C&PE 624 Plant & Environmental Safety Lectures 4/5 PROCESS HAZARDS MANAGEMENT 1/21-23/98 - Spring 1998

THOUGHT The management of a balance of power is a permanent undertaking, not an exertion that has a foreseeable end. (Henry A. Kissinger, White House Years, 1979) QUESTION If management of risk is a continual undertaking, would the process be more efficient and successful if our frame of mind changed? PURPOSE To begin the practice of process hazards management and to develop the skill of determining what could go wrong.

These two lectures are based on the Chevron Video Tape which presents the API 750 Recommended Practice for the Management of Process Hazards. The lecture is structured around the tape with discussion coming intermittently during the course of the tape. I feel that it is important for the students to interact here. So I have structure the lectures around the 3-minute brainstorming sessions. It is important to start having the students think in terms of transients. During Process Dynamics and Control, they should have gotten a feel for the need to consider transient operation but the focus was still on maintaining steady state performance. Here, I want them to think of what could go wrong when a process goes through a transient. Similar to my view that engineers should think that they are wrong unless they can prove that they are correct, I want them think about what the process could do. I believe that this is necessary so that they can think about what is necessary if the control scheme fails or if human error comes into play. Therefore, I present
1 CSH 1/21/98

this video by presenting the case study, stopping the tape and asking them what happened. Keep in mind that the tape case studies are actual events. Once the class has had time to discuss the case study, I ask for proposals and then summarize.

Video Tape Risk increases because of the increased complexity and increased size of our plants. The complexity increases the probability for an event and the size increases the consequence. Our safety systems must recognize this. The safety procedures protect people, facilities and the community. It is important to recognize and for the students to be sensitized to the fact that public attention of our accidents is increasing. In addition to the increased losses, the public attention is one of the motivations for API 750.

Need for Process Hazards Management There are three criteria for establishing whether API 750 is necessary. 1. Flammable Substances: If a process contains 5 tons of material that could be released quickly, API 750 may be necessary. There is an example of an LPG tank measuring 6' x 10' as an example. This is a very small inventory. 2. Toxic Materials: The video introduces the Substance Hazards Index (SHI). If the SHI>5000, then API 750 is necessary. SHI = EVC@20 / ATC The EVC is the equilibrium vapor composition at 20 C and is therefore related to the vapor pressure. The ATC is the Acute Toxicity Concentration. This is a measure of the effects in people.
2 CSH 1/21/98
o o

3.

Injury and Environment: The last criterion is an evaluation of whether an accident could cause injury to the public or could cause damage to the environment. In other words, is the plant located near a population center or near an environmentally safe area?

An example, is NH3 has an SHI of 1000.

API 750 Introduction There are eleven parts to API 750. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. Process Safety Information Operating Procedures Mechanical Integrity Process Hazards Analysis Safe Work Practices Training Management of Change Pre-Start-up Safety Review Emergency Response Incident Investigation Audit

Many of these have a case study included that allows for discussion with the class. There is a large amount of information given in the tape, in general, consequently, the tape should be stopped from time to time to discuss what the host of the tape said.

1. Process Safety Information

3 CSH 1/21/98

Case Study:This is the undocumented line between a fuel oil storage and a diesel source. The Fuel Oil is heated. The valve is inadvertently left upon which allows diesel to enter the tank. Diesel is lighter than fuel oil that increases the pressure in the API tank. These tanks cannot hold pressure so consequently the tank is over-pressured, ruptured and a fire starts.

This is the foundation of Process Hazards Management. The information must cover Hazardous Materials Information, Process Design Information and Mechanical Design Information. The employees must understand the information. The first is given on the MSDS. I need to make sure that they have MSDS during the course of this semester and discuss the contents. Examples of material on the MSDS are toxicity, stability, compatibility etc. Not mentioned on the tape include combustion products. The process design information includes information on chemistry, limits of operation, safety consequences for excursions, possible deviations etc. The Mechanical Design Information is principally embodied on the P&ID's. It is important that the information be up-to-date, that it is accurate and that it is used in training. I pointed out that many will have their first assignment tracing lines in their plants.

2. Operating Procedures Case Study:Cone Bottom Tank with Circulation Pump In this case, an operator used the discharge pump for circulation while the oil contained in the tank was being heated. This was an
4 CSH 1/21/98

undocumented practice. When he left, the new operator only operated the pump when the tank contents were drained. Unfortunately, the tank bottom was cone bottomed with the discharge line protruding up above the bottom. Without circulation during heating, water built up, touched the coils and vaporized. This over-pressured the tank and caused a fire.

There was a lack of written operating procedures. The procedures must specify who is responsible, specify the safe operation under normal and emergency conditions and the consequences of deviation. You must insure that there are no discrepancies between actual operation and that prescribed in the operating procedures.

3. Mechanical Integrity Case Study:This case has a no flow alarm on the process feed to a process furnace and an automatic shutdown valve in the fuel feed line. Presumably, although it is not stated in the tape, the emergency shutdown is tied to the no flow process alarm. The alarm had not been tested and consequently when the flow stopped, the alarm did not go off. Also, the shutdown valve did not close. Consequently, the heating continued causing a line to rupture and damage the furnace. It is an opportune time to point out that furnaces provide heat to the process but they also take heat away via the process. Get the students to look at processes from more sides than the process side.

5 CSH 1/21/98

The quality and integrity is important. The process needs to be built, installed and maintained according to standards. Critical equipment needs to be identified and listed. The equipment must be inspected regularly.

4. Process Hazards Analysis Case Study:In this case there are two feeds going to a tank. There is a process failure in one of the lines causing the feed to enter the tank cold. This did not present a problem because the other feed was still being heated. However, subsequently and unrelated to the first failure, there was a failure in the other process. Consequently, very cold feed entered the tank. This shocked the tank causing the tank to rupture due to cold embrittlement.

This is an introduction to the HAZOP, Fault Tree and Event Tree analyses that I will cover later in the semester. Basically, this step asks the following questions: What are the potential failure scenarios? What are the consequences? What is the effect on the population? What can be done to reduce the probability and/or consequences? How much material could be released? There are set procedures to help ask these What If questions. This is one of the more difficult aspects for students to appreciate, i.e. what can go wrong. Students have a predilection to believe that processes will operate as designed by them and as intended.

5. Safe Work Practices

6 CSH 1/21/98

Case Study:This is the Marathon Oil Incident in Texas City. Basically, a crane operator was hoisting a furnace bundle over the HF plant. He lost control, the bundle fell and severed an HF vapor line. The town was evacuated. This is one of the case studies that I will present later discussing the news media presentation of the event.

This is probably one of the more fertile areas of discussion because most of the students are not familiar with operation. Examples of areas for discussion are opening of process vessels, equipment lockout procedures, ignition sources, confined spaces and heavy equipment operation. I have numerous examples to discuss here including those found in Kletz' book.

6. Training Case Study:This presents an important problem related to operation. Basically, an LPG vessel began to over-pressure when a relief valve failed to open to relieve the pressure. The operators in an effort to reduce the pressure opened a valve at the bottom of the sphere. The flash across the valve caused the temperature to decrease and the valve to freeze open. Consequently, a large volume of LPG was release resulting in a vapor cloud explosion. Operators should have been trained to know that relieving liquid will not reduce the pressure. Further, they should have been trained in the potential for freezing of the valve.

7 CSH 1/21/98

The operators need to have knowledge and skills to safely operate the plant. The job qualifications need to be carefully specified. The operators need to be trained and they need to go through retraining. Finally, it is important to recognize that changes in the process cause the need for retraining.

7. Management of Change Case Study:This uses Flixborough as the example. (I believe that this is one of the most difficult aspects of safety. Plants change frequently with new tie-ins, minor modifications etc. Rarely are the changes well documented in all of the operating manuals and P&ID's. This results in inconsistencies and potentially increases the probability from human error.) Flixborough had two errors. The first was using a water spray to try to keep the temperature under control of one of the six reactors. This was not part of the original design. This potentially resulted in the formation of a crack in the reactor. It was taken out of service and a piece of pipe put in its place. While the pipe was supported by scaffolding, during operation it actually raised off the supports indicating stress in the pipe. This stress ultimately caused a failure of the expansion bellows releasing cyclohexane into the atmosphere. An unconfined VCE was the result causing complete destruction of the plant.

Change can result from feedstock changes, equipment changes and operation changes. Examples of technological changes could be in the process or mechanical. Other
8 CSH 1/21/98

changes might be "Not-In-Kind" replacement that may need to be operated in a different manner. Changes may introduce new complexity into the process. Foresight and Planning are most important in this step. This may include process hazards analysis in advance of the change.

8. Pre-Start-up Safety Review Case Study:There was a block valve in a line between the vessel and the relief valve. These block valves are important so that the relief valve can be maintained. However, during normal operation it is to be open. In this case, it was not. Consequently, the vessel over-pressured and failed. A pre-start-up safety review would have contributed to increasing the probability that the valve would be open. The class can be asked what should be done. I can discuss car sealing open valves.

The purpose of this step is to insure that there are no discrepancies between operation and P&ID's. This is a critical step. It is important to ensure that all construction specifications have been met.

9. Emergency Response Case Study:This is an example of emergency response where there was a fire. The fire fighters did not know that they were not to put water on the fire and they were to maintain a foam cover on the escaping gasoline. Ultimately, the water weighed down the roof of the storage vessel increasing the loss of
9 CSH 1/21/98

gasoline. The foam barrier was broken and the fire flared up trapping temporarily fire fighters. This video is exciting in that it shows the fire fighters being caught. I can also elaborate using Minot, North Dakota as another example with the fire at Westchem Agricultural Chemical warehouse.

This step should be comprehensive covering small to the large. It is important to have drills so that personnel are prepared.

10. Incident Investigation This covers the aspects that events and near misses should be investigated to that the plant can learn from the events. This basically concludes that investigations are necessary to learn. I have assigned homework where students record and investigate their near misses over the course of a week. They are surprised about the number of misses.

11. Audit Basically, a breakdown in any of the previous 10 steps can result in an accident. Consequently, an audit is necessary periodically to insure that the steps are followed. The findings of the audit should be documented.

Afterword This is not a one-time program. The underlying belief is that events are avoidable.
10 CSH 1/21/98

Commitment to Process Hazards Management will lead to success in avoiding loss and to regaining the public confidence in our industry. From here, I intend to discuss consequences and public perception of our industry.

11 CSH 1/21/98