What Went Wrong Part 13 pps

Reverse Flow and Other Unforeseen Deviations 333 A seemingly minor backflow from a reactor occurred on an ammoni- um nitrate plant, but it led to an explosion. The two reactants, nitric acid and ammonia gas, entered the titanium reactor through separate spargers, and a corresponding amount of ammonium nitrate solution overflowed into a rundown tank. When the plant was shut down for a minor repair, some ammonium nitrate solution flowed backward into the nitric acid sparger and mixed with the acid. Most of it was blown out when the nitric acid line was emptied with compressed air, but a small amount of the ammonium nitrate solution was trapped and left behind. Steam was blown through the acid line to keep the vessel waim. After about nine hours, the sparger exploded, and the explosion spread to the rest of the reactor and the rundown tank. The blast damaged an ammonia tank, and people living within seven miles had to leave their homes. The main rec- ommendations in the report were to redesign the sparger so that liquid could not be trapped in it and avoid the use of titanium, as it increases the sensitivity of ammonium nitrate [ 17,181. Reference 14 reviews other ways of preventing backflow. 18.5 REVERSE FLOW FROM DRAINS This has often caused flammable liquids to turn up in some unexpect- ed places. For example, construction had to be carried out next to a com- pound of small tanks. Sparks would fall onto the compound. Therefore all flammable liquids were removed from the tanks while the construc- tion took glace. Nevertheless a small fire occurred in the compound. WBter was being drained from a tank on another part of the plant. The water flow was too great for the capacity of the drains, so the water backed up into the compound of small tanks, taking some light oil with it. This oil was ignited by welding sparks. Another incident occuned on a plant that handled liquefied vinyl chlo- ride (VC) (boiling point -14°C). Some of the liquid entered a vessel through a leaking valve. and the operator decided EO flush it out to drain with water. As the VC entered the drain it vaporized, and the vapor flowed backward up the drainage system: white clouds came out of bari- ous openings. Some of the VC came out inside a laboratory 30 rn away. as the pressure was sufficient to overcome the level of liquid in the U- bends. The VC exploded, injuring five people and causing extensive damage. The amount that exploded was estimated as about 35 kg [ 151. 334 What Went Wrong? 18.6 OTHER DEVIATIONS (a) Figure 18-6 shows part of an old unit. Valve A could pass a higher rate than valve B. Inevitably, in the end the lower tank overflowed. (b) Raw material was fed to a unit from two stock tanks, A and B. A was usually used; B was used infrequently. The raw material was pumped to a head tank from which excess flowed back, as shown in Figure 18-7. The system was in use for several years before the Figure 18-6. Valve A could pass a higher rate than valve B, thus making a spillage inevitable. To plant A (Usually used) B (Used infrequently) Figure 18-7. If A is full and suction is taken from B, A will overflow. Reverse Flow and Other Unforeseen Deviations 335 inevitable happened. Tank B was in use; tank A was full, and the flow from the head tank caused it to overflow. (c) A funnel was installed below a sample point so that excess liquid was not wasted but returned to the process (Figure 18-8). What will happen if a sample is taken while the vessel is being drained? The design errors in these cases may seem obvious, but the diagrams have been drawn so that the errors are clear. Originally they were hidden among the detail of a ‘*spaghetti bowl” drawing. To bring the errors to light, it is necessary to go through line diagrams systematically. line by nine and deviation by deviation. as described in the next section. 18.7 A METHOD FOR FORESEEING DEVIATIONS The incidents listed earlier in this chapter and many others could have been foreseen if the design had been subjected to a hazard and operabili- ty study (hazop). This technique allows people to let their imaginations go free and think of all possible ways in which hazards or operating problems might arise. But to reduce the chance that something is missed, To next vessel Sample -=-I Y Figure 18-8. What will happen if the vessel is drained while a sample is being taken? 336 What Went Wrong? hazop is done in a systematic way, each pipeline and each sort of hazard being considered in turn. A pipeline for this purpose is one joining two main plant items-for example, we might start with the line leading from the feed tank through the feed pump to the first feed heater. A series of guide words are applied to this line in turn, the words being: NONE MORE OF LESS OF PART OF MORE THAN OTHER NONE, for example, means no forward flow or reverse flow when there should be forward flow. We ask: Could there be no flow? If so, how could it arise? What are the consequences of no flow? How will the operators know that there is no flow? Are the consequences hazardous, or do they prevent efficient operation? If so, can we prevent no flow (or protect against the consequences) by If so, does the size of the hazard or problem justify the extra expense? changing the design or method of operation? The same questions are then applied to “reverse flow.” and we then move on to the next guide word, MORE OF. Could there be more flow than design? If so, how could it arise? And so on. The same questions are asked about “more pressure” and “more temperature,” and, if they are important, about other parameters, such as “more radioactivity” or ”more viscosity.” PART OF prompts the team to ask if the composition of the material in the pipeline could differ from design, MORE THAN prompts them to ask if additional substances or phases could be present, and OTHER THAN reminds them to consider startup, shutdown, maintenance, cata- Reverse Now and Other Unforeseen Dewiati,ons 337 14 st regeneration, services failure, and other abnormal situations. For more detailed accounts of hazop, see References 5 through 10. 18.8 SOME PITFALLS IN HAZOP The success of a hazop in identifying hazards depends on the knowl- edge and experience of the team members. If they lack knowledge and experience. the exercise is a waste of time, The following incidents show how an inexperienced team can miss hazards. (a) Figure 18-9 shows a floating-roof tank located in a dike. Rainwater can be drained from the roof into the dike and from the dike into a waterway. The team members are considering whether any sub- stance other than water can get into the waterway. For this to occur. there would have to be a hole in the hose, and both valves would have to be left open. An inexperienced team may decide that a triple failure is so improbable that there is no need to consider it further. Someone with knowledge of the practicalities of plant operation would realize that during prolonged rain the operators may leave both drain valves open, whatever the instructions say, to avoid frequent visits to the tank. Any hole in the hose will then contaminate the waterway with oil [20]. (b) According to a design, an explosive powder had to be rransferred in a scoop. The hazop team realized that this could lead to the for- To waterway - pound vahe Used nwA per-inissiori from Hydrocarbon Processing, Apn 1992. Copyright 0 1992 G~llf Pitblishbig Co. .411 rights resenwl. i Figure 18-9. Liquid other than rainwater can reach the waterway oniy if there is a hole in the hose and both valves are left open. This is not as unlikely as it seems at first sight. 338 What Went Wrong? mation of an electrostatic charge on the powder and scoop and decided that a metal scoop would be safer than a plastic one. No one realized that if the operator was not grounded, a conducting scoop would increase the risk of ignition, as the charge could pass as a spark from the scoop to ground. A spark from a nonconducting plastic scoop would be less likely to occur and less energetic if it did occur [21]. The best solution is not to use an open scoop. (c) During the final purification of a product, a small amount of an oxidizing agent had to be added to a much larger amount of hydro- carbon. The reaction between the two substances was known to be highly exothermic and is listed as such in the standard work on the subject, Br-etherick’s Handbook of Reactive Chemical Hazards [22]. However, not one member of the team knew this, and none of them was sufficiently aware to consult this standard work. (Like the men who designed the temporary pipe at Flixborough (Section 2.4 a), they did not know what they did not know.) An explosion occurred after a few months of operation [21]. In all three examples, the senior managers of the companies involved were committed to safety, but the staff lacked the necessary knowledge and experience. It was not necessary for the whole team to have been aware of the hazard. One member’s awareness would have been enough, so long as the other team members were willing to listen. It was not nec- essary for him or her to be fully conversant with the details of the hazard, so long as concerns were followed up. 18.9 HAZOP OF BATCH PLANTS When studying a batch plant, the guide words should be applied to the instructions as well as the pipelines. For example, if an instruction says that 1 ton of A should be charged to a reactor, the hazop team should con- sider the effects of the following deviations: DON’T CHARGE A CHARGE MORE (OR LESS) A CHARGE AS WELL AS A CHARGE PART OF A (if A is a mixture) CHARGE OTHER THAN A Reverse Flow and Other Unforeseen Deviations 339 REVERSE CHARGE A (That is. can flow occur from the reactor to the A storage .vessel [see Section 18.4]?) A IS ADDED EARLY (OR LATE) A IS ADDED TOO QUICKLY (OR SLOWLY) Here are three examples of hazards uncovered during hazops of batch processes: 0 During the hazop of a batch reaction, when discussing the guide words AS WELL AS A, someone asked what contaminants could lead to a runaway reaction. Another member said organic acids could do so. Other members remarked that organic acids were used in another process and were stored in similar drums in the same ware- house. This example shows how hazop is able to combine the knowl- edge and thoughts of different team members [23]. During the hazop of another batch process, when discussing services failure. the team members realized that a power failure would result in the loss of both agitation and cooling and that at certain stages of the process this could lead to a runaway reaction. They decided to use town water for emergency cooling and nitrogen injection €or emergency agitation [23]. 0 During the hazop of a proposed experimental rig, it came to light that one of the reactants was hydrogen cyanide, supplied in cylinders, and the designers expected the operators to convey the cylinders to the top floor of the building in the elevator. Toxic or flammable gases and people should never be together in a confined space. * A large distillation column in a refinery operated at high vapor loads, just above atmospheric pressure. It was not designed for vacuum and so had to be protected if the heat input from the reboiler failed but condensation continued. An inexperienced hazop team might have accepted without comment the original design intention, which was to break the vacuum with fuel gas (or nitrogen if available). A more experienced team might have realized that the volume of gas required was enormous but that it could be reduced to a manageable figure by locating the vacuum breaker valve at the inlet to the con- densers, thus blanketing them and reducing heat transfer [24]. 340 What Went Wrong? 18.10 HAZOP OF TANK TRUCKS Hazop has been applied mainly to fixed plants, but application of the technique to tank trucks used for carrying anhydrous ammonia and liquid carbon dioxide disclosed a number of hazards [ 111. 18.10.1 More of Pressure Use of this guide word brought out the fact that if there was a leak on the filling line, there was no way of preventing the contents of the tank truck from flowing backward into the filling line and out to the atmosphere unless the leak was so big that the excess flow valve on the tank truck would operate. This will not occur unless the flow is at least 1%-2 times the normal flow. A remotely operated emergency isolation valve prevents flow from the plant. It was therefore decided to install compressed air cylinders on the tank trucks to operate their internal valves; the cylinders were connected to the plant emergency valve system so that when this was operated, the emergency valves on the tank truck also closed. As a bonus, the internal valves also close if the tanker is driven away while still filling. The tank ti-ucks were not fitted with relief valves-normal European practice for toxic liquids. The study showed that the plant was designed for a higher pressure than the tank trucks and that in certain circum- stances they could be overpressured. Modifications were made. 18.10.2 Less of Temperature Some of the older tank trucks were made from grades of steel that are brittle at low temperatures, and they are never moved at temperatures below 0°C. It was discovered that some customers wanted liquid carbon dioxide delivered at less than the usual pressure, and arrangements had to be made for them to be supplied only by selected tank trucks. (All new tank trucks are capable of withstanding the lowest temperatures that can be reached.) 18.10.3 More Than Some customers complained that there was oxygen in the ammonia. It was found that the road transport maintenance department was preparing tanks for repair by washing them out with water and then returning them Reverse Flow and Other Unforeseen Deviations 341 to the plant full of air. The oxygen could cause stress corrosion cracking. Arrangements were made for the plant staff to take over responsibility for preparing tank trucks for repair. REFERENCES 1. T. A. Kletz, Hydrocarbon Processing, Vol. 55, No. 3, Mac 1976, 2. T. A. Kletz, Learning from Accidents, 2nd edition, Bulterworth- Ti. D. B. de Oliveria, Hydrocarbon Processing, Vol. 52, No. 3, Mar. 4.1. E. Troyan and R. Y. Le Vine, Loss Prevention, Vol. 2, 1968, p. 125. . G. Lawley, Chemical Engineering Progress, Vol. 70, No. 4, Apr. 6. Hazard and Operability Studies, Chemical Industries Association, London, 1977. 7. R E. howlton, An Introduction to Hazard and Operability Studies, Chemetics International, Vancouver, Canada, 1981, and A Manual of Hazard and Operability Studies, Chemetics International, Vancouver, Canada, 1992. 8. T. A. Kletz, Hazop and Hazan-Identifying and Assessing Process Industry Hazards, 4th edition, Institution of Chemical Engineers, Rugby, UK, 1999. 9. E P. Lees, Loss Prevention in the Process Industries, 2nd edition, Butterworth-Heinemann, Oxford, UK, 1996, Chapter 8. 10. T. A. Wetz, Chemical Engineering, Vol. 92, No. 7, Apr. 1, 1985, p. 48. 11. E. A. George, Loss Prevention, Vol. 14, 1981, p. 185. 12. K. Bergroth, Loss Prevention Bulletin, No. 109, Feb. 1993, p. 1. 13.E F. Lees, Loss Prevention in the Process Industries, 2nd edition, Butterworth-Heinemann, Oxford, UK, 1996, Appendix B 10. 14. S. M. Englund, J. L. Mallory, and D. J. Grinwis, Chemical Engineer- ing Progress, Vol. 88, No. 2, Feb. 1992, p. 47. 15. J. Easterbrook and D. V. Gagliardi, PlantYOperations Progress, VoL 3, No. 1, Jan. 1984, p, 29. p. 187. Heinemam, Oxford, UK, 1994, Chapter 2. 1973, p. 113. 1974, p. 45. 342 What Went Wrong? 16. H. G. Lawley, Hydrocarbon Processing, Vol. 55, No. 4, Apr. 1976. 17. Clzeinical Process Safety Report, Vol. 5, No. 11, Sept. 1995. 18. Energetic Events, Vol. 3, No. 3, Wilfred Baker Engineering, Aug. 19. Loss Prevention, No. 124, Aug. 1995, p. 13. 20. D. W. Jones, Hydrocarbon Processing, Vol. 71, No. 4, Apr. 1992, p. 78. 21. G. S. Melville, Joiirnal of Loss Preeverztion in the Process Industries, Vol. 7, No. 5, 1994, p, 387. 22. P. G. Urben (editor), Bretherick’s Handbook of Reactive Chemical Hazards, 5th edition, Butterworth-Heinemann, Oxford, UK, 1995. 23. R. L. Collins, Chemical Engineering Progress, Vol. 91, No. 4, Apr. 1995, p. 48. 24. I. M. Duguid, Loss Prevention Bulletin, No. 134, Apr. 1997. p. 10. p. 247. 1995, p. 4. [...]... [ 131 348 What Went Wrong? 19.4 CARBON DIOXIDE CAN IGNITE A FLAMMABLE MIXTURE In 1966, a naphtha tanker, the A h a C u p , was involved in a collision near New York and was severely damaged Some naphtha was spilled, and the rest was pumped out into another vessel The owners wanted to move the ship to a shipyard where it could be gas-freed and the damage could be surveyed, but the New York Fire Department... They can be prevented by installing relief valves The incidents described in Sections 12.4.5 and 17.12 were also mist explosions 350 What Went Wrong? 19.6 THE SOURCE OF THE PROBLEM LAY ELSEWHERE The cause of a problem may be difficult to find when it lies in another part of the plant One example was described in Section 2.6 (a) Here are two more The product from a new plant was purified in a vacuum... equipment are minimized and hazard and operability studies (see Section 18.7) should include a check that this has been done 353 354 What Went Wrong? Software faults can occur in the systems software that comes with the computer or in the applications software written for the particular application Systems software faults can be reduced by using only well-tested systems-not always easy in a rapidly changing... understand what is meant even though they contain errors in spelling or grammar or are ambiguous We know what is meant if we are told to save soap and waste paper 20.2 TREATING THE COMPUTER AS A BLACK BOX The most common types of errors are probably those that occur because operators treat the computer as a "black box," that is, something that will do what we want it to do without the need to understand what. .. 6 No 1, Jan 1987, p 17 2 Reis, Zeitschr$t Physikal Cliein., Vol 88, 1914, p 513 3 P J Baldock Loss Prevention, Vol 13, 1980, p 35 4, Norrliern Echo, Darlington, UK, May 15 1976 5 Lloyds List, London, June 20, 1977 6 Lloyls List and The Times, London, Jan 11, 1978 7 British Weldirzg Research Associatioiz Bulletin, Vol 7, Part 6, June 1966, p 149 8 P C Snyder, 'Brittle Fracture of a High Pressure Heat... Rugby, UK, 1991 16 B 0 Andersson and J Lindley, Loss Prevention Bulletin, No 107, Oct 1992, p 11 17 T A Kleltz, Journal of Loss Prevention 5 , No 4, 1992, p 255 iii the Process Industries, Vol 352 What Went Wrong? 18 Fire Journal, Nov 1967, p 89 19 J Eichhorn Petroleum Refinel; Vol 34, No 11, Nov 1955, p 194 20 H T Kohlbrand “Case History of a Deflagration Involving an Organic Solvent/Oxygen System Below... with about 480°C for propane and about 270°C for cyclohexane, so ammonia is harder to ignite Nevertheless there was little excuse for the ignorance of the responsible people in Texas and 343 344 What Went Wrong? Brazil, as ammonia explosions have occurred from time to time and the explosibility of ammonia has been known since at least 1914 [2] In a paper presented in Houston in 1979, Baldock said that... of ignition 19.2 HYDRAULIC PRESSURE TESTS CAN BE HAZARDOUS As water i s incompressible, hydraulic pressure tests are often considered safe If ithe vessel fails, the bits will not fly very far‘ 346 What Went Wrong? Hydraulic pressure testing is safer than pneumatic testing, as much less energy is released if the equipment fails Nevertheless, some spectacular failures have occurred during hydraulic tests... Operators can do what we want them to do even though we have not covered the point precisely; they can decode vague instructions, A computer, however can do only what it is told to do Errors of this type can be reduced by carrying out hazard and operability studies or hazops (see Section 18.7), on the instructions given to the computer as well as on the process lines We should ask what the computer... thoroughly analyzed In addition, it illustrates the paradox that we are very willing to spend money on complexity but are less willing to spend it on simplicity [4] Yet the simpler solution indepen- 356 What Went Wrong? L-3Tank Truck I ti A) \ Methanol Methanol Storage Tank Figure 20-1 A pump and lines controlled by a computer, were used for several different jobs The pump could also be started and stopped . amount that exploded was estimated as about 35 kg [ 151. 334 What Went Wrong? 18.6 OTHER DEVIATIONS (a) Figure 18-6 shows part of an old unit. Valve A could pass a higher rate than. next vessel Sample -=-I Y Figure 18-8. What will happen if the vessel is drained while a sample is being taken? 336 What Went Wrong? hazop is done in a systematic way, each. Jan. 1984, p, 29. p. 187. Heinemam, Oxford, UK, 1994, Chapter 2. 1973, p. 113. 1974, p. 45. 342 What Went Wrong? 16. H. G. Lawley, Hydrocarbon Processing, Vol. 55, No. 4, Apr.