The first step in the FEHM process involves fire scenario analysis. Credible fire and explosion scenarios should be identified at each installation on a site-specific basis.
As introduced in Section 1, one way to define and implement appropriate and justified fire and explosion hazard management policies is to adopt a risk-based FEHM approach. This process is increasingly being recognised worldwide as an alternative to prescriptive means of providing fire and explosion prevention and protection measures. NB: The term FEHM includes 'explosions' but it should be noted that explosion hazards, prevention and protection are specialised topics and are outwith the scope of this publication.
As part of this, fire and explosion scenarios should be evaluated for probability and consequences (i.e. risk) so that appropriate, justifiable risk reduction options can be selected.
Scenarios selected as posing appreciable risk, and meriting risk reduction measures may be included in a COMAH safety report used to demonstrate FEHM policy and its implementation. In most cases, documentation should be provided to show that credible scenarios have been identified, and risk reduction measures are in place and maintained as part of the installation’s FEHM policy.
Fire scenario analysis can be achieved through a combination of various qualitative scenario analysis tools including hazard analysis (HAZAN)/hazard identification (HAZID)/hazard and operability (HAZOP) and quantitative methods such as event or fault tree analysis. Quantified risk assessment (QRA) can also be used. Industry databases giving incident probabilities can be employed to assist quantitative methodologies. These can be combined with fire and explosion consequence modelling tools to gain an overall assessment of risk.
Incident experience may also provide a useful tool for assessing incident probabilities and consequences.
For example, it might be shown that certain types of incident have occurred or are more likely because of certain failure modes, initiating events or even human factors and inadequate practices and procedures (e.g.
inappropriate maintenance). Similarly, consequences in terms of life safety, asset loss, environmental impact etc. can be estimated from documented incidents.
2.5.2 Scenarios
A range of fire and explosion scenarios should be
considered. In most cases it will be impractical to consider every possible scenario and a balance should be struck between addressing larger, less frequent scenarios that would cause more damaging consequences to personnel, business and the environment, and smaller, potentially more frequent events that could lead to escalation or significant localised damage.
Scenarios should include:
— unignited product releases;
— pool fires;
— atmospheric storage tank fires:
- vent fires;
- full surface fires;
- rim seal fires;
- spill-on-roof fires;
- bund fires;
- boilover;
— jet fires:
- gas jet fires;
- liquid spray fires;
— BLEVEs;
— vapour cloud explosions (VCEs);
— flash fires.
As well as the above, potentially toxic product releases should be considered, and it is worth noting that these may have the potential to result in fires and/or explosions if ignited.
The probability and magnitude (i.e. consequences) of these events depend on a number of product factors:
— Release characteristics (e.g. whether the product is released as a gas, liquid or mixture; whether it is of short duration or prolonged).
— Whether the substance released is toxic, flammable or both.
— If flammable, whether ignition occurs, and if so where and when.
— For ignited gas releases, whether overpressures are generated on combustion (this depends on the degree of confinement or congestion, as well as fuel reactivity and strength of any source of ignition).
In addition, incident probability may be increased during activities such as maintenance and start-up operations.
2.5.3 Unignited product releases
Paradoxically, ignition source control measures
routinely adopted at installations mean that releases of flammable liquids and vapours (whether pressurised or at atmospheric pressure) have the potential to accumulate and remain unignited. Consequently, the amount of flammable product may be large with potential to create damaging fires and explosion if ignited. For flammable liquid releases, the extent of any fire depends on containment measures, as well as any mitigation such as spill response carried out at the time of the release. For gaseous releases, atmospheric dispersion is of importance. As part of any fire scenario assessment, potential release rates should be determined with the help of a ‘source’ model. The results of these can be fed into pool fire, jet fire and VCE consequence models to determine fire extent and characteristics.
Also, there are a number of gas dispersion models available that can be used to evaluate the magnitude of any vapour cloud.
Unignited product releases generally require careful mitigation and response actions to remove the hazard.
These can include containing, neutralising and disposing of the product, or achieving gas dilution or assisted dispersion with the use of water sprays and/or curtains. Such measures are discussed in Section 7.
It is also worth noting that in addition to fire and explosion, unignited releases can pose environmental, toxic and asphyxia hazards and these should be included in any scenario analysis.
2.5.4 Pool fires
Pool fires can be contained (e.g. atmospheric storage tank or bund fires) or uncontained (e.g. unbunded or because of bund overtopping). The ignited fuel usually has very little or no momentum (i.e. it lies in a static pool) and combusts as heat is fed back to the product and it evaporates from the liquid surface. A pool fire can occur in areas such as in bunding below a vessel. If unconfined, the spread can depend on the surface characteristics (e.g. whether hard concrete or permeable), nearby drains and the presence of water surfaces. Pool fire flames are often ‘tilted’ due to wind effects and can ‘drag’ downwind for some considerable distance. In addition, they can be accompanied by large quantities of smoke.
Pool fires present a thermal hazard dangerous to personnel and installations. The potential heat flux in the flame of a pool fire may be in the order of 250 kW/m2.
Fire escalation under pool fire conditions would normally involve direct flame impingement on adjacent tanks, vessels or pipework and valves or prolonged exposure to heat fluxes in excess of 8-12 kW/m2 near to the fire if there is no protection. Escalation may be
much more rapid if exposures are subjected to fluxes in excess of 32-37,5 kW/m2 nearer the flame.
Pool fires may be preceded by a jet/spray fire as installations or process plants depressurise, and this should be taken into account during any fire scenario analysis.
Note, in many cases, the level of thermal flux from a pool fire determines personnel safety, levels of fire protection that should be provided and emergency response requirements. See later in this section, as well as Sections 7 and 8.
2.5.5 Atmospheric storage tank fires
Atmospheric storage tank fires are, essentially, contained pool fires and can vary from being relatively small rim seal fires (in the case of a floating roof tank) to spill-on-roof fires and full surface fires. The RPI LASTFIRE project (see annex I.3) – a joint petroleum industry initiative reviewing the risks associated with large diameter storage tank fires – provides a comprehensive review of tank fire scenarios, as well as typical incident probabilities and consequences based on incident experience and a comprehensive industry database.
The type of fire scenarios to be considered depends largely on the tank construction and to a lesser extent on the product:
— For fixed roof and internal floating roof tanks, vent fires and full surface fires (see 2.5.5.1-2.5.5.2).
— For open top floating roof tanks, rim seal fires, spill-on-roof fires and full surface fires (see 2.5.5.3-2.5.5.5).
— For all tank types, bund fires (see 2.5.5.6).
— For tanks containing crude oil and wide boiling point products, boilover (see 2.5.5.7).
2.5.5.1 Vent fires
A vent fire is a fire in which one or more of the vents in a tank has ignited. Flammable vapours are always present in the vicinity of vents, either because of the tank’s daily breathing cycle or during tank filling operations. Most vent fires are attributed to lightning (see section 4.4.3), although instances have occurred when sources of ignition outside the tank have started vent fires.
When addressed properly, vent fires can usually be extinguished with minimal damage and low risk to personnel. Losses of containment associated with vent fires typically occur as a result of overfilling due to operator error, failure of level instrumentation or in normal tank operation.
2.5.5.2 Full surface fires
A full surface fire in a fixed roof tank can be brought about by vent fire escalation. A vapour space explosion can occur if the vapour space is within the flammable range at the time of flame flashback, especially if vents and/or flame arrestors are defective. If the tank is constructed to a recognised publication such as API Std. 650 then the roof should separate from the tank shell along a weak seam. Depending on the force of the vapour space explosion, the roof may either be partially removed or fully removed.
2.5.5.3 Rim seal fires
A rim seal fire is one where the seal between the tank shell and roof has lost integrity and there is ignited vapour in the seal area. The amount of seal involved in the fire can vary from a small localised area up to the full circumference of the tank. The flammable vapour can occur in various parts of the seal depending on its design.
The most common source of ignition for a rim seal fire, as determined by the RPI LASTFIRE project (see annex I.3) is lightning (see section 4.4.3). Clearly, the probability of ignition is increased in areas of the world where ‘lightning days’ are more common but ignition probability may be further increased if tank maintenance is poor. Other notable sources of ignition for documented rim seal fires include hot work on a
‘live’ tank where permit-to-work (PTW) procedures (see section 4.5) have failed to identify fire risk.
2.5.5.4 Spill-on-roof fires
A spill-on-roof fire is one where a hydrocarbon spill on the tank roof is ignited but the roof maintains its buoyancy. In addition, flammable vapours escaping through a tank vent or roof fitting may be ignited.
2.5.5.5 Full surface fires
A full surface fire is one where the tank roof has lost its buoyancy and some or the entire surface of liquid in the tank is exposed and involved in the fire. If a roof is well maintained and the tank is correctly operated, the risk of a rim seal fire escalating to a full surface fire is very low.
2.5.5.6 Bund fires
A bund fire is any type of fire that occurs within the secondary containment area outside the tank shell due to pipe fracture, corrosion, etc. These types of fire can range from a small spill incident up to a fire covering the whole bund area. In some cases (such as a fire on a mixer) the resulting fire could incorporate some jet or spray fire characteristics due to the hydrostatic head.
2.5.5.7 Boilover
Boilover is a phenomenon that can occur when a fire on an open top floating roof tank containing crude or certain types of heavy fuel oils (which contain a range of fractions), has been burning for some time. It can result in large quantities of oil being violently ejected, even beyond the bund. Boilover is a potential escalation route to multiple tank/bund incidents and a major hazard to fire-fighters.
A boilover can occur in crude oil tank fires when the hot zone of dense, hot crude oil created by the burning of lighter ends descends through the bulk and reaches any water base, which may have been augmented by fire-fighting or cooling actions. The water turns to steam, expanding in the order of 1 500:1.
This steam pushes up through the bulk, taking crude with it and creates a fireball above the tank. Boilovers have spread burning crude oil several tank diameters from the source, thus escalating the incident and endangering fire responders.
The phenomenon of boilover plays a key role in decision making on the most appropriate and cost effective strategy for crude oil tank fires. Although such events are very rare due to normal operating and design controls, when they occur they can cause major asset, business interruption and reputation damage. Boilovers have been known to cause multiple fatalities as well as fire escalation to adjacent installations.
2.5.6 Jet fires
A jet fire is a stable jet of flame produced when a high velocity discharge catches fire. The flame gives varying amounts of smoke depending on the product and degree of air entrainment during discharge. For example, gas/oil jet fires can produce more smoke than both gas or gas/condensate fires and may also feed pool fires.
Jet fires can result because of ignition of a high-pressure gaseous release, or otherwise because of the combustion of a liquid spray (e.g. a high-pressure crude release).
The proportion of the release burning as a jet or spray tends to increase with the pressure and the volatility of the liquid.
By their nature, jet fires are very hot and erosive and have the potential to rapidly weaken exposed plant and equipment (even if passive fire protection (PFP) is provided) as well as pose a serious thermal risk to personnel. The potential heat flux in the flame of a jet fire can be in the order of up to 350 kW/m2. Escalation from jet fires would normally involve direct flame impingement or prolonged exposure to high heat fluxes in the region of the flame.
2.5.7 Boiling liquid expanding vapour explosions See 2.3.3.3 for an explanation of BLEVE.
Pool and jet fire scenarios should be assessed for their capacity to create potential BLEVE situations;
these are more likely where fires can burn directly under or close to pressurised vessels containing Class 0 products.
2.5.8 Vapour cloud explosions
A VCE involves the explosive combustion of flammable vapours released to the atmosphere. The consequences of a VCE depend on factors such as the reactivity of the vapour, degree of congestion and confinement and ignition characteristics. Also, characteristics such as vapour density can affect the travel, ease of dispersion and therefore extent of the cloud.
Potential release areas in petroleum refineries are typically very congested with pipework, process units, vessels and other equipment. Ignited releases there have the potential to be major, generating damaging overpressures because the vapour/air mixture becomes very turbulent and the combustion rate increases very rapidly.
Installations and structures within the blast zone may be demolished or severely damaged, depending on the extent of overpressure generated. Personnel may also be at risk from the overpressure, as well as flying debris and blast/heat effects.
For assessment purposes, the probability of vapour releases should be determined along with the likely extent of dispersion. As well as this, the potential for damaging overpressures should be ascertained. A number of explosion modelling techniques are available to carry this out, and some of these are configured to provide 'lethality' data to assist in assessing personnel or societal risk.
2.5.9 Flash fires
A flash fire can occur when the combustion of a flammable liquid and vapour results in a flame passing through the mixture at less than sonic velocity.
Damaging overpressures are usually negligible, but severe injuries can result to personnel if caught up in the flame. Also, a flash fire may travel back to the source of any release and cause a jet or spray fire if the release is pressurised.
2.6 CONSEQUENCES