Process Safety · Lesson 45 · 8 min read

A Running Deluge Pump Does Not Prove Fire-Area Protection

A firewater pump can start, a deluge valve can open and header pressure can look normal while the protected equipment still receives too little water in the wrong places. The barrier claim is delivered flow and coverage at the hazard—not merely movement in the pump house.

Why pump operation is not protection

Deluge is one part of a fire-and-explosion protection strategy. Depending on the scenario and design basis, it may cool exposed equipment, limit heat effects, support access or help prevent escalation while isolation and depressurisation reduce the fuel. It does not replace release prevention, emergency shutdown, passive fire protection or evacuation arrangements.

Performance can be lost anywhere between water source and target. A pump may run against a partly closed valve. Strainers, branch pipework or nozzles may be obstructed by corrosion products, marine growth or debris. Nozzles can be damaged, misaligned or shielded after plant changes. Distribution can be uneven, and a system that looked satisfactory at commissioning can degrade between tests.

That is why a single indication—pump status, header pressure or an open-valve signal—does not demonstrate the complete function. The installation needs evidence against its own scenario-based performance standard: sufficient water must reach the intended surfaces, with the required distribution and within the required time.

HSE guidance: measure flow and coverage

HSE's offshore inspection guide for hydrocarbon active fire protection tells inspectors to look for functional testing that fulfils the relevant performance standard, including measurement of flow and coverage. It also warns that a first-time performance failure can show that blockage, corrosion or marine growth developed between tests, meaning the system would not have operated effectively on demand. Records and trend review matter because passing one test does not establish future availability. [1]

HSE's PFEER guidance places fire-and-explosion measures within defined performance standards and verification arrangements. The practical question is therefore not “Did water come out?” but “Did the system achieve the claimed protection for the credible event?” [2]

Official incident: the activation point was inside the danger

After the 2007 Valero McKee refinery fire, the U.S. Chemical Safety Board found that first responders could not activate the deluge system intended to protect LPG spheres because the activation valves were too close to the fire. Without deluge protection, a sphere was vulnerable to loss of metal strength from overheating. In January 2026 the CSB closed its related recommendation after industry guidance was revised to address effective activation during emergencies originating in nearby process units. [3]

This incident is not proof of the arrangement or risk on any offshore installation. Its transferable lesson is direct: a deluge system is not available if people must enter the hazard it is meant to control in order to start it.

Hypothetical FPSO example: pressure passes, coverage fails

Hypothetical example—not a documented incident: During a planned FPSO deluge test, the pump starts and the ring-main pressure meets the expected test condition. Water discharges from every visible nozzle. However, the authorised measurement method shows weak delivery on the leeward face of one separator. Several nozzles are partially obstructed and a recently installed access platform changes the spray pattern.

The team declares the affected barrier impaired, applies the installation's authorised operating restrictions and repairs the defects. They repeat the end-to-end test against the performance standard, review other zones with similar nozzles and check whether the platform change passed through the required fire-protection review. They do not accept pump pressure as a substitute for target coverage. This example provides no universal flow rate, pressure, test interval or permission to test an operating system.

Critical controls

Scenario-based performance standard. State what equipment and surfaces must be protected, the required response time, flow, distribution, duration, availability and environmental conditions. Connect those claims to the current fire-and-explosion assessment.

End-to-end functional testing. Exercise the authorised initiation path, valves, pumps, distribution network and nozzles far enough to demonstrate the claimed function. Measure at the target using the site's approved method; do not infer coverage from header readings alone.

Safe, reliable activation. Confirm that automatic, remote and manual activation arrangements match the design basis and remain accessible under credible fire conditions. Include power, control, communications and human response in the proof.

Condition and impairment control. Inspect strainers, pipework, supports and nozzles; trend results; investigate deterioration; and manage every unavailable or degraded zone as a barrier impairment. Repaired defects need a verified close, not only a completed work order.

Test consequences. Plan drainage, containment, electrical exposure, dropped-object risk, corrosion and operational interaction before flowing water. A test must not create a new hazard or compromise other safety-critical equipment.

Leadership actions

Leaders should ask to see evidence from the protected area, not only pump run records. Review overdue coverage tests, repeated nozzle blockages, zones accepted with compensating measures and discrepancies between drawings and the field. When one zone fails, require a documented search for common-cause conditions elsewhere. Provide isolation windows, access and specialist support so the team can test the real function safely.

Three practical actions

• Trace the claim: choose one deluge zone and connect its fire scenario, performance standard, activation path and latest measured coverage result.
• Walk the target: look for obstructed, damaged or misaligned nozzles and plant changes that could alter spray distribution or access.
• Challenge assurance: verify that failed or overdue tests trigger impairment controls, root-cause review, similar-zone checks and an end-to-end retest.

Official video: Fire From Ice

The official CSB video reconstructs the Valero McKee fire. For this lesson, focus on the escalation-control problem: personnel could not safely reach local equipment and deluge activation points as the fire intensified. View the official CSB video page.

Takeaway and team discussion

Key takeaway: a running pump proves activity; measured delivery and coverage prove protection.

Discussion question: which deluge zone on our installation has the weakest current evidence that water will reach the critical surfaces under the fire scenario it is meant to control?

Continue in the Process Safety hub, and connect this lesson with passive fireproofing, end-to-end gas-detection performance, shutdown-system resilience and barrier assurance.

Verified primary references

1. UK HSE: Hydrocarbon Active Fire Protection—Offshore Inspection Guide—official guidance on functional testing, flow and coverage measurement, records and deterioration.
2. UK HSE: Prevention of fire and explosion, and emergency response on offshore installations (L65)—official PFEER ACOP and guidance on performance standards and fire-protection measures.
3. U.S. CSB: Valero McKee deluge-system recommendation status summary—official finding on inaccessible activation valves and the resulting exposure of an LPG sphere.
4. U.S. CSB investigation page: Valero McKee Refinery Propane Fire—official incident summary, report and recommendations.
5. U.S. CSB official video: Fire From Ice—official incident animation and safety lessons.

Published and sources checked 27 October 2026. Educational discussion only: apply the installation's approved fire-and-explosion strategy, performance standards, impairment, management-of-change, test, isolation and operating procedures. No universal flow, pressure, duration, coverage or test interval is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates