300 Firebox Safety

Abstract
This section discusses the risks associated with furnace fires: personnel safety and
lost profits. It identifies the major causes of fires/explosions and recommends
methods of prevention, including design and operational factors. It also includes
information on minimizing losses should a fire occur.
The information is focused on process heaters typically found in refineries and
chemical plants because that is where over 90% of the losses occur on fired heaters.
There is also a discussion (Section 380) of fired heater safety for upstream
applications.
This section is closely related to Section 400, “Component Design and Selection”
and Section 600, “Instrumentation and Control.” Generally, this section focuses on
the concepts of firebox while Sections 400 and 600 discuss the design details.
There is some overlapping information, review Sections 300 and 600 for a full
understanding of preventative measures. Also, see Section 1300, “Process Alarms
and Shutdown Systems” in the Instrumentation and Control Manual for additional
information.

Contents Page

310 Introduction 300-3

311 Scope of Fire Losses
320 Major Causes of Fires in Process Heaters 300-3
321 Tube Failure
322 Firebox Explosions
323 External Fires
330 Design Features of Fuel System 300-9
331 Fuel Reliability
332 Burner Design
333 Burner Isolation
334 Minimum Fire Bypass/Pilots
335 Protective Instrumentation

Chevron Corporation 300-1 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

336 Safety Shutdown Systems

337 Waste Gas
340 Design Features of Process System 300-16
341 Fifty-foot Isolation
342 External Piping
343 Tube Design
344 Protective Instrumentation
350 Design Features of Firebox 300-18
351 Layout, Spacing and Drainage
352 Purge Systems and Snuffing Steam
353 Gas Test Points
354 View Ports
355 Protective Instrumentation
360 Operating Considerations 300-20
361 General Principles
362 General Guidelines for Safe Firing of Furnaces
363 Start-up Checklist/Monitoring
364 Emergency procedures
365 Operating Limits
366 Normal Operation
367 Inspection/Maintenance
370 Fired Heater Safety Best Practice 300-24
380 Upstream Fired Heater Safety 300-24

January 1998 300-2 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

310 Introduction
Fired equipment fires are both a major source of financial loss to the Company and
a safety hazard. While the frequency of these fires has not increased, the magnitude
of the losses continues to climb as furnaces become larger and more complex.
Some of the factors that have caused fires include:
Improper design. This factor includes inadequate metallurgy, mechanical design
features permitting hot spots on tubes, insufficient or inadequately designed protec-
tive instrumentation, and changes to service conditions from the original design
made without a design review.
Inadequate inspection or maintenance. This factor has contributed to fire losses
either by tube failure or by failure of instrumentation to alert operators about a
dangerous condition.
Not following established operating procedures. This factor includes failure to
purge properly and/or test the firebox during light-off, to respond properly to an
unsafe operating condition, or to routinely test alarms and shutdown systems. This
factor also includes inadequate or incorrect operating limits in the operating proce-
dures.

311 Scope of Fire Losses

Over a 10-year period from 1987-1996, the Company had 196 fired heater fires
with a direct financial loss (damage to equipment) of $62 million (in 1996 dollars).
This represents about 15% of the Company's total fire loss during this period.
Approximately $60 million (96%) of this loss was associated with large process
heaters. Large process heaters averaged 12 fires per year over the 10-year period, at
an average cost of $520,000 per incident.
These fire losses (damage) do not include the additional costs of operating down
time and lost production. The production losses can be much more significant than
the actual fire loss. As an example, the two large heater incidents in 1995 were tube
ruptures that resulted in $22 million in equipment damage. However, the lost profit
opportunity (LPO) was an additional $28 million.

320 Major Causes of Fires in Process Heaters

Causes of fires are highly varied, numerous, and complex. Nevertheless, the
majority of all incidents fall under three major categories:
1. Tube Failure
2. Explosions from the ignition of unburned fuel in the firebox
3. Fires related to the fired heater but external to the firebox.
Figure 300-1 shows the breakdown of fired heater fires from 1987-1996.

Chevron Corporation 300-3 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

Fig. 300-1 Process Heater Fires - Downstream 1987-1996

90
$528M

80

70
Totals: 118 Fires, $49.8MM Loss, 11 Injuries
Number of Fires 60

50

40

30
$44,892M

20
$4,400M
10

0
External Firebox
Tube Rupture
Fire Explosion

Figures 300-7 and 300-8 (located at the end of this section) show events that
resulted in tube-rupture fires (Figure 300-7) or explosions (Figure 300-8) over a
recent 6-year period.

321 Tube Failure

Approximately 20% of all fired-heater fires from 1987 through 1996 resulted from
tube failure. However, as Figure 300-1 shows, tube failures account for 90% of the
fire loss. Tube failures also result in a high amount of LPO as well. Tube failures
are generally grouped into two categories:
• Overheating
• Corrosion/metallurgy
Figure 300-2 represents a breakdown of the tube failures from 1987-1990.

Tube Failure from Overheating

Failure due to tube overheating occurs when there is insufficient heat removal in the
tube either from low flow or internal fouling. The elevated tube metal temperatures
result in localized metal failure.
Figure 300-7, is a failure-path diagram that highlights several ways tube rupture
may occur by over-heating. Also refer to 300-3 for a simplified reference diagram
of a typical furnace.
Loss of Flow. The most common scenario for this event combines loss of flow
(through feed pump or compressor failure, improper operation of valves, or process

January 1998 300-4 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

Fig. 300-2 Tube Rupture Fires- Downstream 1987-1996

12 $25,030M

10

Number of Fires
8

6
$16M
4 $1,800M $1,046M

2 $11,000M $6,000M

0
Low LTA Unknown LTA LTA Design
Flow Inspection Metallurgy Oper.
Procedures

turndown, equipment failure, etc.) with continued heating of the tubes. This situa-
tion can occur if fuel is not reduced to minimum fire fast enough or if the minimum
fire itself releases enough heat to damage the tubes. For example, one major fire
occurred when the feed pump to the furnace shut down. This caused loss of flow to
the furnace, while the furnace continued to be fired until the tubes ruptured. The
fire caused $2 million in fire loss and approximately $12 million in lost production.
By reviewing furnace failure paths shown in Figure 300-7 and from past operating
experience, it is clear that:
1. Fuel to the furnace must be shut off immediately upon loss of flow through
the tubes in order to reduce the risk of fire by tube rupture.
2. Automatic shutdown of fuel upon loss of flow through the tubes will signifi-
cantly reduce fire losses due to tube rupture.
Process furnaces meeting any of the following criteria have sufficient criticality to
justify automatic fuel shutdown on loss of flow through the tubes:
1. Over 50 MMBTU/hour
2. Pose a significant risk to people in the event of a tube failure
3. Critical to plant operations based on a thorough review of process requirements
Note These same criteria should be used for design reviews of existing heaters.
During a loss-of-flow event, the flow rate drops to the point where insufficient heat
is carried away in the fluid, allowing the tubes to overheat. This can be caused by:
• total loss of flow
• a decrease in flow which allows tubes to overheat
• a decrease in flow which allows an individual pass to stall
• a restriction in the flow path

Chevron Corporation 300-5 January 1998

Fig. 300-3 Simplified Fired Heater Schematic for Cross Reference with Figures 300-7 and 300-8.
January 1998

300 Firebox Safety

300-6

Fired Heater and Waste Heat Recovery

Chevron Corporation
Fired Heater and Waste Heat Recovery 300 Firebox Safety

Factors to consider when analyzing a loss-of-flow event include loss of the

feed/circulation pump or compressor, valve failure, vaporization of light stock, and
severe plugging.
Internal Fouling or Coking. Overheating can also occur when the tube metal is
“insulated” from the process fluid by fouling or coking. When this occurs, the tube
surface can heat up to well above the design temperature of the tube resulting in a
tube leak or rupture. Coking can occur because of the type of stock or process
conditions, from firing above the design heat duty of the furnace, and from local-
ized overheating from flame impingement. Monitoring the tube temperatures with
skin point TIs and thermography is critical in identifying and correcting potential
hazards before a tube failure occurs.

Tube Failure Due to Corrosion

Two major furnace fires in 1988, resulting in $7.7 million in equipment damage,
were caused by tube failure due to corrosion. Corrosion rates are generally well
known and are based on operating experience. However, corrosion rates can
increase due to unanticipated changes. Accelerated corrosion failures can be caused
by (even minor) changes in the process fluid that are more corrosive to the existing
tube material, insufficient tube inspection frequency, abnormal plant operation, and
insufficient design. For example, one fire occurred at a large processing plant due to
acid carry-over into the furnace feed. The tubes in this particular furnace were not
designed to handle acid, and the tubes rapidly failed, causing a major fire.
The following discusses ways to reduce the probability of tube rupture due to corro-
sion.
Material Selection. Engage appropriate experts when selecting tube materials for
new or existing furnaces. Appropriate experts include process engineering, inspec-
tion, local or CRTC materials experts, and the refining fired heater expert.
Inspection Strategies. Develop inspection strategies (methods and frequency) for
each furnace based on the operating conditions. Tubes in highly corrosive service
may warrant more frequent inspection intervals. Reevaluate the inspection strate-
gies if changes occur that may effect corrosion rates. Operators, engineers, and
inspectors should be particularly sensitive to process changes that may affect tube
corrosion. Consider additional inspection until the new trend of corrosion is verified.
Feed Stock Switches. Give careful consideration to feed stock switches going
through the furnace. Certain components may not be compatible with existing tube
metallurgy and may cause unanticipated corrosion and/or coking. Additionally,
changes in feed can introduce water or light stock which can stall flow in the tubes.
Operational Upsets. In some cases process upsets can cause noncompatible
product (e.g., acid, caustic, untreated crude, etc.) to enter the furnace tubes and
cause accelerated corrosion. When a process upset occurs, be sure to include the
furnaces when investigating for upset damage.
Design Changes. Design changes to process equipment can result in unanticipated
product going to process furnaces. Review design changes carefully to assure
compatibility with existing furnace design. For example, piping waste streams

Chevron Corporation 300-7 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

directly into the furnace firebox for incineration could cause accelerated external
tube corrosion.

322 Firebox Explosions

Accumulation and subsequent ignition of unburned fuel in the firebox is the other
major cause of heater explosions and fires. When unburned fuel is combined with
air, a flammable mixture can form. Ignition of such an accumulation by hot brick-
work, a lighting torch, or an ignitor can result in a confined explosion within the
firebox. This explosion will vent its pressure at the weakest part of the firebox,
resulting in significant damage to the heater and possible injury to operating
personnel.
For example, an explosion occurred at a major facility during light-off of a process
furnace. The basic cause of the explosion was a burner blind left open on a deck
below a burner being lit. The inserted torch (ignition source) in the upper-deck
burner ignited the accumulated gas caused by the open burner below, resulting in an
explosion in the firebox. The event caused two injuries and resulted in significant
damage to the furnace.
Some of the most common causes of these events are:
1. Improper light-off or emergency procedures (e.g., inadequate purge, not testing
for flammable gases before light-off, starting fuel gas before inserting the
torch, fuel valves not blinded, insufficient combustion air, etc.)
2. Equipment failure (e.g., burner failure, loss of forced draft fan), improper fuel
or rapid changes in fuel composition
3. Rapidly increasing air into a “bogged” firebox
Figure 300-8 shows a failure path diagram for a firebox explosion. Also refer to
Figure 300-3.

323 External Fires

As can be seen from Figure 300-1, fires external to the firebox account for over
70% of the fired heater fires. Figure 300-4 shows a breakdown of the causes of
external fires.
The fired heater is an ignition source for any flammable vapors in the area. While
fires of this nature generally have not resulted in large losses, they do present a
serious hazard to operating and maintenance personnel, particularly during start-up.
External fires are caused by leaks in the fuel gas piping to the burners, leaks in the
process piping to the furnace, and liquid carryover in the fuel system which burns
outside the firebox.

January 1998 300-8 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

Fig. 300-4 External Fires on Process Heaters - Downstream 1987-1996

$456M
45
40
$32M
Number of Fires
35
30
25
20
15
10 $40M
5 Negligible Negligible
0
Process Fuel Leak Liquid Design Unknown
Fluid Leak Carryover

330 Design Features of Fuel System

331 Fuel Reliability

Refer to Section 643 of this manual and the Utilities Manual, Section 600, for more
information on the design of fuel systems.

Fuel-Gas
Reliable fuel-gas supplies are essential for firebox safety. Unreliable supplies can
result in burner plugging and flame impingement as well as minimum-fire bypasses
or gas-fired pilots not providing firebox safety in the event of main fuel failure or
temporary interruption. Some of the key concerns of fuel-gas reliability are:
• Heating value of the fuel must be kept within limits. Furnaces are normally
fired to get a required heat release. If the fuel heating value is too low, then the
flame envelope can get very large and impinge on the tubes or portions of the
firebox that were not designed to withstand impingement. Conversely, if the
fuel heating value is too high, then the gas velocities through the burner
assembly can get too low for stable burner operation.
• The dewpoint of the gas must be kept below the piping's lowest temperature.
Where facilities burn process gas, there is a tendency for condensate to form in
the fuel line or come from the fuel source. In this situation, it is important that
a liquid knockout pot be installed as close to the furnace as possible. In colder
climates or where the fuel gas dew point is high, the fuel gas piping may need
to be steam traced and insulated. Separation will keep slugs of liquid hydro-
carbon from spewing through the gas burner and burning both on the floor of
the firebox and, perhaps, while flowing out of the box.

Chevron Corporation 300-9 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

• Dirty fuel gas can partially plug minimum flow bypasses and burners. Then, at
minimum fire conditions, the flame could go out at some burners, with
unburned fuel gas continuing to flow through those burners, creating a risk of a
firebox explosion.
• Fuel gas pressure must be kept within the range of safe burner operation. If the
pressure is too high then the flame may impinge on the tubes or the firebox; if
it is too high or too low then the burner may become unstable and go out.
• Pressure control of the supply to multiple fireboxes minimizes the effect on
one firebox of changing the flow to another one. Actions taken by the controls
of one firebox should not affect the firing of adjacent fireboxes.

Fuel-Oil
Reliable fuel-oil supplies require careful design to cope with high pour-point
stocks, dirty stocks, pressure control of liquid packed systems, and variable viscosi-
ties. Some of the key concerns of fuel-oil reliability are:
• Pressure control keeps the pressure at the oil burners within the range of safe
operating pressures for those burners.
• Oil must be atomized to properly burn. Control the differential pressure
between the oil and the atomizing steam to the burners for proper atomization.
If it is not atomized, then the oil will burn slowly, perhaps in pools that drip
burning out of the bottom of the firebox, or with extra long flames that impinge
on the process tubes. Viscosity control keeps the oil's viscosity within the
limits for the burners. If the viscosity gets too high, then the oil cannot atomize
properly. Oil filters keep sludge from plugging the burners. Partial plugging
causes improper atomization.
• A minimum-fire gas flame at each oil burner guarantees that the oil will re-
light after a flow interruption.
• Block valves on the oil and steam permit pulling the oil gun out of the firebox
when the burner is not being fired. Otherwise coke produced by thermal decom-
position of the oil left in the gun may plug the gun.
• For a multi-burner firebox, the operator may need to adjust the number of oper-
ating burners to keep the oil pressure in a good operating range. For such fire-
boxes, pressure alarms on the oil burner header can tell the operator when it is
approaching its pressure limits.

332 Burner Design

Section 500 discusses burner design and the need for burner testing. It is very
important that the safe operating range of the burner be well understood and
communicated in the operating procedures.

January 1998 300-10 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

Complex Combustion-Air/Flue-Gas Systems

NOx control also frequently adds a selective catalytic reduction (SCR) section to
the flue-gas ducting, with an economizer section downstream of the SCR section.
During the design stage, the operating cases (e.g., bypassing the economizer)
should be restricted to those that cannot blow out a burner with high air flow. Estab-
lish, using burner tests, the upper limit of acceptable air flow, preferably before the
furnace ducting designs are fixed.

333 Burner Isolation

Figure 300-4 shows that a number of fires have occurred as a result of leaks in the
fuel piping outside the firebox. These leaks often occur when the system is initially
being pressured up or when a burner is being lit. This piping should conform to the
appropriate Company piping classification whether it is supplied by the furnace
manufacturer or by others. Establish a method of positively isolating each burner
when it is not lit. This precaution prevents unburned fuel from leaking into the
firebox through that burner and creating the potential for a firebox explosion.
There are two primary ways to isolate individual burners:
1. Single block valve with an operator-turned blind
2. A double block and bleed system
Both systems are considered to provide positive isolation from the firebox. The
advantage of the double block and bleed system is that it avoids the potential for
fuel gas leaks at the blinds when the system is pressured up. No matter what type of
isolation system is used, the following principles apply:
• To facilitate maintenance and operation, valves, flanges, vent drains, unions,
and operating blinds should be easily accessible.
• The burner fuel shut-off valves adjacent to the burners must provide a positive
shut-off and be “fire resistant.” In many instances ball valves are used for
burner fuel shut-off because of their quick quarter-turn operation. Ball valves
can be considered to have acceptable fire resistance if the valve has passed API
Standard 607 “Fire Test for Soft-Seated Ball Valves.” This test subjects the
valve to actual fire conditions and certifies the valve is fire resistant by
measuring leakage during the fire test. Gate valves are normally considered to
be fire resistant because of metal to metal contact at the valve seating surface.
See Section 470 for additional information.

Burner Blinds
This section discusses burner blinds for both oil and gas burners.
Gas Burners. For this type of isolation, the operator must blind off every burner
that is not lit or being lit. Therefore, each burner must have a blind which is
designed to be accessed easily and turned quickly. The piping should be accessed
from grade or a platform so that there is ample room for the operator to move to a

Chevron Corporation 300-11 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

safe location if there is a fire. Refer to Standard Drawing GF-L99965, “Blinding

Guide for Refinery Equipment,” in the Piping Manual, for guidance on the location
of blinds.
As an exception, gas-fired furnaces having a large number (>100) of small burners
(3/4” or less) can be exempted from individual burner blinds if approved by the
appropriate Project or Operations Manager (consider this decision carefully).
Instead, burner header blinds are installed and two fire resistant ball valves are used
as burner blocks at each burner. After each header shutdown, the valves should be
proved leak-tight by pressure testing the burner header with inert gas before light-
off. Typically the valves should hold 50 psig for 30 minutes without dropping more
than 2 psig.
Oil Burners. A blind is not needed for an oil burner with an easily removable gun.
The operator should remove the oil gun in lieu of swinging the blind. Union blinds
are preferred over three-bolt swing blinds in sizes up to 1¾ inches because the
three-bolt blinds have more nuts to loosen and tighten. The operator needs only a
single wrench to turn the single nut of a union blind.

Single Block Valves

Every burner should have at least one fire resistant block valve immediately
upstream of its blind to block the fuel so that the blind may be swung.
Burner block valves should not be used to balance burner firing patterns. Block
valves should be either open or shut, but never pinched. If firing rates are reduced,
the pressure at a burner with a pinched valve may drop below the minimum stable
pressure and cause the burner to flame-out.
Assume that all single block valves leak. If such leaks are not small enough to
permit swinging blinds, replace the valve.
If oil burners are to be lit with a push-button light-off sequence, then each burner
may have an automatic single block valve for the oil to that burner. If kept in good
working order, single blocks are adequate to block fuel oil for the short time
between burner insertion and burner light-off. (Burners should be lit off as soon as
possible after insertion to avoid burner coking problems.)

Double Block and Bleed Valves

A manual double block and bleed system at each burner is an acceptable alternative
to the single block and blind system. The valves should be fire resistant quarter-turn
valves tested in accordance with API 607. The bleed system should be routed to
relief or to a safe location.
If gas burners are to be lit-off with a push-button light-off sequence, then each
burner should have an automatic double block and bleed for the gas to that burner.

Burner Header Blinds

As mentioned above, on large gas-fired furnaces with many burners, burner header
blinds may be installed to blind off groups of burners with a single blind. Blocking,
bleeding, and blinding the header lets the operator start purging the firebox while

January 1998 300-12 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

he closes the individual burner blinds or ball valves. This approach is normally not
practical for heavy fuel oil because header circulation should be maintained for
viscosity control.
Fifty-Foot Block Valves. Block valves are required on all fuel supply headers at
least 50 feet from the firebox to allow shutting off the fuel in the event of a firebox
fire which may engulf valves that are closer to the firebox. Only a single block is
needed, as the valve should only shut off fuel flow enough to swing the associated
blind. A gate valve or a fire resistant ball or butterfly valve is recommended.

334 Minimum Fire Bypass/Pilots

If the fuel control valve closes unexpectedly and reopens, unburned fuel can enter a
hot firebox resulting in a potential explosion. Consequently, minimum fire bypasses
or pilots are required on all furnaces.

Minimum-Fire Bypasses (MFB)

Most fireboxes have an MFB around the main fuel control valve. The objective of
the MFB is to admit enough fuel to keep the burners lit with stable flames when the
main fuel valve closes. The MFB can either be a manually adjusted globe valve or
restriction orifice valve, or it can be a fast-acting pressure regulator set to maintain
a minimum pressure on the fuel system. The pressure regulator must be designed to
open faster than the main control valve closes. The MFB is also often used during
start-up to light-off the first few burners. See Section 600 for more details.
If the furnace has a shutdown system, the MFB should be set to maintain the pres-
sure above the low fuel gas pressure shutdown set point. Regardless of the design,
there must be a system to test the MFB on a routine basis. The manually adjusted
MFB must be reset whenever more than 10% of the burners are either removed
from, or placed into service, and the valves must be car-sealed in the set position.

Pilot Burner
Alternatively, pilots may be used to maintain a flame at the burner. Be aware of the
limitations of the classes of pilots and of their respective abilities to relight oper-
ating burners. Section 600 discusses the various classes of pilots. The small pilots
supplied with some burners are able to light that burner only at minimum fuel
flows; but will not relight the burner at normal operating conditions.
The fuel source for the pilots should either be a separate source from the main fuel
supply, or should take-off upstream of the heater’s fuel control valve. The pilot fuel
should be equipped with its own pressure control and shutdown system.

Chevron Corporation 300-13 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

335 Protective Instrumentation

Section 600 has additional information on instrumentation and controls.

Fuel Pressure Control

Maintain the fuel system at a constant pressure to provide a stable source of fuel to
each furnace. A pressure control valve is normally installed on the main fuel header
upstream of a furnace or a group of furnaces.

Fuel Flow Control

Each firebox needs to have a system to control the flow of fuel to the burners. The
control valve needs to be designed for the full range of operating conditions for the
furnace. For larger furnaces (>50MM BTU/HR) the fuel control system should be
tied to the combustion control system so that the combustion air is increased before
fuel is increased.
Each firebox should also have flow indicators or recorders in the control room for
its total fuel gas or fuel oil usage. Fuel oil fired furnaces should also measure the
flow of atomizing steam. The operator uses the flow information to keep track of
the firebox heat release, particularly when manually operating the firing controls.

Alarms
At a minimum, the fuel system should be equipped with the following process
alarms independent of the control system:
• High level, fuel gas knockout pot
• Low pressure
• High pressure

336 Safety Shutdown Systems

Automatic safety shutdown systems are recommended where the furnace meets any
of the following conditions (see also, Section 320):
1. Operates with a heat duty over 50 MMBTU/hour
2. Poses a significant risk to people in the event of a tube failure
3. Heater is critical to plant operations based on a thorough review of process
requirements
Shutdown systems reduce the potential for injuries and equipment damage by shut-
ting down the furnace before an incident occurs. Several conditions which could
lead to a tube rupture or an accumulation of unburned fuel in the firebox (creating a
risk of explosion) may activate the safety shutdown system. Some of these condi-
tions are:
• Low process flow (either total flow or individual pass flow)
• Low/high fuel pressure
• Flame failure

January 1998 300-14 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

• Forced- or induced-draft fan failure

• Manual activation
Determine the actual conditions which activate the safety shutdown as part of a
Process Hazards Analysis. See the Instrumentation and Control Manual, Section
1300, “Process Alarms and Shutdown Systems,” for further considerations in
applying safety shutdown systems. See Section 650 for additional design consider-
ations related to safety shutdown systems.
Implement a system for in-service testing of the shutdown system. This includes
procedures and checklists, training, responsibilities, testing frequency, and docu-
mentation. Give high priority to correcting deficiencies.
Automatic safety shutoff valves for gas should be double “blocked and bleed” (to a
safe location) if they are to shut off all fuel to a burner. Automatic valves that shut
off only part of the gas to a burner may be single blocks. However, when these
single blocks are used as part of a total-gas-shut-off system, then the total-gas-
shutoff should be a double-block-and-bleed. Bleed valves must vent to a safe
location.

Remotely Operated Safety Shutoff Valves.

Safety shutoff valves should be selected with care for reliable (spring loaded) opera-
tion and positive, fire safe shutoff. Suitable valves include:
1. Spring operated safety shutoff valves with solenoid-tripped mechanical latches
(e.g., Maxon valves or equal) for clean, dry, and sweet fuels such as natural gas
and number 2 fuel oil
2. Either pneumatically operated safety shutoff valves with solenoid pilots or elec-
trohydraulic shutoff valves (e.g.,Hydromotor or equal) for general services,
including wet, dirty or sour services (e.g., process gas)
Carefully specify materials of construction for safety shutoff valves to avoid corro-
sion in close-clearances between moving parts. These valves stay in one position
for long times; corrosion in the close clearances can prevent the valve from stroking
completely when it is needed.

337 Waste Gas

Some furnaces burn waste gas from the process. This gas is essentially another
source of fuel to the furnace and requires the same level of protection.
Waste gas can also add contaminants in the flue gas which can be potentially corro-
sive to the tubes. Evaluate the corrosion potential when selecting tube materials and
developing an inspection strategy.
Provide the following protections for waste gas systems:
• Positive burner isolation in accordance with Section 332
• Safety shutdown in accordance with Section 336
• 50 foot isolation in accordance with Section 333

Chevron Corporation 300-15 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

• Flash back protection (i.e. flame arrestor)

Flame Arrestors
Waste gas can also contain air. Use a flame arrestor to prevent flashback into the
waste gas system if there is a possibility that the waste gas contains air. The arrestor
is designed to prevent flame from flashing back through the waste gas line into
another piece of equipment. The flame arrestor should be UL approved and
installed at the point where the line enters the firebox. See the Fire Protection
Manual, Section 1942, for additional information.

340 Design Features of Process System

341 Fifty-foot Isolation

All process streams should have isolation valves at least 50 feet from the firebox.
The isolation valves should be located in an area which will be safely accessible
during a fire.

342 External Piping

Design furnace piping so that the furnace tubes can be cleaned, drained and blinded
with no hydrocarbon spillage. Minimize flanges next to the furnace. If flanges are
needed, locate them at least 3 feet horizontally outside of the firebox so that mate-
rial will not leak into the firebox when the flange is unbolted.

343 Tube Design

Design furnace tubes for the expected service conditions and run life. Consult with
the fired heater and materials specialists before purchasing heater tubes. Document
the maximum tube temperatures in the SI Sheets and the furnace operating proce-
dures.
Historically, leakage at plugs on tube headers has resulted in many header box fires
and unplanned shutdowns. Where possible, replace existing headers/plugs with U-
bends internal to the firebox or seal welded. Use U-bends for new installations.

344 Protective Instrumentation

Process Flow Indication/Control
All process streams to the furnace should have flow indication and control which
maintains steady, controllable feedrates to the furnace. Multi-pass, furnaces with
single phase flow should have separate flow indication and low flow alarms on each
pass to prevent loss of flow in a pass.

January 1998 300-16 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

Minimum Stops on Pass Flow Control Valves

Furnaces which have individual pass flow control are more susceptible to loss of
flow due to the pass flow control valve closing. Since these valves are not required
for emergency isolation, they should be designed with mechanical stops to prevent
full closure.

Tube Skin Temperature Indicators

Tube skin temperature indicators give indiction of internal coking and low flow
conditions. Provide skin point TIs as follows:
• three TIs per radiant pass
• one TI per pass on radiant section shock tubes in hydrocarbon service if in
series with the radiant section—2 TIs per pass if not in series with radiant
section
• two TIs per pass in steam or boiler feed water service if there is no other indica-
tion of low flow
The exact number and location of TIs should be determined by a technical review
which considers the tube history, thermography results, furnace modelling, and the
life expectancy of the TI. Locate TIs where they can be monitored by thermography
to confirm the readings. See Sections 613 and 2126 for additional information.

Process Outlet Temperature Indicators

Most furnaces are designed to control the process outlet temperature. Furnaces with
multiple passes have temperature indicators on each pass as well as the combined
outlet. Temperature indication of each pass gives indication of a decrease in pass
flow or a heat input imbalance in the firebox. Temperature indication on the furnace
outlet is needed to protect downstream facilities, or to indicate a decrease in flow to
the furnace, or overfiring.

Alarms
As a minimum, the process feed should be equipped with the following process
alarms independent of the control system:
• Pass low flow for furnaces with single phase flow
• Low total flow for each process feed to the furnace
• High tube skin temperature
• High pass outlet temperature
• High combined outlet temperature

Shutdowns
As discussed in 321, decreasing heat input to the furnace on loss of flow signifi-
cantly reduces the risk of a tube rupture. Consequently, automatic shutdown of the
fuel should occur when the process flow rate decreases to a minimum point. The
design of the low flow shutdown should consider the following:

Chevron Corporation 300-17 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

• pre-alarms so that the operators have the opportunity to correct the low flow
condition
• the need to immediately decrease to minimum fires if low flow conditions exist
• a time delay (5-10 minutes) after the pre-alarm before shutdown occurs to
correct the low flow condition
• the rate of firing decrease needs to consider the effect on tube metallurgy and
the downstream process
See Sections 336 and 650 for more information on safety shutdown systems

350 Design Features of Firebox

351 Layout, Spacing and Drainage

Layout and Spacing
Because furnaces are an ignition source, give them additional spacing from other
process equipment handling flammable materials. Refer to the Fire Protection
Manual, Section 1300 for spacing guidelines for fired heaters. Place furnaces
upwind from that equipment, based on the prevailing wind direction, to reduce the
chance of the open burner flame becoming a source of ignition for any substances
released from other sources.
Because furnaces belong, by definition, in electrically unclassified locations, it is
often economically desirable to group all furnaces for a particular facility in one
area. Combined waste heat recovery systems also suggest this type of design.

Drainage
There is a high probability that any liquid hydrocarbon release near a furnace will
be ignited by the furnace. Therefore, it is important that the surface drainage be
designed to:
• quickly drain any spills into a closed drainage system
• prevent spills near a furnace from flowing under pipeways or around other
pieces of equipment
• prevent spills from other equipment from flowing around the furnace
These design features generally involve placing a high point in the grade between
the furnace and other pieces of equipment (including adjacent furnaces), and
installing gas-sealed catch basins to quickly drain a spill to the closed drain system.
Refer to the Fire Protection Manual, Section 1400 for additional information on
drainage.

January 1998 300-18 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

352 Purge Systems and Snuffing Steam

Purging
Firebox purging is performed prior to light-off to ensure no flammable vapors are
present. Furnaces with forced and/or induced draft fans generally purge with air
using the fans. Natural draft furnaces normally purge with steam. The design must
ensure that the purging volume and rate will be sufficient so that when a “zero”
percent reading is indicated on a combustible gas detector, the reading is indicative
of the entire firebox, including all gas passages, flues, and ducts.
For forced draft systems, a purge rate of not less than 25% of the full load volu-
metric air flow is recommended. It is suggested this minimum flow rate of air be
maintained for the time period used in NFPA-8502. That time period is the greater
of either: (1) 5 minutes; or (2) the time required for five volume changes of the
entire firebox and stack. For Chevron, the standard practice has been to purge for a
minimum of 15 minutes.
For natural draft furnaces, the purge steam system is normally used for purging.
The normal practice is to purge for 15 minutes or for 10 minutes after a steam
plume is seen at the top of the stack. Refer to Section 474 for purge steam design.

Snuffing Steam
The purge steam system can also be used for snuffing steam. Snuffing steam can be
effective in helping control or extinguish firebox fires, or in safeguarding a firebox
after a fire is extinguished. The purge steam valve should be clearly labeled and
located at least 50 feet away from the furnace. See Section 475 for guidelines on
snuffing.

353 Gas Test Points

Gas test points are openings in the fired heater that allow for combustible gas
testing prior to light-off. There should be enough points to allow for adequate
testing of the dead spaces throughout the firebox and flue ducting. These dead
spaces are usually in the upper corners of the firebox. See Section 475 for more
information.

354 View Ports

View ports are used to observe the condition of the firebox and radiant section tubes
while the furnace is in operation. Design and locate ports so operators can:
• View all of the burners
• View all of the radiant section tubes
• View a high percentage (80%+) of the tube surface area for furnaces in severe
or coking services
• Perform thermographic reviews of the tubes and the tube skin TI points

Chevron Corporation 300-19 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

Safe access needs to be provided to the view ports. For ease of opening and
increased safety, design the doors to open to the side.

355 Protective Instrumentation

Stack and Arch TI
Flue gas temperature indicators in the stack and arch are tools the operators can use
to determine if the firebox is beginning to bog down or if there could be a tube
rupture in the convection section.

Draft Indication
Firebox draft indication/monitoring prevents running any part of the firebox under
positive pressure which can cause structural damage and a personnel safety hazard.
Either field or board indication is acceptable. See Section 623 for more
information.

Damper Controls
All furnace dampers should be operable over the full range with accurate position
indication. Dampers should have a minimum stop to prevent full closure which can
cause a flame-out and high firebox pressure. See Section 450 for more details.

Combustion Analyzers
All process furnaces should be equipped with on line O2 analyzers. Process
furnaces with heat duties greater than or equal to 50MM BTU/HR should be
equipped with on line CO analyzers. The analyzers are used to: 1) monitor the
combustion process for potential bogging, and 2) optimize fuel efficiency. If
combustion control is used, it should be a “feed forward” design to prevent
bogging. See Sections 630 and 642 for more information.

Alarms
The following independent process alarms should be considered for the firebox:
• High stack temperature
• High firebox pressure
• Low O2/High CO
• FD/ID fan shutdown

360 Operating Considerations

Safe operation of fired equipment requires operator intervention at crucial
moments. Operating procedures must be written so that operators understand the
necessary actions for safe operation. The following general information should be
used only as guidelines in preparing or reviewing local operating procedures for
fired equipment.
In addition to the information in this section, consult the following:

January 1998 300-20 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

• Section 600, “Instrumentation and Control”

• Section 1300, “Process Alarm and Shutdown Systems,” of the Instrumentation
and Control Manual
• The CRTC Fired Heater Operations Guide (which can be obtained from the
CRTC Technical Standards Team) is an excellent resource for more informa-
tion on fired heater operation)

361 General Principles

Operating procedures should be written to ensure that:
1. Firebox operators are properly trained and supervised to safely operate a
firebox. Safety is based on proper operating procedures.
2. The operator will blind (or double block and bleed) fuel lines and all burners
that are not operating. Furnaces with a large number of small burners may be
an exception. In this case, ball valves may be closed at each non-operating
burner provided they are proved leak-tight by pressure testing the burner
header before relighting the first burner on it each time the header is shut down.
3. The operator will manually prepurge a firebox before lighting any of its
burners and manually postpurge it after extinguishing all burners. Steam will
be used to purge natural draft fireboxes; air will be used to purge forced- or
induced-draft fireboxes. Purging will be done manually, without protective
interlocks. Operating centers will train their operators and enforce safe purging
procedures that are consistent with the firebox manufacturer's instructions.
When the purge is complete, the operator will check the furnace atmosphere
for combustibles using a portable gas detector.
4. The operators will manually light or extinguish burners according to operating
center procedures. Burners will not be cross lit one from the other. It is essen-
tial to test the firebox atmosphere using a combustible gas detector before
inserting a lighting torch or lighting a pilot.
5. A safe automatic shutdown shuts off all fuel to the firebox and keeps combus-
tion air flowing as a purge. A manual postpurge with steam is recommended
for natural draft fireboxes and where forced- or induced-draft fans have failed.
Operations will not bypass automatic shutdowns except for testing/mainte-
nance.
6. For plants in which the operator cannot respond rapidly to changed firing or
process conditions, automatic shutdowns are recommended.
7. All protective alarm and shutdown devices and all minimum-fire controls will
be designed and constructed to permit checking without having to shut down
the firebox. Operators will test alarms and shutdowns on a regular basis, and
discrepancies will be corrected promptly.
8. Burners will be factory or field tested to determine the safe operating envelope
of fuel and air rates and that all possible firebox operating conditions fall

Chevron Corporation 300-21 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

within the safe envelope. The firebox and related systems will be designed to
operate at all times within this safe envelope without excessive reliance on
automatic protective systems.

362 General Guidelines for Safe Firing of Furnaces

Appendix D of this manual is reproduced from the Richmond Refinery Standard
AR-9025, “Safe Firing of Furnaces and Boilers.” It has been generalized as a refer-
ence document for other locations preparing operating procedures for safe firing.

363 Start-up Checklist/Monitoring

A high percentage of furnace incidents occur on startup. Consequently, a detailed
step-by-step procedure for starting up the furnace and increased operator moni-
toring are needed to avoid conditions which could lead to accumulating unburned
fuel in the firebox before lightoff, or a tube rupture from low flow or overfiring on
startup.
There should be a startup checklist with sign off for each furnace. At a minimum,
the checklist should include:
• testing critical instrumentation (e.g., skin TIs, SSD, alarms) prior to S/U
• drawing showing gas sample points
• firebox purging and gas testing
• establishing and ensuring stable process flows
• light off steps
• burner lighting sequence
• heatup steps/milestones
• monitoring of critical process variables during heatup
Each furnace should have a means to record critical furnace/plant parameters (e.g.,
flowrates, temperatures) with increased frequency during startups. This can be in
the form of:
• Startup run sheets
• Specific furnace DCS printouts
• Part of the detailed checklists where critical parameters are recorded
During startup, the supervisor needs to review these startup records to assure
furnace conditions are within plant/furnace limits.

364 Emergency procedures

Provide the appropriate written emergency procedures for shutting down and
isolating the furnace safely to: 1) protect the furnace and personnel, and 2) mitigate
the size of an incident. At a minimum, the procedures shall include the following:
• Tube rupture (including the use of snuffing steam and deinventorying the down-
stream process)

January 1998 300-22 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

• Emergency shutdown (power outage, loss of feed, etc.)

Operators shall train on these emergency procedures on a regular basis.

365 Operating Limits

Each furnace shall have an updated SI Sheet showing all critical operating limits,
including the following:
• Maximum tube skin temperature
• Maximum and minimum burner pressures
• Maximum stack and/or arch temperatures
• Minimum process-side flow rates
• Maximum heat release or maximum fuel gas rate (for coking services)
• Spread of pass outlet TIs (optional)
• Maximum outlet temperature
The limits should also be documented in the operating procedures so that they are
understood and adhered to at all times. The SI Sheet and instructions are included
in this manual and are available on the Technical Standards website.

366 Normal Operation

Furnace operators should observe and comment on elements of safe furnace opera-
tion at least twice each shift. Examples include:
• critical process variables are within operating limits
• no positive draft
• no flame impingement
• sufficient combustion air
• no hot spots on tubes
• all tube supports in place
• no excessive tube vibration
• no burning behind refractory (dirty burners)
• no pinched burners
• no debris blocking burners
• uniform heat distribution
• no leaks

367 Inspection/Maintenance
Each furnace should have an inspection plan which addresses the predicted corro-
sion mechanisms and tube metallurgy. Conduct the necessary inspections to predict
furnace condition in order to avoid unexpected failures. Maintain adequate histor-
ical records so that you can predict the condition of the furnace tubes. See
Section 900 for additional information.

Chevron Corporation 300-23 January 1998

300 Firebox Safety Fired Heater and Waste Heat Recovery

Thermography
Thermographic inspections can be effective in supplementing operator surveillance
for determining:
• locations of hot spots on the tubes
• areas of combustion imbalance in the furnace
• areas of air leakage into the firebox
• areas of possible refractory damage
Critical furnaces should have a plan for periodic thermographic reviews. See
Section 600 for more information.

370 Fired Heater Safety Best Practice

Appendix F contains the Fired Heater Safety Best practice developed in Refining.
Contact the CRTC Fired Heater expert for an audit based on this best practice.

380 Upstream Fired Heater Safety

Analysis of fired heater fires in upstream operations is summarized in Figure 300-5.

Fig. 300-5 Fired Heater Fires - Upstream 1987-1996

35 $1,060M

30
Totals: 60 Fires, $2.5MM Loss, 4 Injuries
25
Number of Fires

20 $737M

15

$665M
10

0
External Tube Firebox
Fire Rupture Explosion

Tube Ruptures
In Upstream, 90% of the tube ruptures appear to be related to the lack of an inspec-
tion strategy designed to predict the fired heater’s condition before it fails.

Firebox Explosions
Similar to downstream process furnaces, the majority of firebox explosions
occurred during start-up. Rigorous start-up procedures will help to prevent the accu-
mulation of combustible vapors in the firebox before lightoff.

January 1998 300-24 Chevron Corporation

Fired Heater and Waste Heat Recovery 300 Firebox Safety

Many upstream fired heaters have automatic start-up and combustion control
systems which include pre-purges, automatic ignition of a pilot, automatic shut-
down on loss of flame, and post purges. In general, these systems have operated
very well. However, incidents have occurred because of changes to the systems
which were not managed properly or because of manual intervention into the start-
up process (i.e. closing a damper).

External Fires
The three top causes of external fires in upstream applications are: 1) Fuel leaks, 2)
process leaks, and 3) liquid carryover into the firebox (which causes burning
around the firebox). See Figure 300-6.

Fig. 300-6 External Fires on Fired Heaters - Upstream 1987-1996

14 $143M
12
$882M
Number of Fires

10

8
$4M
6

4 $30M

2 $1M

0
Fuel Leak Process Liquid Design
Unknown
Fluid Leak Carryover

Keys to preventing or mitigating these leaks include:

• Operator surveillance to identify and eliminate leaks
• Designs which minimize leakage points (i.e flanges, vents, etc.) close to the
firebox
• Inspection processes to identify corroded lines before they fail
• Increased operator surveillance and testing of the liquid knockout system
upstream of the furnace
• Maintaining the area around the heater free of combustible material which can
add fuel in the event of a fire on the heater

Chevron Corporation 300-25 January 1998