map aspect of scenario-specific ERP
100
80
60
40
20
20
40
60
80
20 40 60 80 100-100
100
-80 -60 -40 -20
0
0
Pool fire: horizontal plane at 15 m
Material:
petrol/kerosine
Heat flux
5 kW/m
10 kW/m
20 kW/m
Flame drag
Flame
Distance (m)Unconfirmed spillage on land
Down wind
5 m/s
2
2
2
22 23
FH
FH
FH
FH
FH
FH
FH
FH
Water
tank
Skid
Offshore
Stage
Pum
p
house
SludgePit A
North
This fire map is provided
for guidance only and
should not be regarded as
a definitive map of any fire
that may occur. Radiation
contours as at top of tank.
6 kW/m
Contour
Flame drag
contour
Tank full
surface fire
area
12 kW/m
Contour
Rev Date Description By
itle
ank Full surface f re
DRG B / 21 F S F s a e
FH
Pits
2
221

HAZARDS
17
useful when specifying and planning the location of
flammable or toxic gas detection, since it is possible to
determine potential gas concentrations at specific
locations, and hence select and position detectors able
to respond at a point well before the LFL or toxic
threshold. Also, this type of model can be used to
determine the extents of the flammable range, whether
or not gas will accumulate at low points if heavier than
air, or indeed whether pockets of potentially explosive
gas/air mixtures might exist at a particular point.
Modelling can therefore help to define a significant gas
hazard in terms of risk to personnel and assets. From a
fire response perspective, the results can be used to
track gas movement and provide guidance relating to
the deployment of water curtains and other barriers to
gas dispersion. More sophisticated models may even be
able to portray the degree of mixing within congested
areas and allow these results to be fed into further
explosion severity analyses.
2.7.2.4 Explosion models
Regardless of model type, the approach is usually to
calculate or specify maximum potential explosion
overpressures upon the ignition of gas/air (in some
cases fine droplet/air) mixtures. The results can be fed
into the design of blast-resistant buildings in petroleum
refineries, or to study the effect of plant design
modifications in reducing explosion overpressures (See
CIA Guidance for the location and design of occupied
buildings on chemical manufacturing sites). The
technique can also be used with very good effect for
emergency response purposes and can aid the
production of ERPs by indicating evacuation
requirements.
Historically, explosion models such as the TNO
multi-energy model have been used to determine
potential hazard consequences. However, this method is
not always appropriate for all VCEs and new
approaches such as congestion assessment, exceedance
and other CFD-based models are typically used.

18

19
3
FEHM PROCEDURE
3.1 INTRODUCTION
The concept of risk-based FEHM was introduced in
Section 1. It recognises the input to fire risk reduction
from a wide range of issues and enables selection of
cost-effective site-specific strategies that are directly
relevant to real needs.
The FEHM technique involves a scenario-based
evaluation of credible incidents, an assessment of their
potential consequences and quantification and
implementation of the resources required to respond to
them. (It should be realised, however, that not all
possible scenarios may be foreseen, nor may excessive
analysis be desirable).
As noted in section 1.7, meeting legislation alone
is insufficient because this is primarily aimed at life
safety and protecting the environment. In addition,
incident consequences to other risk drivers should be
assessed.
This section expands on the key steps in the FEHM
procedure and outlines typical risk reduction options.
Finally, guidance is given on selecting appropriate
FEHM policies and implementing them.
3.2 FIRE SCENARIO ANALYSIS
This forms the first step of any risk-based FEHM
approach. Its purpose should be to identify fire
scenarios, and assess them in terms of incident
probability and consequences to build a picture of the
overall risks at an installation. Depending on these risks,
appropriate and justified FEHM strategies aimed at
reducing risk can be selected and implemented as part
of an overall FEHM policy.
The aim should be to recognise and select credible
fire scenarios on a site-specific basis. The scenarios that
should be considered are outlined in Section 2, and
include pool fires, jet fires, BLEVEs, VCEs, and flash
fires.
The first step should be to identify hazardous
substances and processes along with potential sources
of ignition. Scenarios should then be described and
potential consequences outlined.
As part of this, various scenario analysis tools may
be used to evaluate incident probability and
consequences. These can include:
— HAZAN/HAZID/HAZOP;
— QRA;
— event trees;
— fault trees;
— estimated maximum loss;
— risk matrices;
— industry databases;
— incident experience;
— fire and explosion modelling.
Use of these techniques can help to focus on the
probability of potential loss of containment events and
sources of ignition, as well as indicating the likely
consequences of an incident in terms of asset loss,
personnel safety, business interruption etc. Risk
matrices and QRA techniques are particularly useful
tools in assigning 'numerical' values of risk that can be
compared against risk criteria.

20
The types of generic fire scenarios that can occur at
various installations are well understood and are
described in 3.2.2.
3.2.1 Identification of major fire scenarios,
hazards and hazard characteristics
Typical fire and explosion scenarios are discussed in
section 2.5.
In addition to fire scenarios associated with
plant/storage areas, other fire hazards and events such
as cellulosic fires and electrical fires should be
identified for probability and consequences. External
fire sources that are not immediately obvious should
also be considered. These may include those initiated by
events such as tanker fires, collisions, vegetation fires,
etc.
Each identified hazardous event might result in a
range of possible scenarios. Usually, scenarios should
be selected that represent the most significant
consequences to personnel, production and the
environment. The most appropriate way is to carry out
a risk analysis aimed at identifying these, which also
takes incident probability and consequences into
account. Following this, it should be easier to select
credible design events meriting risk reduction options
and further, define the role of fire prevention and
protection systems in reducing risk.
In most cases, it will be impractical to consider
every possible scenario and a balance should be struck
between addressing larger, less frequent scenarios that
could cause more damaging consequences and smaller,
potentially more frequent events that could lead to
escalation or significant localised damage.
An example of a smaller, more frequent event
might be fire resulting from an ignited pump seal
release or a localised fire in an electrical cabinet – both
of which may have significant consequences in terms of
production continuity.
An example of a larger, less frequent event may be
a full surface tank fire or large bund fire causing
extensive damage with high consequences.
Consequently, recent risk-based legislation will
often be satisfied if a range of credible scenarios is
addressed as well as a smaller selection of larger, less
credible but nevertheless potentially high consequence
events.
In selecting and evaluatingscenarios,consideration
should be given to the following factors:
— installation design features;
— human factors (e.g. human error);
— failure modes;
— probability of failure/release;
— locations of releases/potential release points;
— fuel characteristics (density, flash point,
composition, ignition temperature, heat output
etc.);
— release characteristics (e.g. pressure, temperature
etc.);
— degree of isolation/quantity of isolated inventory;
— release size;
— probability of ignition;
— ignition location;
— mitigation measures;
— potential consequences (life safety, environment,
production).
A useful way of selecting scenarios is to draw up a list
of installations or plant areas and examine possible
generic fire or explosion events (e.g. pool fires) for
probability and consequences. In other words, the
question should be asked, "how probable is this
scenario, and what consequences will it have?" A range
of scenario analysis tools is available for this purpose
(see 3.2), but to assist, a list of typical scenarios for
various installations and areas is given in 3.2.2.
As well as the initial effects of fire or explosion,
consideration should be given to whether and how
escalation can occur and if this can affect personnel,
adjacent plant and the environment. Escalation might
also render fixed fire-fighting installations ineffective,
and this should be addressed as part of the scenario
analysis.
Escalation analysis can be carried out by using
event and/or fault tree methods, HAZOP, etc. Such
scenario analysis tools areusefulin identifying potential
escalation routes and failures, which might result in a
particular level of risk. By using such techniques,
additional risk reduction options can be identified to
reduce either probability or consequences.
Industrydatabases and incident experience can also
be used to estimate the probability of escalation from
given fire or explosion scenarios.
3.2.2 Typical scenarios for various installations/
areas
Scenario analysis tools (see 3.2) should be used to
define potential fire and/or explosion events.
It should be remembered that any fire incident is
possible; however, whether it is credible or not is a
decision that should be made based on incident
probability and through examination of potential
consequences.
Incident probabilities and consequences vary
depending on the nature of the event or installation, and
each scenario should be assessed on an individual basis.

FEHM PROCEDURE
21
For major petroleum fires to occur there would
need to be a loss of containment (i.e. a release or spill)
and a source of ignition. Process parameters such as
temperature and pressure as well as the size and nature
of any release will determine the type of fire or
explosion event anticipated.
The following sub-sections set out installations/
areas that should be assessed.
3.2.2.1 Process areas
In many process areas, flammable fluids are typically at
elevated temperatures and pressures. Releases may be
in the form of liquid sprays, or vapour jets depending on
these and other factors such as hole size, substance
composition, release location and point of ignition.
Also, releases from atmospheric plant could result in
product accumulation under vessels and other plant.
Scenario analysis should identify what type of event
could be expected.
Some examples of typical generic fire/explosion
events for process areas include:
— flammable or toxic product releases (liquid or
gaseous phase);
— VCE, e.g. as a result of delayed ignition of
flammable vapour;
— pool fires, e.g. because of an ignited flammable
liquid spill;
— spray fires, e.g. from a pressurised flammable
liquid release;
— jet fires, e.g. ignition of a pressurised vapour
release.
Remote product pumps and manifolds are also potential
sites for the above, and should be included in any
analysis. In all cases, consequence modelling can assist
in estimating the size and composition of releases as
well as their consequences (e.g. flame lengths, pool size
and flammable regions).
3.2.2.2 Atmospheric storage tanks
The types of scenario for atmospheric storage tanks are
well understood. The type of event depends to a large
degree on tank construction, safety features, product
volatility and potential for loss of containment. Typical
fire scenarios that should be considered include, for
particular tank types:
— vent fires (fixed roof tanks or internal floating roof
tanks);
— vapour space explosion (fixed roof tanks);
— contained and uncontained spill fires;
— rim seal fires (open-top floating roof tanks);
— pontoon explosion (open-top floating roof tanks);
— spill-on-roof fires (open-top floating roof tanks);
— full surface fires (fixed, internal and open-top
floating roof tanks).
These events are also discussed in section 2.5.
Incident probabilities and escalation routes for
these events are well-documented in industry databases
such as RPI LASTFIRE. (In most cases, large events
such as full surface fires result from an initiating fire
such as a spill-on-roof fire or vapour space explosion).
As well as bulk storage areas (tank farms) there
may be external areas for petroleum storage in
intermediate bulk containers (IBCs). For guidance on
safe storage, reference should be made to HSE The
storage of flammable liquids in containers or
equivalent.
3.2.2.3 Pressurised storage tanks
The types of scenarios associated with spheres or bullets
containing pressurised LPG that should be considered
include:
— combined jet/pool fire;
— vent fire, e.g. from ignition of LPG released from
a pressure relief valve (PRV);
— jet fire, e.g. resulting from ignition of a release
from valves or pipework;
— BLEVE.
In some cases, a pool fire will result from an initial jet
fire if the tank is depressurised (due to product burn-off
or emergency shutdown (ESD)). The most likely sites
for jet fires would normally be from associated
pipework or valves. BLEVE is a potentially high
consequence event that should not be overlooked (see
section 2.3.3.3).
3.2.2.4 Road tanker vehicle and rail tank wagon
loading areas
Road tanker vehicle and rail tank wagon loading areas
often handle a wide variety of flammable substances
ranging from LPGs and hydrogen to bitumens, as well
as process intermediates and other refined products.
Product transfers through loading and unloadingarmsor
hoses are potentially hazardous operations. Most fire
events occur through ignition of accidental product loss
of containment due to breakout of hoses and couplings,
etc.
In such cases, a pool fire could occur if the spill is
ignited. Also, liquefied gases or other very volatile
products may ignite close to the source of release and
cause a flash fire or jet fire.
BLEVE should also be considered as a possibility
if a prolonged pool or jet fire is likely close to, or under

22
road tanker vehicles and rail wagon tanks containing
liquefied gases and other high-energy products.
3.2.2.5 Jetties
As well as spill fires resulting from accidental releases
of product from loading or unloading arms, ship fire
incidents should also be considered, since they may
threaten jetties. A VCE is also a possibility in areas of
confinement or semi-confinement, particularly where
large releases of liquefied gases are considered as a
potential scenario.
In addition, flash fires and/or spill fires can result at
jetty 'roots' around product pipelines, especially if there
is potential for loss of containment around motorised
valves.
3.2.2.6 Electrical/switchgearfacilitiesandsubstations
Petroleum installations invariably include critical
switchgear, electrical installations, substations/
transformers and associated cabling. Some of these may
utilise oil-filled equipment and the risk of pool fires
should be examined. For electrical installations, fires
can originate from faulty equipment. Initially, fires may
smoulder and go unnoticed if appropriate fire detection
is not installed.
Fires can also occur within computing facilities,
motor control centres (MCCs) and other critical
enclosures. They can originate from the equipment
themselves, mechanical media, or auxiliary equipment
such as air conditioning units or cooling systems. Such
fires may only cause localised damage but could have
an effect on production continuity and data integrity.
3.2.2.7 Turbine enclosures
Turbine enclosures may utilise flammable substances
such as oil, hydraulic fluids and fuel gas. They generally
consist of the following areas and potential fire
scenarios:
— control compartment – electrical fires;
— auxiliary compartment – liquid jet, gas jet and
electrical fires;
— turbine compartment – liquid jet, gas jet and
electrical fires, short duration gas explosion;
— generator – deep-seated electrical fires.
Each of these potential fire incidents should be
reviewed as part of a risk analysis.
3.2.2.8 Buildings
Support buildings and offices are also potential fire
locations and credible fire scenarios should be
addressed. Fires including cellulosic (i.e. ordinarily
combustible materials) as well as flammable liquids and
gases should be examined. Some examples of potential
fire locations can include:
— control rooms;
— laboratories;
— warehouses/ storage areas;
— workshops;
— pump houses;
— generator enclosures;
— administration buildings;
— accommodation.
Where appropriate, factors such as the fire load,
presence of flammable gases and liquids and hazardous
processes such as hot work, should be taken into
account to determine fire scenarios.
Fires in storage areas containing bulk storage of
flammable liquids in IBCs should also be considered.
Tests have demonstrated that when ignited (e.g. by oil-
soaked rags or paper under IBC valves) containers can
melt dramatically in a matter of seconds and pool fires
can spread over a large area. Similarly, idle pallet
storage in these areas can represent a significant fire
hazard.
3.2.3 Design/credible scenario selection
Credible scenarios that are selected from risk
assessments as meriting further risk reduction options
because of their probability or consequences can be
termed 'design events'. This is illustrated in Figure 3.1
where design events can consist of one or more
prevention, control and mitigation measures for
identified fire hazards and scenarios.
As part of this process the role of prevention,
control and mitigation measures, including those of fire
prevention and protection systems should be identified.
For further guidance, see section 8.9.3. For example, the
role of a gaseous fire protection system might be to
control or extinguish a deep-seated electrical fire within
an enclosure.
The selection of appropriate design events varies
between installations butthe followingfactors should be
considered:
— Whether to include risk reduction for less frequent,
catastrophic events.
— Whether risk reduction is appropriate.
— What ESD time should be used.
— Whether the fire/explosion characteristics merit
risk reduction.
— What other emergency response measures can be
implemented.

FEHM PROCEDURE
23
Fire hazard
identification
Fire type Consequences
Fire size Duration
Probabilities
Identify prevention,
control and mitigation
measures
Define system role
and develop performance
specification
Design events
Fire products
Figure 3.1: Design/credible scenario selection
In some cases, CBA should be applied to determine
whether to design and implement risk reduction options.
For example, it might be shown that the annual
statistical costs associated with an incident far exceed
the amortised costs of implementing a particular risk
reduction option. This is explained further in 3.3.
A particularly effective way of selecting
appropriate design events is to use a risk matrix
approach in which potential scenarios are superimposed
on a grid. Both incident probability/frequency and
consequences can be assigned numerical values to
obtain an overall risk 'score'. Risk reduction measures
can then be considered for incidents above a certain
threshold and incident strategies can be developed.
An example of a risk matrix (used in the
exploration and production sector) is shown in
Figure 3.2. Such a matrix can be easily adapted for use
at petroleum refineries and bulk storage installations.
Figure 3.2: Scenario risk matrix
Strategy 1 - Minor incident intervention only
Strategy 2 - Dedicated fixed fire protection systems
Strategy 3 - Systems/equipment plus back-up
Strategy 4 - Systems/equipment plus fire brigade
}
}
Either strategy dependent on facility location
Either strategy dependent on facility location
Appropriate strategies for incidents
CONSEQUENCES INCREASING PROBABILITY
Life
safety
Environ-
ment
Business Asset Reput-
ation
Has occurred
in petroleum
industy
Has occurred
in-house
Happens
several times
per year
in-house
Happens
several times
per year at
location
Slight
injury
Minor
injury
Major
injury
Slight
effect
Minor
effect
Localised
effect
Slight
effect
Minor
local
effect
Major
local
effect
Slight
damage
Minor
damage
Localised
damage
-
Slight
impact
Limited
impact
Consid-
erable
impact
Incident listing
Small incidents
Pump seal
Compressor incident
Turbine enclosure
Vessel incident
Cone roof tank
Floating roof tank
Aircraft incident
Buildings incident
1
2
3
4
5
6
7
8
9
1
Key
8 Incident number
875
32
4 6
64
72
9
Single
fatality
Multiple
fatality
Major
effect
Massive
effect
Major
damage
National
impact
Massive
effect
Total
extended
effect
Extensive
damage
Intern-
ational
impact
INCREASINGCONSEQUENCES

24
In Figure 3.2, credible scenarios are identified and
appropriate strategies are matched to incident risk.
Thus, high-risk events might merit fire-fighting systems
and possibly fire brigade intervention. Events that are
considered lower risk (top left of the matrix) might
benefit from minor intervention only (e.g. using
portable fire-fighting equipment).
Decisions on which risk reduction measures are to
be implemented should therefore be based on the actual
risk. Having made the decisions, publications (codes of
practice, design standards, specifications, guidance,
etc.) on fire protection system design can be used to
give guidance on implementation.
Also, once appropriate risk reduction measures
have been identified (see 3.3) good fire engineering
judgement and practices should be applied for design
and implementation. As part of this, a framework of
FSIA should be adopted (see 3.5.2).
3.2.4 Fire and explosion modelling
Typical approaches to fire and explosion modelling are
described in section 2.7.
It should be noted that modelling can only give an
approximate indication of the likely consequences of a
particular fire or explosion scenario. It should never be
used to 'predict' the effects of an incident with certainty.
Although modelling techniques are now very advanced,
interpretation requires great skill and care.
Consequently, the results should be used as 'guidance'
to assist in developing appropriate response strategies
(i.e. as a tool to help decide policies, rather than to
decide them alone).
3.3 RISK REDUCTION OPTIONS
Fire and explosion risk reduction can be achieved in
many ways:
— elimination or substitution of fire and explosion
hazards;
— fire and explosion prevention measures;
— fire and flammable gas detection;
— emergency shutdown;
— PFP;
— active fire protection systems;
— salvage.
This is illustrated in Figure 3.3.
Figure 3.3: FEHM risk reduction options
Mobile equipment
Hazard elimination
Training
Process
design/control
Plant layout
Inventory control
Area classification
Escape routes
Salvage
Plant maintenance
Operating practice
Process sparing
Spillage
control
Insurance
Process reinstatement Mutual aid
Contingency planning
Fire protection
systems
Fire brigade
First-aid fire equipment
Access control
Emergency shutdown
Alarm systems
Hazard substitution
Ignition source
control
Passive
protection
Fire and gas
detection
FEHM

FEHM PROCEDURE
25
The approach should be to consider risk reduction
options in the following order of importance:
— fire prevention;
— fire and flammable gas detection;
— active fire protection and PFP measures;
— fire response requirements.
Regardless of the method(s) of risk reduction employed,
it is vital to assess each in terms of its contribution to
overall FEHM.
Guidance is given on the most common risk
reduction options in this publication. To locate the
appropriate section, see Table 3.1. However, for clarity
the following general measures should be addressed:
— inventory control;
— site layout to minimise fire consequences;
— flammable and combustible product control and
containment;
— safe working practices and procedures including
ignition source control;
— fire and flammable gas detection measures;
— alarm systems and communications;
— escape and evacuation arrangements;
— fire control and extinguishment (fixed, semi-fixed
or mobile systems);
— emergency procedures and plans;
— pre-fire planning;
— fire response training.
Alternative prevention, protection and mitigation
measures should be evaluated. The most appropriate
way of achieving this is to adopt a scenario worksheet
approach in which scenarios are identified, current risk
reduction measures are outlined and potential risk
reduction measures are evaluated for appropriateness
and effectiveness. As part of this, necessary resources
(i.e. prevention, protection and fire response measures)
should be listed.
Table 3.1: Risk reduction options guidance
Risk reduction option Section
Fire prevention measures
— Control of flammable substances
— Atmospheric monitoring
— Control of sources of ignition
— Permit-to-work systems
— Maintenance practices
— Housekeeping
— Site layout
— Buildings fire precautions
4.2
4.3
4.4
4.5
4.6
4.7
4.8
4.9
Flammable gas detection 5.2.1
Fire detection 5.2.2
Passive fire protection – Options, applications and design issues 6.2
Active fire protection
Extinguishing media
— Water
— Foam
— Dry powder (dry chemical)
— Gaseous agents
— Fixed systems – Options, applications and design issues
— Water spray systems
— Fixed monitors
— Sprinkler systems
— Water mist systems
— Foam systems
— Dry powder (dry chemical) systems
— Gaseous systems
Fire equipment
— Portable and mobile fire-fighting equipment
6.3
6.4
6.4.2
6.4.3
6.4.4
6.4.5
6.5
6.5.2
6.5.3
6.5.4
6.5.5
6.5.6
6.5.7
6.5.8
7.6
7.6.1

26
Any identified FEHM shortfalls should also be
identified, and risk reduction measures considered to
correct these.
Risk reduction measures should aim to reduce
either probability or consequences, or both:
Risk = probability x consequences
Reduced probability or consequences 6 reduced risk
CBA is one way of justifying a particular risk reduction
option (or options) in line with ALARP-type principles.
See HSE Reducing risks, protecting people. A risk
reduction measure is cost beneficial if the cost of the
following quantitative relationship applies:
{(Cwithout x (without) - (Cwith x (with)} x Prcontrol > Cost of implementation
where:
Cwithout is expected cost of incident without option in
place;
Cwith is expected cost of incident with option in
place;
(without is expected statistical frequency of the
initiating event if option is not implemented;
(with is expected statistical frequency of the
initiating event if option is implemented;
Prcontrol is probability that option will perform as
required.
3.4 FEHM POLICY
As every installation operates in its own particular
environment, the optimum, cost-effective incident
consequence reduction strategy/policy should be
developed taking into account local conditions, the
installation’scriticalityandanincident’spotentialeffect
on life safety, the environment, assets, continued
operations and company reputation.
Previously, fire protection practices used in major
hazards industries have been very prescriptive in
approach and were not based on the real needs of a
particular installation. However, due to major incident
experience, legislators/regulators, such as NFPA (USA)
and HSE, require goal-setting performance-based
standards within a safety report. Consequently,
requirements for cost effective fire protection resources
should be assessed and justified based on credible major
incident scenarios.
Essentially, if both parties adopt risk-based
approaches to FEHM then there should be no conflict.
Policies based on meeting legislation alone are not
necessarily appropriate or sufficient.
As noted in section 1.7, a number of drivers should
be taken into account when developing appropriate
FEHM policies. These include life safety and the
environment, as well as asset loss, business interruption
and reputation.
Most companies adopt a policy somewhere in
between providing 'total protection' policy and adopting
a 'burndown' policy; see Figure 3.4.
Thus, the overall aim should be to establish, in an
auditable way, a formal, site-specific justified and cost
effective fire and explosion damage mitigation policy
appropriate to the criticality and overall needs of the
installation.
The most appropriate way to achieve this is to use
fire and explosion scenario analysis. Following this,
appropriate and justified risk reduction measures can be
adopted and implemented.
Figure 3.4: FEHM policy options
Burndown
policy
No damage mitigation
measures
Full automatic shutdown.
Comprehensive passive protection.
Sophisticated automatic fire and gas
detection/protection systems.
Full portable/mobile equipment
back-up.
In practice, most facilities
will adopt a policy
somewhere between the
two extremes
FEHM policy Total
protection
policy

FEHM PROCEDURE
27
Of course, many publications (codes of practice,
design standards, specifications, guidance, etc.) are
available and these should be used where appropriate to
assist in implementing risk reduction options
appropriate to the FEHM policy.
In many cases, protection over and above the
requirements of these documents may be required. If
this is the case, all assumptions and design philosophies
should be stated.
Once a policy has been decided and appropriate
risk reduction measures (see 3.3) have been
implemented, the policy should be maintained through
relevant practices and procedures, system testing and
maintenance, preplanning etc. For more guidance, see
Section 8.
3.5 IMPLEMENTATION
To effectively implement FEHM policy as part of a
SHEMS, the following issues should be addressed:
— practices and procedures;
— FSIA:
- inspection and testing of fire systems;
— emergency response preplanning:
- fire response training;
- fire response exercises;
— competency development;
— monitoring.
3.5.1 Practices and procedures
This refers to various aspects of FEHM such as:
— continuing hazard identification, assessment and
control;
— incident and near-miss reporting;
— safe operating procedures and working practices;
— safety induction;
— control of sources of ignition;
— PTW systems;
— protective clothing;
— pre-planned maintenance (PPM).
Guidance on some of these issues is given in Section 4.
3.5.2 Fire systems integrity assurance
FSIA is a structured approach aimed at ensuring the
implementation of test, inspection and maintenance
procedures for fire systems. For guidance, see
section 8.9.3.
3.5.3 Inspection and testing of fire systems
Test procedures should be based on ensuring that
critical performance criteria defined at the design stage
are met, and maintenance schedules on ensuring that
any system problems should be quickly identified.
When defining schedules and procedures, the reliability
of system components and the levels of risk reduction
that the system is designed to provide should be
considered. For example, a system that is critical to life
safety may require a more rigorous testing regime than
a similar system designed purely for asset protection.
Any system testing should be relevant to the role of
the system and either a direct measure of functional
performance criteria or a measurement of a parameter
that demonstrates that the functional performance can
be achieved.
If appropriate schedules and procedures are unable
to be drawn up, then guidance should be sought from
manufacturers’ recommendations and recognised
publications (codes of practice, design standards,
specifications, guidance, etc.) (see annex I.3). For
guidance on inspection and maintenance of fire
equipment, see section 7.6.3.
3.5.4 Fire response preplanning
The only way that fire incidents can be handled safely
and effectively is to ensure a formalised and justified
strategy that everybody involved understands is in
place, preplans are available to remind personnel of
their role and exercises are carried out to test the
preplans and ensure that they are workable and relevant.
Even if the FEHM policy is burndown, an appropriate
ERP should be developed to formalise it.
Strategic incident preplans should be developed
addressing non-fire response issues such as production
continuity, media reporting, human resources and other
aspects of incident management. For further guidance,
see section 8.3.
The implementation of risk-based legislation (e.g.
under the Seveso II Directive) specifically requires duty
holders to demonstrate emergency preparedness and to
develop, maintain and exercise pre-fire plans for major
incidents. These should serve as training aids for fire
responders, enabling desktop and practical exercise
response performance to be measured. For further
guidance, see section 8.7.
Pre-fire plans should be supported by scenario-
specific ERPs (see section 8.8) that provide instant
written instructions, guidance and helpful information
for operators and fire-fighters to assist them at the
critical early stage of a major incident ‘on the ground’.
In addition, they should provide sufficient potential

28
hazard information to enable informed decisions to be
taken regarding the safety of personnel responding to
the incident. As part of this, regular exercises and
responder competencies should be implemented. For
further guidance, see section 8.9.1.
Preplanning is only of value if the equipment that
is going to be used in the fire response is well-
maintained and the ERPs are exercised regularly to
check that they are workable and that those involved are
competent and aware of their role in a real incident.
3.5.5 Competency development
As well as fire responder competencies, personnel
involved with the upkeep of fire and other safety
systems as well as plant maintenance should undergo
regular review and assessment. This should be aimed at
ensuring that personnel have the necessary skills to
work safely and contribute to continuing safety. For
further guidance, see section 8.6.
3.5.6 Monitoring
Monitoring processes should be implemented as part of
a management of change approach to ensure that:
— Incidents and near misses are recorded and
reviewed.
— Fire systems maintenance practices and testing
procedures are reviewed for effectiveness.
— Personnel training and competencies are kept up-
to-date.
— Fire risk assessments are periodically recorded and
reviewed.
— Risk reduction measures are reviewed for
continuing effectiveness.
— Practices and procedures are updated or revised
where necessary.
— Fire response training is regularly reviewed.
— Safety education and training are effectively
implemented and updated.
— Safe working practices are followed.

29
4
FIRE PREVENTION
4.1 INTRODUCTION
This section describes several means of hazard
avoidance that aim to prevent unplanned releases and
avoid their ignition.
Fire prevention can be considered as the first step
in effective FEHM; it includes many aspects of
installation design, operation, inspection and
maintenance aimed at avoiding fire and explosion by
preventing accidental releases and avoiding ignition.
Duty holders should in the first instance minimise
the probability of fire or explosion before considering
other risk reduction options such as fire and flammable
gas detection and passive or active fire protection
systems.
This can be achieved with the following
preventative measures:
— control of flammable substances (and other
combustible materials);
— atmospheric monitoring (e.g. flammable gas
detection);
— control of sources of ignition (e.g. through
hazardous area classification);
— controlling hazardous work (e.g. PTW systems);
— using well-designed maintenance schedules and
procedures;
— good housekeeping to minimise fire hazards;
— effective site layout to minimise fire risks and
escalation potential;
— buildings fire risk assessment and fire prevention.
4.2 CONTROL OF FLAMMABLE
SUBSTANCES
4.2.1 General principles
The petroleum industry handles a wide range of
products derived from crude oil that are processed in
downstream units; they range from LPGs and hydrogen
to bitumens, as well as process intermediates and other
refined products. If released at storage or processing
conditions these streams behave differently, forming
gases, sprays or pools of liquid. They may freeze or
spontaneously ignite and the vapours may rise or form
dense, low-lying clouds. Additionally, releases may be
acutely toxic if they contain hydrogen sulphide.
Duty holders should be familiar with the properties
of the substances they handle. In addition, they should
know immediately of losses of containment so that they
can activate the appropriate ERP.
4.2.2 Liquid releases
Many potential releases (e.g. from leaking valves or
pipe joints) can be eliminated by good operational and
maintenance practices; however, small liquid leaks and
discharges can sometimes occur during normal plant
operation (e.g. from manual and continuous analyser
sampling). Wherever possible, releases should be
contained at source and either returned to the plant or to
a closed system. Liquid leaks should be collected and
removed safely. Secondary containment can be used to
prevent petroleum liquid carry-over to other areas, or to
direct larger spills to a safe area, and prevent fire spread

30
in the event of ignition.
4.2.3 Flammable atmospheres
Flammable atmospheres are often present at petroleum
refineries or bulk storage installations. Small quantities
of vapour may exist during routine operations, in the
vicinity of loadingandunloading operations, or released
from vents (e.g. as a result of the normal, daily
'breathing cycle' of a tank).
Prevention measures should be implemented where
applicable to minimise vapour releases to atmosphere.
These may include:
— inerting;
— vapour recovery;
— closed system design and/or avoiding open system
design;
— prompt maintenance;
— venting.
In many cases, environmental requirements should
minimise emissions; for example, by using primary and
secondary seals in the rim seal areas of floating roof
tanks.
Flammable atmospheres can also arise as a result of
accidental spills, loss of containment resulting from
failure of vessels or pipework, operator error, or simply
because flammable concentrations of vapour are
expected to occur in certain areas from time to time.
Flammable atmospheres can also be formed within
a nominally empty tank due to residual product adhering
to the tank walls and the roof underside. Vapours
emitted present a fire and/or explosion risk, particularly
during filling or tank cleaning operations.
4.2.4 Isolation/depressurisation
The amount of fuel involved in a release can be
minimised by plant isolation and depressurisation. This
should reduce the probability of a large fire and should
also reduce fire duration and consequences in the event
of ignition.
Vesselsand equipment containing large inventories
of flammable substances should be equipped with
isolation valves that are accessible in emergency
conditions. Valves to relief systems should normally be
locked open. However, due to radiation from fires, it
may not always be possible to operate valves manually
and automatic 'fire safe' isolation valves should be
provided, or otherwise the valve(s) should be situated
outside any potential fire area.
Remote operation for larger valves should be given
consideration, especially if access during an emergency
would be hazardous. Remotely operated valves used for
isolation of flammable substances and the associated
power supply lines should be fitted with PFP if they are
in the potential fire zone near to the protected
equipment. The valves should be routinely tested, on-
line if practicable, or as part of shut down and start-up
procedures, and their use should be included or
simulated in emergency exercises (see HSE Emergency
isolation of process plant in the chemical industry).
Draining and depressurising valves should be
provided for clearing material from a system when
normal process lines cannot be used. They should be
routed to a recovery system or flare rather than to
atmosphere or ground.
4.2.5 Flammable gas/vapour dispersion
The aim of gas dispersion is to reduce the concentration
of any flammable gas to below the LFL as quickly as
possible and within the shortest distance from the leak.
This can be achieved by using fixed water sprays,
monitors or fan spray nozzles positioned to aid the
dispersion of gas into the atmosphere and divert it away
from fixed sources of ignition in plant areas.
If provided for gas dispersion, fixed sprays and
monitors should be located where experience has shown
there is the greatest probability of serious releases. For
deployment techniques, see section 7.2.1.3 and
section 7.6.1.9, respectively.
NB: Adequate collection, drainage and oil/water
separatorfacilities shouldbe providedforwaterused for
gas dispersion purposes. Also, gas releases may be
accompanied by flammable liquid and this too should be
managed.
4.3 ATMOSPHERIC MONITORING
Installations processing flammable gases or liquids
where there is a possibility of a loss of containment
producing a flammable atmosphere, may require
flammable gas detectors to give advance warning of a
developing hazard. This is especially applicable to
installations that have a small operational staff and
where large sections are virtually unstaffed or staffed
only during daytime working hours.
A scenario-based review of potential gas release
incidents should be carried out, preferably with the use
of dispersion modelling. Appropriate flammable gas
detectors may be selected to detect foreseeable releases.
The purpose of flammable gas detection should be to
give enough warning of potentially hazardous gas
concentrations in plant and building areas. Detection
should be set to alarm at a point well before the LFL is

FIRE PREVENTION
31
reached – typically < 20% LFL. Flammable gas
detectors can be used to perform executive actions such
as plant shutdown, isolation or damper activation to
prevent ingress of flammable atmospheres into
buildings.
When selecting flammable gas detectors, units
should be chosen that are stable and reliable in the
particular environment of the plant. Most flammable gas
detectors include 'reference sensors' that are able to
recognise potentially spurious alarm sources such as
fog, dust, humidity, etc.
4.4 CONTROL OF SOURCES OF IGNITION
4.4.1 General
Control of sources of ignition refers to the practices and
procedures necessary that aim to prevent accidental
ignition of petroleum and its products.
Potential sources of ignition include:
— naked flames;
— welding and cutting equipment;
— smoking;
— friction and sparks generated by equipment and/or
vehicles;
— thermite sparks;
— electrical lighting;
— electrical equipment not suitably certified for use in
a hazardous area;
— hot surfaces;
— radio equipment/ mobile telephones;
— static electricity;
— incandescent particles;
— pyrophoric scale/deposits (e.g. in crude oil/
bitumen tanks);
— flares;
— external sources.
One or more of the above sources can ignite
combustible solids, flammable liquids and flammable
atmospheres.
To control ignition risks, the following precautions
should be adopted:
— Controlling hot work and grinding through PTW
procedures (see 4.5).
— Declaring hazardous areas (see IP Area
classification code for installations handling
flammable fluids).
— Prohibiting smoking, except in designated 'safe'
areas.
— Vehicular restrictions, where practicable.
— Prohibiting non-certified electrical, electronic and
mechanical equipment.
— Wearing of anti-static PPE (e.g. clothing and
footwear).
— Following anti-static procedures when
loading/unloading.
The above controls are usually only necessary within
ignition source control areas. However, when applied
across an installation they can help to reinforce good
FEHM as part of a SHEMS or overall safety culture.
Control of sources of ignition should be reinforced
regularly with the help of signage, and for visitors and
contractors incorporated within a site induction process.
4.4.2 Static electricity
Static electricity is generated when relative movement
results in charge separation and accumulation on
different parts of plant or liquid surfaces. If the plant is
not earthed or if the liquid has a low electrical
conductivity the charges may accumulate more quickly
than they can dissipate and cause an electrical discharge
to adjacent equipment in the form of a spark. With
sufficient energy this could ignite a flammable
atmosphere, depending on the ignition energy of the gas
or vapour concerned.
Static electricity is undoubtedly a major source of
ignition, particularly during tanker loading/unloading,
product transfer and gauging operations. For static
electricity to cause fire or explosion, four conditions
need to be met:
— A means of static generation.
— A means of accumulating charge and maintaining
a potential difference.
— A spark with sufficient energy.
— A spark in a flammable atmosphere.
Operations and process conditions susceptible to static
electricity generation in the petroleum industry include:
— High velocity and turbulent mixing e.g. in
pipelines, at the discharge of jets fromnozzles, tank
mixing, etc.
— Filtration, particularlythroughmicroporeelements,
with a large surface area exposed to fluid flow.
— Liquid droplets or foam falling through a vapour,
e.g. spray or mist formation in vapour spaces.
— Splash filling of tanks or tankers.
— Application of fire-fighting foam to an exposed
fuel.
— Settling of water droplets through petroleum

32
liquids, e.g. in tankage.
— Bubbling of gas or air through petroleum liquids.
— Water jetting in tank cleaning.
— Movements of belts and sheets of material over
pulleys and rollers.
— Movement of vehicles, fans, persons etc.
— Movement or transport of powders.
— Release of steam to the atmosphere.
Anti-static precautions can include:
— Earthing and bonding.
— Using anti-static additives.
— Reducing flow velocities.
— Avoiding splash filling.
— Restricting tank sampling.
— Wearing anti-static PPE, e.g. clothing and
footwear, which should be regularly tested.
All persons involved in process, maintenance or fire-
fightingoperationsshould have a basic understanding of
static electricity as it affects their own work. For further
guidance, see IP Guidelines for the control of hazards
arising from static electricity.
4.4.3 Lightning
In recent years, a number of proprietary lightning
protection systems have become available. However,
there are no internationally recognised publications
(codes of practice, design standards, specifications,
guidance, etc.) clearly defining design parameters and
efficiency of such systems for use at petroleum
installations.
Standards such as NFPA 780 and others, which
deal with the installation of lightning protection
systems, generally make no specific attempt to define
applicability of proprietary systems, other than
recognising that tanks should be suitably grounded.
These precautions may be necessary to conduct away
the current of direct lightning strikes, and to avoid the
build-up and potential that can cause sparks to ground.
4.5 PERMIT-TO-WORK SYSTEMS
Legislation and good practice require duty holders to
ensure safe working practices are carried out during
maintenance, repair and hazardous operations.
The probability of fire incidents can be increased
when personnel (including staff, contractors and
delivery drivers) have little knowledge of the hazards
associatedwithpetroleumproducts, and if correct safety
procedures are not carried out. For this reason,
personnel should be competent in the correct use of
PTW systems through regular training and refresher
training.
PTWs should ensure that:
— All hazards are identified. (Personnel should be
trained to recognise the physical properties and
fire-related hazards of flammable substances, and
to ensure that the activity to be carried out does not
introduce any new hazards to the area without
appropriate precautions being taken.)
— Correct precautions and safety equipment,
including appropriate PPE, are used.
— Clear and adequate instructions are given to all
personnel relating to the work/equipment
concerned.
— Conflicts between interacting operations are
avoided and there is clear authorisation and
communication regarding potentially hazardous
tasks.
Permits should typically cover:
— Personnel entry into special areas.
— Testing, maintenance or repair work on plant and
equipment including equipment disjointing,
electrical isolation, etc.
— Personnel entry into confined spaces (e.g. tanks,
vessels, sewers, excavations, etc.).
— Vehicle entry into plant or storage areas.
— Introduction into plant or storage areas of naked
flames or other sources of ignition (e.g. use of
burning, welding, brazing, grinding, grit blasting,
pneumatic drilling and non-certified electrical and
battery powered tools and equipment).
— Excavation work.
— Use of particularly hazardous substances (e.g.
radiation sources).
— Precautions associated with inert gas for fire
protection.
— Installation and operation of non-standard,
temporary, process equipment or bypassing of
equipment.
Further guidance can be found in HSE Guidance on
permit-to-work systems.
4.6 MAINTENANCE PRACTICES
4.6.1 General
Many maintenance practices can be potentially
hazardous and require fire prevention to be considered

FIRE PREVENTION
33
by management and operators prior to, during and
following the work. Such maintenance activities should
be subject to a PTW system (see 4.5).
For example, breaking containment can lead to
releases of flammable gases or liquids, whilst sparks are
often generated during hot work practices such as
grinding or welding, increasing the chance of ignition.
Other maintenance practices, particularly on safety
and fire protection equipment, require systems to be
temporarilydisabled.Thiscouldincreasetheprobability
of fire occurring or potential consequences should a fire
develop. Such maintenance activities should also be
subject to a PTW system (see 4.5).
Before maintenance work can be carried out,
personnel should plan thoroughly. Process knowledge,
approvals from operations personnel and hazard
awareness should be in place. Safety and Fire Officers
should be consulted during the planning phase of a
major turnaround.
At the design stage, plant areas should be laid out
to enable safe access and working. Special areas or
buildings for maintenance work should be provided.
These areas should be a suitable distance away from
possible sources of hazard arising from the plant.
Materials and supplies should be safely stacked and
stored. Personnel issuing and checking them should
ensure they are kept in their proper location. Where
mixed goods are stored, combustible materials should
be alternated with non-combustible items (other than
oxidising agents) where practicable, in order to prevent
extensive fire spread. Also, tools, accessories and
equipment should be safely stored in cabinets, racks or
suitable containers. Work areas and work benches
should be kept clear and clean.
Handling of waste should be given special
consideration. Waste and rubbish containers should be
provided in appropriate locations, and emptied
regularly. Clean rags and waste should be stored in
metal containers. Oily rags should be placed in self-
closing or covered metal containers and emptied at the
end of every shift. Combustible material should be
properly disposed of and stored in appropriate
containers. Plant areas and out of the way places should
be kept clean, well lit and free from waste material.
Flammable liquids in small quantities should be
kept in dedicated containers (e.g. made of materials that
are impact resistant and compatible with the fluid), and
kept in a suitable fire resisting cabinet. Larger quantities
should be stored in purpose-built stores, labelled as
hazardous, in a safe area away from buildings.
4.6.2 Hot work
Hot work is any activity which may involve, or have the
potential to generate sufficient heat, sparks or flame to
cause a fire. Hot work includes welding, flame cutting,
soldering, brazing, grinding and using disc cutters and
other similar equipment.
Before such work commences, suitable fire
extinguishers should be available (see sections 7.6.1.1-
7.6.1.5). Operators should be competent to use them,
and in hazardous areas, standby fire-fighting personnel
should be considered. Adequate precautions should be
taken to prevent flame, sparks or hot metal from starting
fires in adjacent materials, at lower levels or the
surrounding area in open plant. For example, the area
could be wetted and drains covered, or vents protected
where vapours could escape to the atmosphere. The
atmosphere should be regularly monitored to check the
safety of the operation. Where necessary, the
requirement for such checks should be written into the
permit.
4.6.3 Electrical equipment used for maintenance
Portable electrical equipment such as power tools,
lighting and test equipment, associated cables, plugs,
sockets etc., and temporary installations for
maintenance purposes, should conform to the
requirements of IP Electrical safety code. Their use
should be subject to PTW procedures and examination
by a competent person. Equipment not meeting these
requirements should be used only under hot work PTW
procedures.
Particular care should be paid to the condition of
equipment, cables, connections etc. to minimise the risk
to personnel and the possibility of fire.
Portable pneumatic or hydraulic powered tools,
though generally considered safe from the viewpoint of
power supply, may produce sparks due to their
application. They should therefore be subject to hot
work PTW procedures when used in hazardous areas.
4.6.4 Hand tools
The use of 'non-sparking' tools is not recommended in
petroleum installations; such tools are misnamed
because they can sometimes produce sparks on impact.
As they are made of relatively soft metal, particles of
harder spark producing materials can become
embedded. They also have a low mechanical strength.
When tools or equipment are used in a hazardous
area, then hot work PTW procedures should be
followed. Consideration should also be given to
covering the ground or surface below the work to
prevent sparks due to possible impact. The equipment
and the area should be wetted to prevent and quench
sparks.

34
4.6.5 Chemical cleaning
Chemical cleaning is used when mechanical means are
either unsatisfactory or impracticable. The substances
used may be inhibited acids, alkalis or proprietary
products formulated for a particular cleaning operation.
Many solvents may be flammable liquids. A
temperature approaching the boiling point of water may
be necessary in some cases.
Chemical cleaning can lead to the evolution of
flammable and/or toxic gases or vapours, for example
whenremovingscale-containingsulphides. Appropriate
precautions should be taken for the safe disposal of such
gases, not only from the equipment being cleaned but
also from any temporary surge tank and pipework.
Operators should also wear appropriate PPE. Drains are
required on each piece of equipment and at all high and
low points on associated pipework in the loop.
4.6.6 High pressure water
High pressure water jetting is commonly used for
cleaning purposes. In addition to the dangers of water
impact there is a risk of electrostatic charges being
developed which are potentially dangerous in the
presence of flammable mists that can be generated by
water jetting. See 4.4.2.
4.7 HOUSEKEEPING
Good housekeeping should include the following
precautions:
— Maintaining indoor and outdoor plant areas in an
orderly condition free from fire and other hazards.
— Minimising combustible materials and wastes.
— Storing flammable liquids and flammable/
combustible waste in closed, non combustible
containers.
— Safely disposing of flammable and combustible
wastes at frequent intervals.
— Segregating empty and full or part full flammable
liquid or gas containers.
— Storing flammable liquids and gases outdoors in
dedicated areas.
Plant areas should be kept in a clean and tidy condition.
Releases of petroleum, its products and other process
fluids should be prevented where practicable. ERPs
including spill control measures should be in place to
activate assistance in the event of a significant release
posing a fire (or consequential environmental risk).
Particular attention should be paid where leakages
saturate insulation on hot or traced line systems or
tanks, since spontaneous ignition can occur. Minor, low
hazard leaks of substances such as waxes, oils,
bitumens, etc. should be collected in drip trays and the
cause should be remedied as soon as possible.
Access-ways and roads should be kept free from
obstruction and maintenance materials should be
removed promptly after completion of work. Items
forming a temporary obstruction should be clearly
marked as a hazard and brought to the attention of
process supervisors and operators. Close attention
should be paid to the condition of cladding and PFP
materials on process vessels, columns and tanks. In
some cases, loose cladding may allow ingress of water,
causing hidden corrosion and weakening of the
structure. Where necessary, it should be repaired
promptly to avoid the risk of it becoming detached and
creating a hazard.
Regular and systematic inspections should be made
to ensure that safe, clean and orderly conditions are
maintained. PTW systems should therefore address
tidying-up and safe disposal etc.
Vegetation likely to constitute a fire risk should be
cut short within 6 m of any storage building containing
flammable or combustible materials. Cuttingsshould be
removed to a safe place.
Sawdust or other combustible materials should not
be used for soaking up spills of flammable liquids. Dry
sand or absorbent inert mineral material should be used
or otherwise proprietary spill kits suitable for the
purpose.
4.8 SITE LAYOUT
4.8.1 General
The layout and general design of a petroleumrefinery or
bulk storage installation should be optimised with
respect to safety, operational efficiency and
environmental protection.
National regulations (e.g. COMAH) and local
regulations including petroleum-licensing conditions,
building regulations and local bylaws, may have
specific layout requirements and should be consulted at
the design phase of an installation. For example, the
preparation and submission of a pre-construction safety
report can be a requirement under Seveso II-type
legislation. Discussions should be held at an early stage
with all authorities responsible for these and any other
requirements. Formal approval should be obtained
before construction work commences.
Some petroleum companies have in-house
standards for site layout and minimum separation

FIRE PREVENTION
35
distances may be specified. These may be based on
experience and can in many cases be used as a starting
point for layout purposes. However, for optimisation
purposes, there should be additional considerations.
Under a goal setting (i.e. risk-based) legislative
framework, detailed layout studies and fire protection
analyses should be carried out. Their purpose may be to
optimise installation layout, whilst considering
necessaryFEHMmeasures. For example, fireprotection
such as water spray systems might be considered
(depending on potential fire exposure and emergency
response, etc.) if land use needs to be optimised and
storage tanks or plant are to be situated close to each
other. For a typical study, the following should be
considered:
— Credible fire scenarios at the installation (e.g. pool
fire, pressurised gas jet or liquid spray fire, etc.).
— Fire probability and consequences (e.g. potential
for asset damage).
— Potential fire exposures, including personnel and
buildings and implications for life safety (e.g. is
the flame from the fire likely to impinge on
adjacent equipment, vessels etc. or will nearby
items and personnel be exposed to high radiant heat
levels?).
— Potential risk reduction options or mitigation
measures (e.g. fixed water spray systems or foam
systems),includingtheextentofspacing/separation
required between items or areas of plant.
Generally, spacing between tanks and other items of
plant can be relaxed with a higher degree of fire
protection. For example, if PFP (i.e. a fire wall) is
provided between two critical product pumps, then
greater separation may not be required.
In some cases, appropriate fire detection backed up
by a rapid fire response (whether by fixed fire-fighting
systems or by manual means) can allow relaxation.
In all cases, criticality of plant and equipment and
implications of loss for asset damage, business
interruption and reputation should be considered, as
well as those for life safety.
For areas where personnel are normally present
(e.g. loading and unloading areas) there may be
considerations for access and emergency egress. Also,
appropriate areas should be set aside to allow safe
vehicle movement, and features such as crash barriers
should be installed to prevent collision with plant and
structures.
In heavily built-up areas, a risk assessment should
be carried out to determine both personnel and societal
risks (see section 1.7.2) arising frompotential fire or gas
release events. The use of fire and explosion modelling
and other scenario analysis tools such as event tree
analysis can assist in this purpose.
For buildings and other occupied structures,
potential for external fire spread should be assessed.
Fire could start and spread because of exposure to fires
within plant areas or it could propagate due to fire
spread from adjacent or adjoining buildings. Generally,
a 'clear' area should be provided around buildings where
possible to minimise fire spread.
4.8.2 Boundaries
Installations should be surrounded by a suitable security
fence or wall of minimum height of 2 m. Where
petroleum installations are situated within a fenced or
controlled area, such as dock or harbour premises, the
requirements for fencing may be relaxed by agreement
with the local controlling authority.
4.8.3 Storagetanklayout/secondary containment
Installations intended for the handling of only
Class II(1) or Class III(1) petroleum products present a
lower level of risk than those handling Class I,
Class II(2) or Class III(2). However, safe separation
distances of storage and handling installations from
boundaries should still be observed for these products
having regard to the installation's location and the
nature of its surroundings.
Normally, good tank design and operations good
practice should prevent large product releases.
Catastrophic tank failure is one possibility, but is
usually considered a low probability event. Although
considerable research has been aimed at the subject of
bund overtopping, good bund design and minimising
potential for large releases in the first instance should
significantly reduce the probability of such an event.
Tank inspection practices aimed at identifying potential
corrosion points well before a leak could developshould
be implemented as part of a site pre-planned inspection
and maintenance programme.
Above-ground tanks should be provided with a
form of secondary containment, which will serve to
contain any releases that may occur. Bunds or walls
may be constructed from earth, concrete, masonry or
steel, or a combination of these. They should be
substantially impervious to liquid and capable of
withstanding the hydrostatic pressures to which they
may be subjected. The floor of the bund area should be
substantially impervious to petroleum and its products
in order to safeguard groundwater quality.
Environmental regulations and water protection
standards should be observed in the design of
compounds, drainage systems and impounding systems.

36
Intermediate walls of up to half the height of the main
walls, but normally not more than height 0,5 m may be
provided within a bund area to control losses of
containment and avoid the spread of substance to the
vicinity of other tanks sharing the same bund. Such
walls should divide the tankage into groups of a
convenient size.
When planning tank bunds and bund walls, the
bund should be capable of holding a volume equal to
110% of the maximum capacity of the tank.
As an alternative to these designs lower walls may
be employed in conjunction with systems to direct the
lost product to an impounding basin at a convenient,
safe location.
The maximum total capacities of tanks within a
single compound should be:
(1) Single tanks, all
classes, including
crude oil
No restriction
(2) Two or more
floating
roof tanks
120 000 m3
(3) Two or more fixed
roof tanks
60 000 m3
(4) Crude oil tanks Not more than two tanks
of greater individual
capacity than 60 000 m3
The data for (2), (3) and (4) may be exceeded provided
that an assessment indicates no significantly increased
risk of environmental impact or to people. Such
assessment may take account of developments in
floating roof seal technology and practice and should
consider the design of appropriate fire protection and
extinguishment measures.
For guidance on storage tank separation distances
in relation to fire risk reduction options (including
bunding), see annex C.2 and Table C.1.
4.8.4 Process plant layout
Process areas should include access-ways for fire-
fighting, as well as routine inspection and maintenance.
Some guidance on process plant layout includes:
— Access-ways should be arranged in a rectangular
grid pattern, so that fire-fighting can take place
from two opposite sides.
— To limit fire spread, low walls or kerbs should be
provided and each should be connected to a
drainage system (but not any storm water system).
These can assist foam blanketing and limit fire
spread caused by low flash point products floating
and burning on the surface of the water (carry-
over). However, during fire-fighting, it should be
recognised that the drainage capacity of kerbed
areas may be exceeded and flooding may occur
under full fire-fighting water application rates.
— Fixed water spray or foam systems should be
considered for high-risk equipment where fire-
fighting access is poor or if items are vulnerable to
fire exposure. PFP should also be considered.
4.8.5 Fire-fighting access
Pre-fire plans (see section 8.7) should identify
emergency vehicle access points, including means of
gaining entry where unattended or remotely-operated
secure entry systems exist. Roads and crossings, as well
as overhead pipe rack clearances, should allow
emergency vehicles easy access to all areas of the site.
Main roads should also be suitably surfaced and
drained. Speed bumps, which could limit response
times, should not be provided on emergency routes.
Roads or access over firm ground should be
provided to allow fire appliances to approach within
reasonable operating distance of the hazard. Access
should be kept free of obstruction. In certain
circumstances, railway lines may impede access for fire
appliances. Each case should be considered separately,
but for initial guidance, access should be provided
within 20 m to 45 m of the hazard. Water supplies
should be available at these places.
A subsidiary road should be provided in large
installations for general access and fire-fighting
purposes around the perimeter. This road may be sited
within the safety distance specified for the spacing of
tanks from the boundary and should have access to the
public road system at two points at least. Secondary
access to the site should normally remain secure or
locked and with well-defined arrangements for opening
in emergencies. Connecting roads should normally be
arranged to permit approach from two directions to all
major fire hazards onsite.
Roadways should be provided with passing spaces
for fire vehicle access if they do not permit two lanes of
traffic. Recommendedwidthsfortwo-directionaltraffic
and for single directional traffic should not normally be
less than 6 m and 4 m respectively. Cul-de-sacs should
be avoided, but, if necessary, should be provided with
adequate turning areas. Road junctions and curves
should be constructed with sufficiently large turning
circles to ensure easy vehicle manoeuvring. It may be
necessary to provide one or more vehicle turning points
and to cater for emergency vehicles, such as by
providing hard standings at strategic locations.

FIRE PREVENTION
37
Each large storage area of flammable substances or
major process plant unit should be accessible from at
least two sides. If access is only possible from two
sides, these should, wherever possible, be the longest
opposite sides.
The design of the road layout should be influenced
by plant complexity and the type(s) of fire appliances
likely to be employed in fire-fighting. Road widths, gate
widths, clearance heights, turning circles and axle
loadings for the various types of vehicles likely to be
called to the hazard should be considered. These could
include vehicles other than fire-fighting appliances such
as heavy bulk foam and/or carbon dioxide (CO2)
carriers.
One or more hard standings should be provided
beside each open water source to enable fire-fighting
appliances to be positioned at strategic points, where
this is necessary to prevent blocking roadways. A
waiting area should be allocated near each main
entrance to the site as a rendezvous point for emergency
vehicles where this is warranted by the size or nature of
the installation.
These aspects should be considered in consultation
with the local government Fire and Rescue Service
(FRS).
4.8.6 Drainage systems
Due to their flammability and classification as
dangerous to the aquatic environment, sewerage
companies and environmental agencies generally do not
allow entry of petroleum and its products into drainage
systems and natural watercourses under their respective
control. In addition, fire-fighting water is likely to be
highly polluting, posing a threat to watercourses,
groundwater and sewage treatment facilities. Therefore,
the capacity of site drainage systems should be carefully
evaluated and the management of fire-fighting water
should be included in ERPs (see 8.8).
Adequate drainage for storm water should be
available and special provisions such as pumps, run-off
areas, etc., may be necessary for the disposal of water
used in fire-fighting operations. Increasingly, there are
controls on the release of fire-fighting foam due to
concerns over the toxicity of fluorochemicals used, and
some environment agencies may require catchment and
specialist disposal of foam run-off.
To avoid flooding during fire-fighting, the drainage
system should be designed to cope with the fire-fighting
water available to that area, including cooling water.
Generally, this would comprise at least 90% of the flow,
assuming some 10% evaporates in the fire.
Area drainage or alternative disposal systems for
the large volumes of water that may be used should be
adequate to avoid flooding, which can introduce other
hazards. Consideration may be given to installing
recycling facilities for oil-free water. The system should
be designed to prevent carryover of petroleum, its
products and other pollutants into the sea, rivers, or
other environmentally sensitive areas. Contingency
plans shouldbediscussed with the relevantenvironment
agency.
Consideration should also be given to the possible
danger from the mixing of incompatible effluents.
Flammable vapours can arise if hot fluids, e.g. steam
condensate, mix with petroleum and its products in
drainage systems. Also, flammable substances may be
carried offsite by drains and precautions should be taken
to prevent this possibility.
4.8.7 Fire protection and other safety critical
equipment
Fire protection and other safety critical equipment
should be located in safe and non-hazardous areas.
Consequence modelling should be carried out to
determine placement of such items as they may
constitute sources of ignition. Considerationshould also
be given to locating such equipment so as to enable
access at all times during incidents. In addition, such
equipment should be capable of withstanding the effects
of fire and explosion if its use is required during
emergency conditions. For example, fire pumps should
be located at a safe distance away from any possible fire
consequences.
4.9 BUILDINGS FIRE PRECAUTIONS
National and local regulations may require fire risk
assessments to be performed for occupied, as well as
some unoccupiedbuildingsatpetroleuminstallations. In
addition, some building regulations (e.g. in England and
Wales – TSO Building Regulations Approved
Document B – Fire safety) specify minimum require-
ments for fire prevention and protection in newly
constructed buildings. Where applicable, these building
regulations should be met. For existing buildings, fire
risk assessments should be performed to identify the
extent of fire risk and used to implement additional fire
precautions and protection where appropriate.
See CIA Guidance for the location and design of
occupied buildings on chemical manufacturing sites for
buildings fire safety considerations at petroleum
installations.
Fire risk in buildings can be assessed and
appropriate FEHM measures implemented by
performing a fire risk assessment. A typical assessment

38
should consider for a building:
— Its nature and use.
— The type of construction, including its internal
features.
— Its size and layout.
— Its contents, including equipment, furniture and
furnishings.
— The presence of combustible materials or
flammable substances.
— Identification of all internal and external fire
hazards.
— Potential sources of ignition, both internal and
external.
— Its occupants, including whether they are typically
staff, contractors or visitors and their ability to
respond in the event of a fire emergency.
— Means of escape.
— Existing fire prevention and protection measures.
For each building, the following steps should be taken:
— Identify all fire hazards, including combustible
materials and flammable substances, potential
sources of ignition and structural features
contributing to fire risk.
— Identify personnel at risk.
— Eliminate, control or avoid fire hazards.
— Assess existing FEHM measures and improve if
needed.
— Record the assessment.
— Prepare an ERP.
— Review the assessment periodically.
See annex C.7 for typical fire detection/protection
measures for various building types at petroleum
refineries and bulk storage installations.

39
5
FIRE AND FLAMMABLE GAS
DETECTION
5.1 INTRODUCTION
Depending on the criticality of the installation and
emphasis on life safety, automatic fire and flammable
gas detection systems can be used to give early warning
of a fire event and allow immediate investigation and/or
fire response. This section sets out the various types,
recent developments, application to various facilities/
areas and design issues.
The capability to detect fire early is especially
applicable to installations that have a small operational
staff and early warning is paramount to a rapid fire
response. Appropriate fire detection systems can be
employed within operational areas, support facilities
and buildings. Detection systems can also be linked to
active fire protection systems, thus providing executive
actions.
Releases of flammable gases from process units
pose an immediate threat to operations personnel and
plant, and accidental discharges should be detected as
early as possible to avoid the possibility of confined or
partially confined VCEs.
5.2 PRINCIPLES OF FIRE AND FLAMMABLE
GAS DETECTION – OPTIONS,
APPLICATIONS AND DESIGN ISSUES
5.2.1 Flammable gas detection
For areas where the risk arises solely from a leak of
flammable gas or vapour, appropriate flammable gas
detection should be employed.
5.2.1.1 Point detection
Point detectors measure gas concentration in a
flammable gas/air atmosphere at a specific location. To
detect flammable gas they should be situated in an area
close to potential sources of release for maximum
response.
5.2.1.2 Open-path detection
Open-path infrared (IR) detectors are useful for
monitoring large open areas for gas releases. In effect,
they act as a series of point detectors placed end-to-end.
Experience has shown that they are most effective over
distances of about 60-100 m but may be used over
greater distances in some cases.
Open-path detectors may be considered for use as
perimeter monitoring devices around installations; see
Figure 5.1. The purpose of perimeter monitoring might
be to track the movement of a flammable gas/air cloud
either around or offsite. Ideally, open-path detectors
should be supplemented with the use of point detection
situated close to potential sources of releases. In this
way, sources can be pinpointed and the cloud movement
assessed to assist mitigation or deployment of gas cloud
control actions.
5.2.1.3 Catalytic gas detection
Point catalytic detectors typically comprise an
electrically heated platinum wire coil coated in a
catalyst, sometimes called a pellistor bead. This sensor
responds to a flammable gas/air mixture by heating and
altering the resistance of the platinum coil. The amount
of heating (and therefore change in resistance) is
proportional to the amount of combustible gas present
and a reading can be displayed on a meter.

Ip model code of safe practice part 19 2nd ed. jan. 2007 part1

More Related Content

What's hot (20)

Similar to Ip model code of safe practice part 19 2nd ed. jan. 2007 part1 (20)

More from Varadaraj Ck (7)

Recently uploaded (20)

Ip model code of safe practice part 19 2nd ed. jan. 2007 part1