c/EPA
           United States
           Environmental Protection
           Agency
          Air and Energy Engmet-rii",
          Research Laboratory
          Research Triangle Park iv /
           Research and Development
Prevention Reference
Manual: Control
Technologies

Volume 1. Prevention
and Protection
Technologies for
Controlling Accidental
Releases of Air Toxics

-------
                                    EPA/600/8-87/039a
                                    August 1987
         PREVENTION REFERENCE MANUAL:

             OONTROL TECHNOLOGIES

     VOLUME 1;  PREVENTION AND PROTECTION

   TECHNOLOGIES FOR CONTROLLING ACCIDENTAL

            RELEASES OF AIR TOXICS
                      by:

                  D.S. Davis
                  G.B. DeWolf
                  J.D. Quass
              Radian Corporation
              Austin. Texas 78766
            Contract No. 68-02-3994
              Work Assignment 62


              EPA Project Officer

                T. Keily Janes
Air and Energy Engineering Research Laboratory
     U.S. Environmental Protection Agency
 Research Triangle Park, North Carolina  27711
                                    -U.S.  Environmental Protection Agency
                                    Reel on  5, Li>r-ar7 (^i'L-iG)
                                    230 S.  Dearborn Street, Room
                                            , -JL   60604
  AIR AND ENERGY ENGINEERING RESEARCH LABORATORY
        OFFICE OF RESEARCH AND DEVELOPMENT
      U.S.  ENVIRONMENTAL PROTECTION AGENCY
        RESEARCH TRIANGLE PARK, NC 27711

-------
                      NOTICE

This document has been reviewed in accordance with
U.S. Environmental Protection Agency policy and
approved for publication.  Mention of trade names
or commercial products does not constitute endorse-
ment or recommendation for use.
                       11

-------
                                   ABSTRACT

     A toxic  chemical  release occurs when  equipment breakdown or  loss  of
process control in a chemical  process operation  causes  a loss of containment
of the chemicals.   The probability  that  an accidental  release will  occur
depends on the extent  to which deviations  (in  magnitude and duration)  in the
process can  be tolerated  before  a  loss  of chemical containment  occurs.
Development  of  a  satisfactory control  system and  equipment  capable of
withstanding  deviations  from the design intent  requires adherence to  the
principles of sound  process and physical  plant  design  and  to  appropriate
procedures and management practices.

     Process  design and control are  intimately related.  Control of a process
is achieved by manipulating the variables  of  flow,  temperature, pressure,
composition,   and  quantity,  for  deviations in these variables can  cause
deviations from  acceptable  process  conditions  that would  increase  the
potential for a toxic  chemical  release.  A  control system  can be improved by
improving the quality,  specifications, and maintenance of physical  components,
and by duplicating components  (the  principle of  redundancy)  where  warranted.
Process changes that enhance control of  the system will  reduce the  probability
of a  chemical release.   Such changes  include reducing the severity of
operating conditions and modifying  the  basic  chemistry,  operations,  and
equipment.

     The probability that  equipment  will  fail  and cause a  release  of  toxic
chemicals can also be reduced by considering various  aspects of physical  plant
design.  Whereas  process  design involves  the  operating  conditions of  a
chemical process, physical plant design involves  the hardware,  the equipment
components,  and their placement within a unit or  plant.
                                     111

-------
     A third way  to  reduce the probability of a  release  is to ensure that
proper management practices and personnel training procedures  are  maintained
from  the  initial research  and  development through  the  manufacture of  a
chemical product.  Finally, protection  system technologies such as  flares,
scrubbers, and enclosures offer a last line of defense against the occurrence
of accidental toxic chemical releases.

     Each of these areas  is discussed  in terms of its relation  to specific
categories of hazards,  its  effectiveness  in reducing the  probability  of a
release, and the relative economics  of  its application.
                                       iv

-------
                               ACKNOWLEDGEMENTS

     This manual was prepared under the overall guidance and direction of T.
Kelly Janes, Project Officer, with the active participation of Robert
P. Hangebrauck, William J. Rhodes, and Jane M. Crum,  all of U.S.  EPA.  In
addition, other EPA personnel served as reviewers.  Sponsorship and technical
support was also provided by Robert Antonopolis of the South Coast Air Quality
Management District of Southern California, and Michael Stenberg  of the U.S.
EPA, Region 9.  Radian Corporation principal contributors involved in
preparing the manual were Graham E. Harris (Program Manager),  Glenn B. DeWolf
(Project Director), Daniel S. Davis, Nancy S. Gates,  Jeffrey D. Quass, Miriam
Stohs, and Sharon L. Wevill.  Contributions were also provided by other staff
members.  Secretarial support was provided by Roberta J. Brouwer  and others.
Special thanks are given to the many other people, both in government and
industry, who served on the Technical Advisory Group and as peer  reviewers.

-------

-------
                               TABLE OF CONTENTS

Section
  ABSTRACT	   iii
  ACKNOWLEDGEMENTS 	     v
  TABLES 	     x
  FIGURES	    xi

  1       INTRODUCTION 	     1
          1.1  Fundamental Concepts  	     1
          1.2  Organization of the Manual	     5

  2       PROCESS DESIGN CONSIDERATIONS  	     7
          2.1  Control Characteristics of the Process  	     8
               2.1.1  Process Control and Release Prevention 	     8
               2.1.2  System Response	    12
               2.1.3  Control System Integrity 	    13
               2.1.4  Control System Components  	    14
               2.1.5  Effectiveness of Control Systems ........    23
          2.2  Process Characteristics and Chemistry 	    27
               2.2.1  Process Materials  	    28
               2.2.2  Process Mode	    31
               2.2.3  Reaction Thermodynamics  	    31
               2.2.4  Process Control System 	    33
               2.2.5  Process Type	    33
               2.2.6  Severity of Process Conditions	    35
               2.2.7  Process Complexity 	    37
               2.2.8  Process Modifications  	    37
          2.3  Flow Measurement and Control	 .    38
               2.3.1  Flow Hazards	    38
               2.3.2  Technology of Flow Control	    45
               2.3.3  Control Effectiveness  	    54
               2.3.4  Summary of Control Technologies  	    57
               2.3.5  Costs	    61
               2.3.6  Case Example	    61
          2.4  Pressure Control  	 .....    61
               2.4.1  Pressure Hazards	    61
               2.4.2  Technology of Pressure Control 	    64
               2.4.3  Control Effectiveness  	    72
               2.4.4  Summary of Control Technologies  	    80
               2.4.5  Costs	    80
               2.4.6  Case Examples	    84
          2.5  Temperature Control 	    84
               2.5.1  Temperatures Hazards	    85
               2.5.2  Technology of Temperature Control  	    90
               2.5.3  Control Effectiveness  	    95
                                      vii

-------
                         TABLE OF CONTENTS (Continued)

Section                                                                  Page

               2.5.A  Summary of Control Technologies  	     100
               2.5.5  Costs	     100
               2.5.6  Case Examples	     100
          2.6  Quantity Control  	     104
               2.6.1  Quantity Measurement and Control  Hazards ....     104
               2.6.2  Technology of Quantity Control	     106
               2.6.3  Control Effectiveness	     110
               2.6.4  Summary of Control Technologies  	  ...     112
               2.6.5  Costs	     112
               2.6.6  Case Example	     112
          2.7  Mixing	     116
               2.7.1  Mixing System Hazards  	     117
               2.7.2  Technology of Mixing Control 	     120
               2.7.3  Control Effectiveness  	     121
               2.7.4  Summary of Control Technologies  	     122
               2.7.5  Costs	     125
               2.7.6  Case Example	     125
          2.8  Composition Control 	     125
               2.8.1  Hazards Associated With the Loss  of Composition
                      Control	     125
               2.8.2  Technology of Composition Control  	     128
               2.8.3  Control Effectiveness  	     130
               2.8.4  Summary of Control Technologies  	     131
               2.8.5  Costs	     131
               2.8.6  Case Examples	     135
          2.9  References	     136

     3    PHYSICAL PLANT DESIGN CONSIDERATIONS 	     139
          3.1  Standards. Codes, and Recommended Practices 	     140
          3.2  Siting and Layout Considerations  	     141
               3.2.1  Siting	     150
               3.2.2  Layout	     151
               3.2.3  Storage Layout Considerations  	     156
               3.2.4  Miscellaneous Design Considerations  	     157
          3.3  Equipment Design Considerations 	 ....     165
               3.3.1  Materials of Construction  	     165
               3.3.2  General Equipment Failure Modes  	     169
               3.3.3  Vessels	     173
               3.3.4  Piping	     186
               3.3.5  Process Machinery  	     205
               3.3.6  Instrumentation and Control System Hardware  .  .     215
          3.4  References	     221
                                      viii

-------
                         TABLE OF CONTENTS (Continued)

Section
     4    PROCEDURES AND PRACTICES	..	    223
          4.1  Management Policy 	    223
          4.2  Operator Training	    228
          4.3  Maintenance and Modification Practices  	    235
               4.3.1  General Practices	    235
               4.3.2  Equipment Monitoring and Testing 	    239
               4.3.3  Metal Thickness and Integrity Testing  	    240
               4.3.4  Direct Corrosion Monitoring  	    242
               4.3.5  Vibration Testing and Monitoring ... 	    243
               4.3.6  Relief Valve Testing 	    244
          4.4  Operating and Maintenance Manuals 	    244
          4.5  References	    251

     5    PROTECTION TECHNOLOGIES  	    252
          5.1  Flares	    253
               5.1.1  Process Description  	    253
               5.1.2  Applicability	    256
               5.1.3  Control Effectiveness  	    260
               5.1.4  Costs of Flare Systems	    263
          5.2  Scrubbers	    265
               5.2.1  Process Description  	    265
               5.2.2  Applicability	    267
               5.2.3  Control Effectiveness	    269
               5.2.4  Costs	    271
          5.3  Enclosures	    273
               5.3.1  Process Description	    273
               5.3.2  Applicability	    274
               5.3.3  Control Effectiveness  	    275
               5.3.4  Costs	    276
          5.4  References	    276

APPENDIX A - GLOSSARY	    278
APPENDIX B - METRIC CONVERSION FACTORS 	    283
                                       ix

-------
                                    TABLES

Number                                                                   Page

2-1  Failure Rates of Selected Process System Components 	        26
2-2  Properties of Materials to be Considered in Chemical Process
     Hazard Evaluation 	        29
2-3  Considerations for Various Process Modes  	        32
2-4  Unit Processes in the Chemical Process Industries 	        34
2-5  Unit Operations in the Chemical Process Industries  	        36
2-6  Types of Checkvalves	        51
2-7  Flowmeter Selection Guide 	        55
2-8  Typical Failure Rates of Flow Control Components  	        58
2-9  Major Hazard and Control Technology Summaries 	        59
2-10 Costs of Components Associated with Process Modifications
     for Flow Systems	        62
2-11 Pressure Sensing and Measuring Devices  . 	        73
2-12 Typical Failure Rates of Pressure Control Components  ....        81
2-13 Major Hazard and Control Technology Summaries 	        82
2-14 Costs of Components Associated with Process Modifications For
     Pressure Measurement and Control Systems  	 .....        83
2-15 Temperature Sensor Selection Guide for Non-Severe Service
     Under 932°F	        96
2-16 Typical Failure Rates of Temperature Control Components ...        99
2-17 Major Hazard and Control Technology Summaries 	  .       101
2-18 Costs of Components Associated with Process Modifications For
     Temperature Measurement and Control Systems 	       103
2-19 Liquid Level Detector Selection Guide 	       109
2-20 Typical Failure Rates of Quantity Control Components  ....       113
2-21 Major Quantity Related Hazards and Control Technology
     Summaries	       114
2-22 Costs of Components Related to Process Modifications for
     Quantity Measurement and Control Systems (Excluding Flow Rate
     Measurement.  See Section 2.3)	       115
2-23 Typical Failure Rates of Mixing System Components 	       123
2-24 Maj or Mixing Related Hazards and Control Technology
     Summaries	       124
2-25 Costs of Components Associated with Process Modifications for
     Mixing Systems  	       126
2-26 Typical Failure Rates of Composition System Components  . .  .       132
2-27 Major Composition Related Hazards and Control Technology
     Summaries	       133
2-28 Costs of Components Associated with Process Modifications for
     Composition Determination and Control 	       134
3-1  Some of the Major Organizations Providing Codes, Standards,
     Recommended Practices, and Guidelines for Equipment for
     Chemical and Allied Industry Process Plants 	       142

-------
                              TABLES (Continued)

Number                                                                  Page

3-2  Some of the Areas covered by Codes, Standards, and
     Recommended Practices of Designated Organizations
     (See Table 1-3 for Symbols Definitions)	       144
3-3  Physical Components, Design, and Fabrication Features of
     Vessels Covered by ASME Codes as Indicated  	       147
3-4  Galvanic Series of Metals and Alloys 	        180
3-5  Typical Failure Rates for Vessel Components  	        182
3-6  Vessel Hazards and Control Technologies  	        183
3-7  Design Bases for Vessel Controls ........ 	        184
3-8  Typical Failure Rates for Piping Components  	        201
3-9  Examples of Piping Hazards, Control Technologies, and Costs         202
3-10 Design Bases for Piping Controls 	        203
3-11 Typical Failure Rates for Process Machinery Components . .  .        212
3-12 Examples of Process Machinery Hazards, Control Technologies,
     and Costs	        213
3-13 Design Bases for Process Machinery Controls  	        214
4-1  Aspects of Training Programs for Routine Process Operations         232
4-2  Examples of Questions Asked During Procedure Reviews ....        250
5-1  Important Considerations for Using Flares to Prevent Acci-
     dental Chemical Releases 	        261
5-2  Cost Comparison of Elevated and Enclosed Ground Flaring
     •Systems	        264
5-3  Summary of Selected Typical Commercial Absorption
     Efficiencies for Various Industrial Chemicals  	        270
5-4  Example of Performance Characteristics for a Packed Bed
     Scrubber	        272

                                FIGURES

1-1  The role of various accidental release control measures in
     reducing the consequences of an accidental release 	          3
2-1  Generalized information flow for process control loop  ...         10
2-2  Estimated typical program costs for our R&D effort to develop
     process modifications  	         39
2-3  Check valve types  	         50
2-4  Examples of backflow through pumps 	         52
2-5  Typical rupture disc installation  	         67
2-6  Cross section of a typical pressure relief valve 	         70
3-1  Example guide for material selection under acidic conditions        167
5-1  Conceptual diagram of elevated flare system  	        254
5-2  Conceptual diagram of ground flare system  	        255
5-3  Three common types of scrubbers  	        266
                                     xi

-------

-------
                                   SECTION 1
                                 INTRODUCTION

     Accidental toxic chemical releases, fire, and explosion are the three
types of major accidents in chemical process facilities.  Toxic chemical
releases may occur as the result of fire or explosion, but may also occur in
their absence.

     This manual, which addresses the prevention of and protection from
accidental releases of toxic chemicals, is part of a three-part set of refer-
ence manuals whose purpose is to summarize the major concepts of release
hazard control so that the probability and consequences of accidental toxic
chemical releases can be reduced.  The volumes in the series include:

          Prevention Reference Manual - User's Guide
          Prevention Reference Manual - Chemical Specific
          Prevention Reference Manual - Control Technologies
                Volume 1:  Prevention and Protection Measures
                Volume 2:  Mitigation Measures

     The PRM-Chemical Specific actually consists of a number of individual
volumes for specific chemicals.

     This series of manuals is intended to assist both  regulatory and industry
personnel in developing approaches to reducing accidental  chemical releases
and their consequences.  In addition to highlighting the various technical
aspects of the problem, the manuals also briefly address costs.

1.1  FUNDAMENTAL CONCEPTS

     The purpose of preventing toxic chemical releases  is  to prevent harm  to
the health of human beings and other life and to the environment.  An acci-

-------
dental toxic chemical release is the final event in a sequence of events
leading to the release.  In the termin9logy of formalized fault tree and event
tree analyses, two of several formal methods for analyzing causes and effects
in event sequences, that are discussed in the PRM-User's Guide, an event
sequence begins with the initiating, or primary, event and passes along a
chain made possible by enabling events.  The chain is broken by preventing
either the initiating event or the enabling events from occurring.  Selection
of the best of several possible options that could prevent a particular
accidental toxic release depends on correctly identifying individual events
and event chains, on knowing the relative probability of the events, and on
the skill and knowledge of the individuals charged with solving the problem.

     Figure 1-1 illustrates the place of prevention in the overall sequence
of an accidental chemical release.  Prevention is the second barrier between
the realization of a toxic chemical release hazard and its consequences.  It
follows proper identification of the hazards.  Protection, reduction of the
quantity of material released, and mitigation, reduction of the magnitude of
consequences, are two additional barriers.  Community response is also shown
as a barrier since community response measures can reduce the ultimate adverse
consequences of a release.  Evacuation is an example of a community response
measure.  Since the total prevention of an accidental release implies a zero
probability for that release, and since this can never be assured, prevention
in practice means reducing the probability of a release to within acceptable
limits.  At present, such acceptable limits, which are related to acceptable
risk, are subjective and are not quantitatively defined.

     Preventing accidental releases means preventing the loss of primary
containment.  The three general classes of equipment that contain chemicals
are:

     •    Vessels;

     •    Piping; and

-------
                              RELEASE

                              HAZARDS
                        HAZARD IDENTIFICATION
                       PRE - RELEASE PREVENTION
                       PRE - RELEASE PROTECTION
                               r
                       POST - RELEASE MITIGATION
                                 1
COMMUNITY RESPONSE
i
r
ULTIMATE CONSEQUENCES
                                                       <
                                                       f-.
Figure 1-1.   The role of various accidental  release control measures in

             reducing the consequences of an accidental release.

-------
     •    Process machinery.

     In the context of this manual, vessels include all major process equip-
ment:  tanks, columns, heat exchangers, etc.  Piping includes pipe lines,
valves and fittings, and instruments fitted into pipe lines.  Process machin-
ery includes pumps, compressors, fans, and other such material moving equip-
ment, either rotating or reciprocating.  To ensure containment, a process must
operate in proper sequence under acceptable conditions of temperature, pres-
sure, and composition.  The equipment must operate within design limits
defined by specifications for pressure, temperature, externally applied me-
chanical stresses, chemical compatibility (corrosion, erosion), and within the
physical limits imposed by the process system as actually installed and
operated.

     An accidental toxic chemical release can occur when there has been a
physical breakdown of equipment or a loss of process control that leads to a
breach in primary containment.  Process modifications that enhance control
and/or physical process steps and procedures that reduce the probability of
equipment failure or a loss of process control will reduce the probability of
a release.  The overall problem, then, requires consideration of:

     •    Process design;

     •    Physical plant design;

     •    Operation; and

     •    Supervision or management.

     The first two elements address the process, its chemistry, and hardware;
the second two elements address the human factor.

-------
1.2  ORGANIZATION OF THE MANUAL

     Following this introduction. Section 1. the remainder of the manual
addresses the above elements.  Section 2, which covers process design
considerations, addresess the basic functional and operational characteristics
of any chemical process system, highlights major hazards associated with
various characteristics of systems, and discusses the control measures that
reduce those hazards.  These include specific approaches for preventing
deviations from intended operating conditions that could directly or
indirectly cause an accidental toxic chemical release.

     Section 3 covers physical plant design and considers how inappropriate
design practices for the physical facility and its hardware contribute to
accidental chemical releases.  Adhering to proper design and equipment
specifications for vessels, piping, valves, process machinery, and
instrumentation can reduce the probability of an accidental toxic chemical
release.  Fundamental principles of configuration, layout and other design
considerations associated with process hardware are discussed.

     Section A discusses procedures and practices such as management policies.
operator training, maintenance practices, and other topics.  Some experts in
loss prevention believe that the most significant decreases in the probability
for accidental toxic chemical releases can be made in these areas.

     Section 5 discusses protection systems, which include scrubbers, flares,
and secondary containment systems.  These devices, which can provide an
emergency control system for process units handling some toxic chemicals,
reduce the quantity of toxic chemical reaching the environment once primary
containment has been breached.

     A selection of hazard controls depends partly on the economics of their
application.   Example control costs are presented in each section for various
process and equipment control technologies.  These technologies involve
individual hardware and procedural components, as well as multicomponent
combinations  for controlling an accidental release hazard.  Since numerous

-------
combinations of individual controls are possible,  costs  are presented for
individual hardware and procedural components that can be combined into a full
control system.

     Since costs in this manual are intended to be a starting point for
initial planning,  cost bases selected for each component are for specific
sizes and overall  specifications representative of that  class of component.
For example, for piping, one control option might  be to  use Schedule 80 rather
than Schedule 40 pipe in some process unit.  Costs are presented for three
sizes of both Schedule 80 and Schedule 40 carbon steel pipe, two-inch,
four-inch, and six-inch, which are common sizes encountered in many process
plants handling toxic chemicals.  While other sizes may  be encountered, a
first estimate of  the relative costs of changing the schedule size can  be
estimated using one of these pipe sizes as an example.

     The costs shown in this manual were obtained  from various process  plant
estimating references and are presented in 1986 dollars.  For each component,
both capital and total annual costs are presented.  Capital costs represent
direct installed equipment costs, exclusive of indirect  costs such as engi-
neering or contractor's fees.  Total annual costs  include only labor where a
procedure is involved, or only maintenance and capital recovery where a
hardware component is involved.  Maintenance costs for all hardware are
assumed to be a flat two percent of the direct installed equipment cost.
Capital recovery has been calculated at a 10 percent cost of capital over an
assumed 10-year component life.

     Costs for various controls applied to new plants can be expected to
differ substantially from the same controls applied to existing plants.  The
relative differences in costs will vary according  the type of controls, but,
in general, retrofitted equipment is usually more  costly than the same equip-
ment installed initially.  Costs in this manual apply to new plants.  Retrofit
costs can be roughly estimated as about fifty percent higher.  Costs of
introducing changes in procedures and practices can also be expected to vary,
but generalizations about these costs cannot be as easily made as for equip-
ment.
                                       6

-------
                                   SECTION 2
                         PROCESS DESIGN CONSIDERATIONS

     A first step in hazard control is planning the initial process design.
This section describes the basic considerations of initial process design, as
well as subsequent process modifications, and identifies operational aspects
of a process where upset and loss of control could lead to a toxic chemical
release.  Process design considerations involve several fundamental principles
applied to the process materials, process variables, and equipment.  These
principles are addition, substitution, deletion, and redundancy (or duplica-
tion) .  Each process chemical, operation, or piece of equipment should be
viewed in terms of how changes based on these qualities may lead to a reduc-
tion in the probability of an accidental release.  For example, substitution
might involve the replacement of a toxic chemical with one less toxic.
Duplication or redundancy might involve the use of a second thermocouple to
measure a critical temperature.

     Modifications,  then, of fundamental process chemistry, operations, and
equipment can reduce the severity of operating conditions, the quantities of
toxic materials, the complexity of the process, and can enhance process
control.  Such modifications involve a number of process components:

     •    Control characteristics of the process;

     •    Process thermodynamics and chemistry;

     •    Flow measurement and control;

     •    Pressure measurement and control;

     •    Temperature measurement and control;

-------
     •    Quantity measurement and control;

     •    Mixing;  and

     •    Composition measurement and control.

     Process hazards associated with each area  that can contribute to acci-
dental releases and the control measures that can reduce those hazards are
discussed in the following subsections.   Such measures  may include changes in
both hardware and  operational procedures.  Hardware changes may involve
individual equipment items or entire systems.  Costs of hardware components
likely to be involved in process modifications  are presented.   Since process
modifications can  involve combinations of components, costs are presented on a
component or subsystem basis, allowing the user of this manual to select those
components that apply to any specific modification for  which the user wants an
approximate estimate of costs.

2.1  CONTROL CHARACTERISTICS OF THE PROCESS

     Good process  control, including the interaction of human  operators with
the process system, is basic to successful process operations.  Process
control is achieved by manipulating the variables of flow, temperature,
pressure, composition, and quantity.

2.1.1  Process Control and Release Prevention

     Adequate control of the process is fundamental to  accidental release
prevention, since  loss of control might begin or propagate the sequence of
events leading to  loss of containment and accidental release.   Loss of con-
tainment through loss of control occurs when some process variable exceeds the
physical limits of the containment system.  Equipment  failure, operational
failure, or both can cause loss of control.   The interaction of human oper-
ators with the process is not explicitly addressed here, but certain aspects
of the human factors, such as operator training, are discussed in Section 4.

-------
     Process control means maintaining process variables within prescribed
limits.  Process variables are either controlled directly or indirectly.  Some
indirectly controlled variables are maintained through control system action
on directly controlled or manipulated variables.  The physical characteristics
of a process unit, the process chemicals, and the operating conditions deter-
mine the control characteristics of the particular system.

     The following essential functions'of a process control system may be
modified to enhance control and reduce the probability of accidental releases:

     •    Measurement;

     •    Normal control; and

     •    Emergency or protective control.

     These functions of a control system are the same whether manual* analog,
or computer control is used.  In any control system, the conceptual component
configuration for controlling a variable is as shown in Figure 2-1.  The
connecting arrows indicate information flows between components.  The dotted
lines indicate that both direct or indirect measurement and control of vari-
ables is encountered in process systems.  A sensor for the measurement device
monitoring the measured variable transmits its signal to a controller, where a
comparison or decision is made relative to specified process conditions.  A
signal is then sent from the controller to the actuator of a final control
element, which adjusts the manipulated variable.  In chemical process systems
the most common manipulated variable is flow and the most common final control
element is the actuator/control valve.  The actuator is the device that
physically operates the valve.  The manipulated variable controls change in
the measured variable.  For example, a temperature might be the measured
variable and flow of a cooling medium might be the manipulated variable.  In
some situations, the measured and manipulated variable may be the same:  the
flow rate of a fluid stream, for example.  In a completely manual system,  a
human operator responds to a measurement and acts as both the controller and

-------
   Measured
    Variable
  Sensor/
Transmitter
Controller
               Manipulated
                 Variable
            Final
           Control
           Element
Figure 2-1.   Generalized information flow for process control loop,
                               10

-------
actuator of the final control element.  In an analog system the response
occurs through electrical, electronic and/or mechanical components.  A com-
puter system combines the components of an analog system with the capabilities
of logic and computations software algorithms.

     The primary variables for any chemical process unit are:

     •    Flow;

     •    Pressure;

     •    Temperature;

     •    Composition; and

     •    Quantity.

     Typically, these variables are all controlled by manipulating the flow of
some process stream.

     The specified value of the controlled variable in the process system is
referred to as its set-point.  Deviations from this set-point can occur in
response to various influences known as process loads.

     Process loads may arise from disturbances in the following:

     •    Feed stream quality and rates;

     •    Service stream (e.g. steam,  cooling water)  quality and
          rates;

     •    Product stream quality and rates (especially where there
          is recycle);

     •    Equipment malfunctions;
                                      11

-------
     •    Process operating conditions;

     •    Ambient conditions; and

     •    Material properties and behavior.

Deviations in variables can cause deviations in the process.   Deviations from
acceptable conditions are the fundamental source of process hazards.  A valve
that is open when it should be closed or an overpressure leading to equipment
failure or emergency venting are two examples of direct causes of accidental
releases.  The specific role of primary  variables in process  hazards is
explored further in Sections 2.3 through 2.8.  Certain additional general
concepts of process control as they relate to hazard reduction are discussed
below.

2.1.2  System Response

     The overall control characteristics of a process depend  on the response
characteristics of both the process being controlled and on the control system
itself.  The response characteristics of a process are known  as the process
dynamics.  The interaction of a control  system with a process creates a new
set of dynamic responses that may differ from the dynamic responses of the
process alone.  A key concept of process control and dynamics is that any
corrective action taken will not result  in an instantaneous response and might
not result in the return of a deviating  variable to its set point.  The
response of a system to a control action can result in a continued deviation,
both "in terms of duration and magnitude, or to new deviations, if a control
system is not properly designed.  Either the duration or magnitude of devia-
tion may lead directly or indirectly to  a loss of containment and to an
accidental release.  The relationship between deviations and  specific causes
of events leading to releases is the primary theme throughout other parts of
this manual.
                                       12

-------
     Any assessment of the probability of an accidental chemical release
depends, therefore, on the extent to which deviations in magnitude and dura-
tion can be tolerated before a loss of containment occurs.  Once this is
known, the limits of control are defined, and appropriate initial design or
modifications that enhance control can be undertaken.

2.1.3  Control System Integrity

     The success of process control depends on the integrity of the control
system.  Integrity means that the control strategies and hardware are
adequate, reliable, for the job at hand.  Judging the adequacy of a control
system requires examination of its components and specifications.  An
evaluation cannot fully determine adequacy, in terms of controller settings
and response to system upsets, without understanding the intent of the basis
for design, the design, or observing the control system in operation under
actual process upset conditions.  Partial insight can be achieved by examining
the control system configuration on a piping and instrumentation diagram, the
actual hardware used, by discussions with personnel familiar with operating
the process, and by formal methods of hazard identification and evaluation
such as hazard and operability studies and fault tree analysis, among others.
Such methods should be used in control system design (1).  From these
approaches the control system's adequacy may be inferred.

     If control strategy is correct, any increase in the reliability of a
control system depends on improving the quality, specifications, and mainten-
ance of the physical components, and on duplication of (redundancy) components
where the potential hazard warrants.  This may ultimately be a subjective
decision; no specific criteria can be given here for that decision. The formal
hazard evaluation method mentioned earlier can be a guide, however. For
example, duplication could be applied to an entire loop, or only to the
components most likely to fail.  This judgement must be made on a case-by-case
basis.
                                      13

-------
     High points in design philosophy have been well-stated by one author (1).
There should be a clear design philosophy and proper performance and reli-
ability specifications for the control and instrumentation.  The design
philosophy should deal with,  among other things, the characteristics of the
process and of the disturbances to which it is subject,  the constraints within
which the plant must operate, the definition of the functions which the
control system has to perform, the allocation of these between the automatic
equipment and the process operator, the requirements of  the operator and the
administration of fault conditions.  The philosophy and  specification should
cover measurements, displays, alarms, control loops; protective systems;
interlocks; special valves (e.g., pressure relief,  non-return, emergency
isolation); the special-purpose equipment; and the  process computer(s).

     A process that appears to require a complex control system should be
re-examined to determine process changes that would reduce the complexity.

     The control system as a whole and the individual instruments should have
the turn-down capabilities necessary to maintain good measurement and control
at low throughputs.

     Transient situations, such as startup, shutdown, and restarting after a
trip or restarting an agitator, tend to be particularly  hazardous.

2.1.4  Control System Components

     Major control system components discussed in this section include:

     •    Sensing and measurement;

     •    Controllers;

     •    Final control elements;

     •    Switches and alarms;
                                      14

-------
     •    Emergency shutdown and interlock systems; and

     •    Computer control.

     Certain aspects of control systems are general to the system as a whole
or apply to all kinds of instrumentation used.  Some important aspects are
(1):

     1.   The control loops should have fail-safe action as far as possible.
          particularly on loss of instrument air or electrical power to the
          control valves.  The action for other equipment should also be
          fail-safe where applicable.  Control that adds material or energy
          should receive special consideration for integrity.

     2.   The ways in which common cause failure can occur and the ways in
          which the instrument designer's intentions may be frustrated should
          be carefully considered.

     3.   Instrumentation which is intended to deal with a fault should not be
          disabled by the fault itself.  And if the process operator has to
          manipulate the instrumentation during the fault, he should not be
          prevented from doing so by the conditions arising from the fault.

     4.   The instrument system should be checked regularly and faults re-
          paired promptly.  It should not be allowed to deteriorate, even
          though the process operator compensates for this.  The process
          operator should be trained not to accept instrumentation unrepaired
          over long periods.

     5.   Ease of detection of instrument faults should be an objective in the
          design of the instrument system.  The process operator should be
          trained to regard detection of malfunction in instruments as an
          integral part of his job.
                                      15

-------
6.   Instruments which are required to operate only under fault condi-
     tions, and which may therefore have an unrevealed fault,  require
     special consideration.

7.   Important- instruments should be checked regularly.   The proof  test
     interval should be determined from a reliability  assessment where
     possible.  The checks should include measurements,  alarms,  control
     loops, etc.

8.   Tests should correspond as  nearly as possible  to  the expected  plant
     conditions.  It should  be borne in mind that an instrument may pass
     a workshop test, but still  not perform satisfactorily in  the plant.

9.   Valves, whether control or  isolation valves, can  leak even when
     closed.  Control valves in  particular may not  give  a tight shutoff.
     More positive isolation may require measures such as double block
     and bleed valves.

10.  Valves, particularly control valves, also tend to stick,  giving rise
     to conditions that do not always emerge from simple applications of
     the fail-safe philosophy.  Two dangerous conditions are a feed valve
     jamming in an open position, or a cooling water valve jamming  in a
     closed condition.

11.  Practices which process operators tend to develop in their use of
     the instrumentation should  be borne in mind, so that these practices
     do not invalidate the assumptions made in the  reliability
     assessments.

12.  The possibility of human error should be fully taken into account.
     The reliability of the  process operator should be assessed quanti-
     tatively where possible. Human factor principles should  be applied
     to reduce human error.
                                 16

-------
     It is also necessary to pay careful attention to the details of the indi-
vidual instruments used (1).  Some important features are:

     1.   Instruments are a potential source of failure, either through a
          functional fault on the instrument or through a loss of containment
          at the instrument.

     2.   Use of inappropriate materials of construction can lead to both
          kinds of failure.  Materials should be checked carefully in relation
          to the application, bearing in mind the possible impurities in the
          bulk chemicals.  It should be remembered that the instrument
          supplier usually has only a very general idea of the application.

     3.   Instruments containing glass, such as sight glasses or rotameters,
          can break and give rise to serious leaks and should be avoided,
          where possible, with toxic chemicals.

     4.   Instruments may need protection against the corrosiveness of the
          process fluid.  Examples of protection are the use of inert liquids
          in the connecting lines on pressure transmitters or of chemical
          diaphragm seals on pressure gauges.

     5.   Sampling and connecting lines should be given careful attention.
          Purge systems are often used to overcome blockage in sampling and
          connecting lines.  Freezing is another common problem, which can be
          overcome by the use of steam or electrical heat tracing.

     6.   Temperature measuring elements should not normally be installed
          bare, but should be protected by a thermowell.  A thermowell is
          frequently exposed to quite severe conditions, such as
          erosion/corrosion or vibration and should be carefully designed.

     7.   Pulsating flow is a problem in flowmeters such as orifice plate
          devices and can give rise to serious inaccuracies.  This is a good
          example of a situation where duplication of identical instruments  is
          no help.
                                      17

-------
     8.   Pressure transmitters and regulators  are  easily  damaged  by over-
          pressure.

     9.   Complex instrunents such as analyzers,  speed  controllers,  vibration
          monitors and solids weighers are generally  less  reliable than  other
          instruments.  This requires not  only  that such instruments receive
          special attention, but that the  consequences  of  failure  be analyzed
          with particular care.

     10.  Different types of pressure regulator are often  confused,  with
          perhaps a pressure reducing valve being used  instead  of  a  non-return
          valve or vice versa.   It is specially necessary  with  these devices
          to check that the right one has  been  used.  Also, bypasses should
          not be installed across pressure regulators.

     11.  Selection of control  valves is very important.   A control  valve
          should have not only the right nominal  capacity  but also appropriate
          rangeability and control characteristics.  It should  have  any
          fail-safe features required, which may  include not only  action on
          loss of power but also a suitable limit to  flow  when  fully open.   It
          should have any necessary temperature protection (e.g. cooling
          fins).  Bellows seals may need to be  provided to prevent leaks.  The
          valve should have a proper mechanical balance for the application,
          so that it is capable of shutting off against the process  pressure.
          It should be borne in mind that  any valve,  but particularly a
          control valve, may not give completely  tight  shutoff, and  also that
          a badly adjusted valve positioner can prevent shutoff.

     12.  Instruments should not be potential sources of ignition  and should
          conform with the electrical area classification  requirements.

A further discussion of the loss prevention aspects of  control  and instrument
systems is given by Hix (2).
                                      18

-------
Sensing and Measurement—
     Sensing and measuring both controlled and manipulated variables is
fundamental to the proper operation of any control system.  A wide variety of
instrument types and vendors is available.  Sensing and measuring devices
include devices for normal process control, as well as trips and alarms for
emergencies, and monitoring and detecting equipment for impending equipment
failure and chemical leakage.  Once a process system is constructed, its
successful operation depends on the effectiveness of the sensing and measuring
devices on which process control decisions are based.

     Components for this function of the control system vary in sensitivity.
range, accuracy, and reliability.  Component selection must consider the
severity of operating conditions, including chemical attack.

     The variable of interest should always be measured directly where pos-
sible, rather than being inferred from some other measurement.  The measure-
ment should be made at the right location.  If the variable is critical for
process safety, the same measurement should not be used for control and for an
alarm or trip.

Controllers—
     The controller is the decision-making and command component of a process
control system.  The controller receives information from the process sensing
and measuring equipment, compares this information with its set point, and
takes appropriate action to minimize deviations.  In a manual system, the
human operator acts on the information.  In a computer-supervised control
system a computer acts on the information.  Traditional analog control systems
operate between these extremes.

     Controllers come in a variety of types and operate in any or in all three
common control modes:  proportional, integral, and derivative; or in other
specialized modes.   Details of such features are beyond the scope of this
manual but are widely discussed in the literature of process control (e.g..
                                      19

-------
References 3. A, 5).   Pneumatic controllers have been available for many years
and are still in wide use.   Electronic controllers  have grown in popularity
over the years and include  traditional analog electronic controllers as well
as newer digital types.

     The numerous changes in controller technology  in recent  years have
created opportunities for both increased safety and hazards.   Opportunities
for safety exist because of the versatility,  accuracy,  and response capabil-
  i
ities of the newer generation of controllers.  Opportunities  for hazard result
from the large number of available control systems, making inappropriate
selection, application,  installation and operation  a greater  possibility than
before.  Proper controller  selection is an important step in  accidental
release prevention.

Final Control Elements—
     A process control loop is completed with the final control element.  In
most cases this is a fluid  control valve.  In other cases it  may be another
device, an electric heater, for example.  Again, many types and vendors exist.
For a control valve,  proper sizing, trim, and actuator selection are critical
in selection since these factors determine how well the valve will perform its
control function under both normal and abnormal operating conditions.

Switches and Alarms—
     Switches and alarms are important devices for  process upset and emergency
conditions.  Alarms are devices that warn of an impending or  existing abnormal
process condition; switches are action devices that divert a  flow, close a
valve, or perform some other emergency function such as tripping an alarm.
Necessary characteristics are sensitivity to the condition being monitored and
hardiness in hostile environments, especially because such devices are typi-
cally used only intermittently.

     The most common of these devices respond to pressure, flow, level, and
temperature.  Details are described in the sections of this manual specific to
                                      20

-------
each of these process variables; but certain general features are discussed
here.

     Switches may be indicating or non-indicating.  An indicating switch has a
scale readout that allows the process operator to make changes in the switch's
set-point.  A non-indicating switch is not adjustable by the process operator.
This type may be appropriate in a process where the switch's function is
crucial in controlling the potential for an accidental release and undocu-
mented changes in the settings are to be avoided.  The danger with this type,
however, is that if process conditions are changed, the switch setting may
also have to be changed, but there is no indication of the switch setting to
verify that the necessary change has been made.

     A switch should be applied to the parameter showing the most significant
change for the condition to be alarmed to enhance switch sensitivity.  For
example, pressure switches are sometimes used in pump discharge systems to
indicate a pump failure, or to start a spare pump.  However, with a low-head
pump system, the difference in pressure between the shutoff setting and
operating pressure may be small, making switch operation unreliable.  The
change in flow rate between normal operation and shutoff condition may be
significant, making a flow switch the better choice.  Switches differ in their
susceptibility to damage from overrange.  This should be considered when
selecting a switch for a process prone to overrange upsets.

     The philosophy of the alarm system should relate the variables alarmed.
the number, types and degrees of alarm, and the alarm displays and priorities
to factors such as instrument failure and operator confidence, the information
load on the operator, the distinction between emergency alarms and mere status
indications, and the action the operator should take.

Emergency Shutdown and Interlock Systems—
     These systems may use a combination of many instrument components to
achieve a safe process shutdown condition.  Their success depends on proper
                                      21

-------
design and operating strategy,  as well as on the proper selection of system
hardware.  An emergency shutdown system is used primarily for the shutdown of
process equipment and for the operation of block,  dump, and  control  valves.
An interlock system presents a change in the operation of a  pump, valve,  or
other equipment unless certain conditions are met.   In the design of these
systems, redundant components and circuits are normally recommended  since
these systems are safety systems and high reliability is a fundamental  re-
quirement.  This is especially important in the temperature  and  level control
of exothermic reactions or when heat sensitive materials are handled.

Instrument Air and Electrical Backup Systems—
     Backup instrument air or electrical systems also should be  provided  for
these systems.  The backup electrical system for instruments and control  may
be part of the same system for general electrical  backup, or it  may  be  an
independent system.  Overall electrical backup can be achieved with
diesel-generator sets.  Sometimes the needs of critical process  control
instrumentation are best met by localized battery  backup. These systems  are
often supplied as part of standard control instrumentation packages  when  the
latter are purchased as a complete system, but can also be provided  as  pack-
ages for individual control loops, if required.

     Where pneumatic systems are used, backup instrument air supplies may be
system-wide or local.  System—wide backup may require tying  a main compressor
into both the basic plant power supply and into the plant electrical backup
system to ensure compressor availability during power outages.  Another
approach is to provide a large inventory of compressed air storage sufficient
tTo bring a process system to a safe shutdown.  Sometimes backup  is provided by
tying the instrument air into a liquid nitrogen system so that the nitrogen
can be substituted for air on an emergency basis.   Local backup  of instrument
air can be achieved by having a portable cylinder or emergency tank  of  either
compressed air or nitrogen tied into the instrument air system for emergency
use.
                                      22

-------
Computer Control—
     The application of computer- and microprocessor-based control has in-
creased rapidly over the last decade.  There are at least two fundamental
reasons for such growth:  1) reduced costs and a simultaneous increase in
capability, and 2) hardware developments that permit more effective automated
distributed control.  An example of the former is the advent of microcomputers
that offer a small operation true computer control for the first time.  An
example of the latter is the "smart" controller, a stand-alone controller that
can be programmed for its various control functions and settings.  A discus-
sion of many more specific developments, including the use of coaxial cables
to replace multiple cable runs between parts of a control system and a central
computer, video screens to replace individual meters and displays in control
rooms, and other such developments, is beyond the scope of this manual, but
the reader may find ample information in the many books on process control and
in technical periodicals (e.g., References 6 and 7).

     The new instrumentation and control technologies offer an increase in the
quality and quantity of data that can be handled at a given tine.  Two very
desirable features are that priority scanning and rate of change monitoring
can be employed.  Such systems free the human operator from many routine and
complex monitoring and evaluation functions, allowing him to focus on critical
process deviations or upsets.  Sequencing and the automatic shutdown features
of such systems can make the system freer from operator error.

     When computer systems are used, the ability to revert to manual control
or ordinary analog control may be desirable in many processes for safety
reasons.  Such backup systems may be provided for the most critical parts of
processes handling toxic chemicals.

2.1.5  Effectiveness of Control Systems

     The effectiveness of a process control system is its ability to minimize
the magnitude and duration of deviations in process variables.  Maintenance of
                                      23

-------
process variables at or near the set point is accomplished by direct manipula-
tion of the flow of mass or energy into or out of the process unit.  These
manipulations alter the values of other variables.   Loss of control, which can
initiate the chain of events leading to an accidental release, can occur when
manipulations fail in sequence, time of application, or magnitude.  A funda-
mental loss of control can occur from a failure of components in the control
system, including physical components and human error, or from faulty logical
design of the control system.  This latter failure is most likely to occur
when deviations lead the control system to operate near or beyond the extremes
of its design capabilities, in which case the design fault may be relative to
the range of applicability rather than absolute.  Proper design of the system
and proper selection of individual components are therefore essential to
ensure control system reliability and effectiveness.

     The effectiveness of process control depends on the following key items:

     •    There are a limited number of fundamental manipulated
          variables for controlling any chemical process system.

     •    The controllability of a process depends on the interac-
          tion of both the process control system and the dynamics
          of the specific process.

     •    Critical variables should be measured directly.  For
          example, a pressure indication should not be used as an
          indirect indication of temperature in an exothermic
          chemical reaction.

     •    The control system must be compatible with the level of
          training and skill of both operating and maintenance
          personnel.
                                      24

-------
     •    Duplication or redundancy of individual system components
          can increase the reliability of individual parts of the
          system.

     •    A redundant component must be completely independent of
          its duplicate.

     •    A definitive evaluation of process control for the criti-
          cal variables in a process once a system has been in-
          stalled is not easily accomplished by an evaluator and a
          judgement of its reliability must be inferred from limited
          information.

     The reliability of the components that make up any control system has
been studied for many common process equipment and instrumentation components
(1, 8).  One measure of reliability is the mean time between failures (KTBF),
or the failure rate or frequency, the number of failures that occur per unit
of time.  Table 2-1 presents some values for selected components.  Additional
values are presented in other sections of this manual for specific equipment
items.  Such values can be used in conjunction with standard methods of
quantitative systems analysis, fault tree analysis for example, to estimate
overall system reliability.

     Changes in control strategy or control system hardware may be an appro-
priate process modification to reduce the probability of a failure leading to
an accidental toxic chemical release.  However, a secondary hazard can be
introduced if the effects of the changes on the process and its operation are
not carefully reviewed beforehand.  For example, although more sophisticated
instrumentation and control schemes may be desirable in theory, in practice a
lack of adequately trained or skilled operating or maintenance personnel may
make such systems more hazardous.  Direct process effects may include unfore-
seen changes in process dynamics.
                                      25

-------
        TABLE 2-1.  FAILURE RATES OF SELECTED PROCESS SYSTEM COMPONENTS

                                                          Failure Rate
     Component                                             (faults/yr)

Control valve                                               0.25 - 0.60
Differential pressure transmitter                           0.76 - 1.73
Variable area flowmeter transmitter                         0.68 - 1.01
Thermocouple                                                0.088 - 0.52
Pneumatic controller                                        0.29 - 0.38

Source:  Adapted from Reference 1.  More detailed information may be found
         in Reference 8 and other sources.
     The following performance criteria should be considered when selecting
components for process control systems:

     •    Mechanical or electrical;

     •    Range;

     •    Accuracy (repeatability);

     •    Precision;

     •    Operating environment and materials of construction;

     •    Sensitivity; and

     •    Ability to withstand excursions from specifications or
          operating conditions.

     In summary, the process control system, which is understood to mean both
the human operator and the control hardware, must be one of the key elements
                                      26

-------
examined as a possible basis for process modifications to a process system.
The specific modifications required must be made on a case-by-case basis but,
in general, should be directed toward increasing the reliability and respon-
siveness of the control system to deviations and corrective actions for those
variables most critical in preventing a loss of control.  In the sections that
follow, some of the specific fundamental principles of a chemical process, and
pertinent process variables are explored in the context of possible process
changes that could achieve the above objectives.

2.2  PROCESS CHARACTERISTICS AND CHEMISTRY

     Numerous formal hazard identification and evaluation procedures are
available which include examining chemical process characteristics and
chemistry, as summarized in the PRM-TJser's Guide, that are amply discussed in
the technical literature (9, 10).  Fundamental process changes can often
reduce inherent hazards by reducing in-process inventories of toxic materials
and by reducing the severity of operating conditions.  Some factors important
in examining chemical processes for potential hazards are (1, 11):

     •    Inventory - the quantity of hazardous material in the
          process;

     •    Energy content - the inherent energy content specific
          chemical species as well as process temperature and
          pressure conditions;

     •    Time factor - maximum rate of a potential release, and
          warning time available for emergency counter measures;

     *    Substitutability - whether a less hazardous material can
          be substituted, or whether a substitution may result in
          less severe operating conditions; and
                                      27

-------
     •    Complexity - the number and kinds  of  process  steps;  the
          operational sophistication required for the process.

     Hazard reduction through changes in these  broad process  characteristics
involve other factors discussed below.

2.2.1  Process Materials

     Evaluation of the properties of the materials in the process must in-
clude:

     •    Raw materials;

     •    In-process materials, such as reaction intermediates;  and

     •    Product materials and process wastes.

     The more known about all the materials  in  a process  the  better,  but in
practice, all potentially significant properties and even the identity of some
intermediate process materials may not be known.  Table 2-2 lists properties
of significance for process hazards (12). For  release  prevention, the
properties of toxic materials that should always be known are:

     •    Boiling point;

     •    Vapor pressure at ambient and process conditions;

     •    Specific heat;

     •    Heat of vaporization;

     •    Acute toxicity;

     •    Corrosiveness and reactivity properties;

                                       28

-------
       TABLE 2-2.  PROPERTIES OF MATERIALS TO BE CONSIDERED IN CHEMICAL
                   PROCESS HAZARD EVALUATION
GENERAL INFORMATION REQUIRED

Corrosivity
Purity (Specifications of Grade
  Used)
Formula (Chemical Structure)
Contamination Factors
  (Incompatibility)
Quantity of Material Anticipated
Color
Hygroscopicity
Molecular Weight
Appearance
Odor
Physical State
Solubility
Synonyms

FLAMMABILITY INFORMATION REQUIRED

Flash Point
Fire Point
Flammable Limits
Specific Gravity
Vapor Density
Vapor Pressure
Heat of Vaporization
Boiling Point
Ignition Temperature,
  Autoignition Temperature
Spontaneous Heating
Dielectric Constant (Static
  Hazard)
Melting Point
Flow Point
Percent Volatiles
Extinguishing Media
Special Fire Fighting Procedures
Unusual Fire and Explosion Hazard
Gases Released During
  Decomposition
Heat of Fusion
REACTIVITY (INSTABILITY)
INFORMATION REQUIRED

Differential Thermal Analysis (DTA)
Impact Test
Thermal Stability
Detonation with Blasting Cap
Drop Weight Test
Thermal Decomposition Test
Lead Block Test
Influence Test
Self Acceleration Decomposition
  Temperature
Card Gap Test
Thermal Stability (Under
  confinement) JANAF
Critical Diameter
Limiting Oxygen Value
Hazardous Decomposition Products
Incompatibility
Conditions Contributing to
  Hazardous Polymerization
Conditions Contributing to
  Instability
Shock/Friction Sensitivity
Decomposition Temperature
Specific Heat
Gas Evolution
Adiabatic Temperature Rise
Heat of Reaction
Source:  Reference 12.
                                     29

-------
     •    Flammability; and

     •    Explosive limits.

     The boiling point defines the physical state of the material in the
process, whether it is a liquid or gas at ambient and process conditions, for
example.  The vapor pressure defines the volatility of the material when it is
below its boiling point, and how much pressure buildup might be expected from
overheating below the boiling point.  The specific heat and heat of vaporiza-
tion allow estimation of volatilization rates when the release occurs as a
liquid.

     Toxicity data alerts the designer, operator, or evaluator of a chemical
process facility to what materials are most hazardous to health, and suggests
where to focus attention when taking measures for release prevention.
Parameters that should be considered include the IDLH, LC50, and others
defined in standard chemical toxicity references.

     Toxic materials that are also corrosive require extra care in specifica-
tion of materials of construction and also in monitoring equipment conditions.
Corrosive materials that are not the primary toxic materials in a process are
also important; however, when they are involved in processes where toxics are
present.  Corrosion can contribute to equipment failure and to a toxic
chemical release.

     Unrecognized reactivity in a process can cause a release hazard.  If
certain materials are accidentally mixed, or unexpected contamination occurs,
a runaway thermal reaction or violent evolution of gases can result.  Both may
cause overpressure or spillage of a toxic chemical.

     Flammability and explosive limits are important because fires and
explosions can cause an accidental release as well as be caused by a release
of a flammable material.  A small leak could result in a major release if
ignited.
                                      30

-------
     Other properties may be significant for other reasons.  One example is
density.  In a two-phase non-miscible liquid system, the denser liquid will
settle out in vessels and tanks if agitation is not provided.  Another example
is viscosity, which can be a significant variable affecting process behavior
in flow, heat transfer, and mixing parts of a process.  A special situation
where this might contribute to a hazard is a loss of temperature control where
emergency cooling might not respond as rapidly as expected because a viscous
layer near a cool heat transfer surface reduced the heat transfer coefficient
to a lower value than anticipated in the original process design.  These are
only some examples.  Evaluation of process materials may have to take into
account properties beyond those that at first appear obvious.

2.2.2  Process Mode

     The mode of process operation can affect the safety of a process.  Three
basic modes of process operation are:  1) batch, 2) semibatch, and 3) contin-
uous operation.  Table 2-3 lists some considerations that apply to each of
these modes.

2.2.3  Reaction Thermodynamics

     The fundamental thermodynamic characteristic of concern for reaction
safety is the exothermicity of a reaction.  This is the direction and rate of
energy release.  An exothermic reaction releases heat and an endothermic
reaction absorbs heat.  Exothermic reactions are usually of concern because
they can lead to thermal runaway reactions and the attendant adverse
consequences.  The hazard of a specific exothermic reaction depends on both
the magnitude of the heat of reaction and on the rate at which the heat is
released or absorbed.   The magnitude is determined primarily by the specific
reaction and by the quantities of chemicals involved.  The rate depends on
these variables as well as on the temperature at which the reaction takes
place.   The primary process consideration when exothermic reactions are
present is provision of adequate cooling.  Temperature control is discussed
more completely in Section 2.5.
                                      31

-------
             TABLE 2-3.   CONSIDERATIONS FOR VARIOUS PROCESS MODES

Residence Time
Feed System

Startup - Shutdown
In-process Inventory*
System Response
Temperature
Pressure
Composition
Flow
Fluid Dynamic Stability

Batch
Long
Intermittent -
short duration
Frequent
Large

Slow
Fast
Fast
Not applicable
Stable

Semibatch
Long
Intermittent -
long duration
Frequent
Large

Slow
Fast
Fast
Long
Stable

Continuous
Short
Continuous -
long duration
Infrequent
Small

Fast
Fast
Slow
Fast
Subject to
Fluctuation
*At same annual throughput rate.
                                      32

-------
     Endothermic reactions are not as hazardous as exothermic reactions, but
do carry some hazard potential.  Systems with endothermic reactions require
heating.  The hazard lies in the potential failure of the heating system in a
way that would result in too much heat input to the process.  This could cause
overpressure through flashing, boiling, or expansion, and weaken or damage
equipment.

2.2.4  Process Control System

     Some fundamental concepts of control systems were discussed in Section
2.1.  Types of control systems include:

     •    All manual,

     •    Manual/analog,

     •    Automatic/analog, and

     •    Automatic/digital, and

     •    Computer control.

     The type of system used must be appropriate to the process.  In general,
reliability increases with sophistication, assuming proper design and
installation.

2.2.5  Process Type

     The type of process is characterized in terms of unit processes and
operations.  Certain unit processes and unit operations may be inherently more
hazardous than others.  The basic unit processes that make up most of the
chemical industry have been defined in a classic work by Groggins (13) and
more recently in a comprehensive study (14).  Unit processes defined by the
latter are presented in Table 2-4.  Recognizing the class into which a process
fits will highlight the specific hazard features associated with that class.

                                      33

-------
TABLE 2-4.  UNIT PROCESSES IN THE CHEMICAL PROCESS INDUSTRIES
 Acylation
 Alkaline Fusion
 Alky1ation
 Amination
 Aromatization
 Calcination
 Carboxylation
 Caustization
 Chlorination
 Combustion
 Condensation
 Coupling
 Cracking
 Diazotization
 Double Decomposition
 Electrolysis
 Esterification
 Fermentation
Halogenation
Hydration
Hydrocracking
Hydroforming
Hydrogenation
Hydrolysis
Ion Exchange
Neutralization
Isomerization
Nitration
Oxidation-Reduction
Polymerization
Pyrolysis
Reforming
Sulfonation
                             34

-------
     The most common unit operations of chemical engineering are listed in
Table 2-5.  Again, certain operations that may inherently be more hazardous
than others can be considered for substitution in process modification.

2.2.6  Severity of Process Conditions

     The severity of process conditions is defined by the levels of pressure
and temperature for each step of the overall process, in reactors as well as
separation equipment.  The effects of pressure and temperature from a process
hazard perspective are discussed in Sections 2.4 and 2.5.  In general, the
higher these variables, the more hazardous the process and the greater the
accidental release potential.  Pressures in excess of 1,000 psig may be
considered extreme.  Pressures above 400 psig and temperatures above 500°F may
be considered high.

     While severity is usually interpreted in terms of high pressure and
temperature, extremely low conditions can also be hazardous.  As discussed in
Sections 2.4 and 2.5, these conditions require special precautions in design
and operations.  Conditions near ambient pressures and temperatures generally
will result in safer operation than temperatures and pressures either much
above or below ambient.  Since operating conditions are usually determined by
the fundamental chemistry of the process, changes in these conditions will
require research into the corresponding changes in process chemistry.
Important factors include the physical states of reactants, products and rate
processes, fundamental reaction kinetics and rates of mass transfer.  These
factors of the process can be examined to determine where changes might reduce
severity.

     The history of methanol synthesis is an example of a situation where
changes in the fundamental process reduced the severity of operating condi-
tions.  For many years the synthesis of methanol required high temperature and
very high pressure.  Research resulted in fundamental change to a new process
that allows methanol to be synthesized at much lower temperatures and
pressures (15); thus operation hazards were reduced.
                                     35

-------
TABLE 2-5.  UNIT OPERATIONS IN THE CHEMICAL PROCESS INDUSTRIES
         Absorption
         Adsorption
         Agglomeration
         Centrifugation
         Crystallization
         Deionization
         Desorption
         Distillation
         Drying
         Evaporation
Extraction
Filtration
Heat Transfer
Leaching
Mixing
Membrane Transport
Size Reduction
Sublimation
Fluids Transport
Solids Transport
                           36

-------
2.2.7  Process Complexity

     Process complexity is characterized by the number of unit operations,
streams, and variables that must be monitored and controlled in a process.  In
general, increased complexity increases the process hazard by creating more
opportunities for unforeseen process interactions and more opportunity for
errors in design, construction, and operation.  Process complexity can be
roughly estimated by considering the number of equipment items and the number
of chemicals involved.  A special consideration is how much recycling of
process streams is in the process.

2.2.8  Process Modifications

     Potential process modifications include any changes in the previously
discussed areas that could reduce the toxicity, severity, sensitivity, or
complexity of the process.  Such modifications are limited by the fundamental
constraints of process chemistry.  The number and extent of possible modifica-
tions is probably greater the earlier in the development of a process they are
made.  An existing process offers less opportunity for fundamental change than
a new process, but even here a change of catalyst, for example, might result
in less severe, hence less hazardous, operating conditions.

     The effects of modifications on traditional process costs will be process
and plant specific.  The effects will depend on equipment and operational
features of the modified process.  Though such costs cannot be estimated
generically, some insight about the potential research and development costs
of modifications can be gained by talking with technical and managerial
personnel.   It has been estimated that it costs about $150,000/year to main-
tain the average technical person in a large corporate environment.  This
translates  into about $75/hour of researcher time.  If it is assumed that this
reflects the cost of the average technical professional/managerial person who
would be involved in a program to modify the basic process characteristics and
chemistry,  the costs of such a program can be estimated from estimated levels
                                       37

-------
of effort for the program.   Figure 2-2 presents a range of costs for such
programs based on average staff level commitment and program duration.  Though
these costs exclude lost production while modifications are being made or the
capital investment required to physically modify a chemical process system,
they illustrate order of magnitude costs that show that fundamental process
modifications for process safety may equal the cost of new product/ process
development and implementation.

     Assume that a typical  chemical product may take 5 or more years of effort
and $10.000,000 to bring to market, excluding marketing costs.  If a
modification required only  10% of that effort, costs would be on the order of
$1.000,000.

2.3  FLOW IflEASUREMENT AND CONTROL

     Flow measurement and control of both primary process fluids and service
fluids such as steam, air,  nitrogen, and heating and cooling media is at the
heart of all process system operations.  This section explores the role of
fluid flow in process events that may lead to accidental toxic chemical
releases, and flow hazard controls.

2.3.1  Flow Hazards

     Process hazards associated with flow involve deviations that cause the
flow to be too low, too high,  reversed, or fluctuating.  Flow changes may be
caused by pressure changes  in some prime mover for a fluid, or by changes in
the resistance to flow in piping or other equipment.  Special hazardous
consequences of flow deviations can be identified for various individual
equipment items and processes.  Some consequences are obvious, while others
are not.  Some causes and hazards of loss of flow control are discussed below.
                                      38

-------
 4000
 1000
o
o
o
0)
o
o
1-1
00
o
t-l
Pu

a
-3
OS
  100 rfc
                           12
  18         24         30

Program Duration,  months
36
42
       Figure  2-2.   Estimated  typical program costs  for our R&D effort  to

                     develop process modifications.

                                       39

-------
Low Flow—
     Flow can be interrupted or reduced by factors related to the process.
equipment, or operations.  These factors may act independently or in combina-
tion and include:

     •    Blockage;

     •    Vapor lock;

     •    Cavitation in pumps;

     •    Mechanical failures of prime movers;  and

     •    Leakage.

     Blockage can occur from physical obstructions such as dirt,  tramp materi-
als in a line, or deposits which build up over  time.   These include products
of corrosion and erosion.  Polymerizable fluids may cause blockage or restric-
tions to flow.  Freezeup is another possibility with some materials.

     Certain equipment especially prone to blockage includes all  piping,
especially small diameter piping and tubing, heat exchangers, packed beds, and
filters.  Support screens and perforated plates in process equipment are  also
prone to blockage.  Control valves, which usually have orifices much smaller
than line size, are especially prone to restrictions and blockage, as are
orifices in differential pressure flow sensors.  Control valves,  being
automatic devices, can sometimes jam in a full  or partially closed position,
due to such conditions as dirt buildup on the stem, or mechanical failure of
the activator.

     Vapor lock can occur when a gas or vapor collects in a line  or other
process equipment space so that the vapor pressure exceeds the available
pressure head available for flow.  Liquid flow  through the line or equipment
may be restricted or stopped.
                                       40

-------
     Cavitation in pumping equipment can occur when a liquid near its boiling
point or contains a dissolved gas.  If the suction pressure to a pump falls
low enough, the dissolved gas may be suddenly released or the liquid may boil,
trapping a vapor bubble in the pump that causes the pump to lose suction and
flow.

     Mechanical failures in prime movers, such as pumps and compressors, are
obvious causes of low flow.  These mechanical failures include electrical
outages as well as actual breakage of mechanical components.

     Leakage upstream in a fluid system can cause deficient flow downstream.
Causes of leakage are discussed in the subsections on equipment in Section 3
of this manual.

     Many possible hazards are associated with low or no flow, depending on
the process, but the following are typical:

     •    Overheating caused by inadequate cooling to a process.
          The consequences of excess temperature are discussed in
          Section 2.5.  Some consequences include runaway chemical
          reactions or physical damage to equipment.

     •    Overcooling caused by inadequate heating to a process.
          The consequences of deficient temperature are discussed in
          Section 2.5.  Some consequences include an accumulation of
          unreacted material that could cause a runaway reaction on
          reheating, a freezeup in a critical line, or collapse of
          an atmospheric vessel due to vapor condensation and
          unrelieved vacuum.

     •    Process upsets caused by incorrect feed rate.  In some
          exothermic reactions a portion of the cooling relies on a
          low temperature feed.  An increase in the feed temperature
          or loss of one feed and not the other can lead to an

-------
          excess of one reactant.  This can sometimes lead to an
          excess exotherm and a runaway reaction.   Too low a feed
          rate to distillation columns can cause excess heating from
          a reboiler if the control system does not respond
          properly, causing overpressurization and a relief valve
          discharge.

     •    Low flow in a pump can cause overheating and pump failure.

Excess Flow—
     A primary cause of excess flow is an open valve which should either be
partially or completely closed.  The following are some typical hazards
associated with excess flow:

     •    Excess flow of a cooling medium can cause the same prob-
          lems as deficient flow of a heating medium, discussed
          previously.

     •    Excess flow of a heating medium can cause the same prob-
          lems as deficient flow of a cooling medium, discussed
          previously.

     •    As with low flow, incorrect reactant ratios can result,
          causing excess exotherms, or excess boilup and pressures
          in heated process equipment.

     •    Overfilling of vessels can result if excess flow is not
          detected and shut off in time.

     •    Unwanted siphoning of liquids is another example of excess
          flow; or flow where none is intended.
                                      42

-------
Reverse Flow—
     Reverse flow can occur when downstream pressure exceeds upstream
pressure.  A common cause of reverse flow is a pump failure, or failure of a
directly pressurized fluid transport system.  Reverse flow is not uncommon,
even in systems protected by check valves that may fail to close or seal
properly.  Some typical hazards of reverse flow are the following:

     •    Reverse flow can lead to unintended chemical or physical
          reactions.  An unexpected exothermic reaction in a storage
          tank from backflow of process reactants is an example of a
          chemical reaction hazard.  Overpressurization through
          unintended flashing of liquid is an example of a physical
          reaction hazard.  This could occur, for example by reverse
          flow of a liquid into a heated process vessel.
          Unintentional contact of water and hot oil in refinery
          systems has sometimes caused steam explosions.

     •    Reverse flow through pressure relief vent headers can
          cause obstruction of vent lines, contamination by leakage
          through unseated pressure relief valves on other equipment
          connected to a common header, and excessive back pressure
          on relief devices, with all the attendant hazards that may
          result from these effects.

Fluctuating Flow—
     Fluctuating flow can be caused by a variety of conditions.  Reciprocating
prime movers such as piston pumps inherently generate a fluctuating flow,  but
processes using such devices are either designed to accommodate the
fluctuations, or have special dampers to reduce the fluctuations.  Fluctuating
flow may be a hazard when it is unintentional.  Some common unintentional
causes of fluctuating flow include cavitation in centrifugal pumps and
improperly tuned automatic process control loops.  Some hazards of fluctuating
flow include:
                                      43

-------
     •    Severe pulsations which can damage piping and equipment.
          Even moderate pulsations over time may lead to fatigue
          failure in piping or other process hardware.

     •    The overall controllability of a process  is degraded.
          making it inherently less safe.

     •    Depending on the oscillatory time period  of fluctuations,
          fluctuating flow can lead to the same problems as low  or
          excess flow, depending on the relative process system
          dynamics in response to heating or cooling, for example.

Hammer Blow—
     The phenomenon of hammer blow, also referred to as "water hammer," is the
propagation of a pressure shock wave through a liquid in a pipe  line or other
equipment.  It occurs when flow is abruptly shut off.  An example is when a
control or solenoid valve is suddenly closed.  It can also occur with manual
valves, such as ball valves, that can be closed quickly.  The pressure shock
can be destructive to piping and other equipment in liquid-handling  systems.
The primary hazard is piping or equipment rupture that could directly or
indirectly cause the release of a toxic chemical.  A more insidious  aspect of
this phenomenon is that even if its effects are not immediately  evident, its
repeated occurrence may cause stress fatigue and eventual piping or  equipment
failure.

     Three conditions that can lead to "water hammer" are (16):

     •    Hydraulic shock;

     •    Thermal shock; and

     •    Differential shock.
                                      44

-------
     Hydraulic  shock occurs when  there is an abrupt interruption of flow.  The
 conversion of the kinetic energy  of the moving fluid to a physical pressure
 force is proportional to the square of the velocity, and the resulting pres-
 sure shock wave can be considerable.  Hydraulic shock can occur from an abrupt
 valve closure, which includes check valves in pump systems when pumps are
 started or stopped.  This phenomenon can be alleviated by providing a water
 hammer arrester in the line or by providing slower closing valves.  Special
 consideration needs to be given to this effect when the line handles toxic
 materials directly, or in other process lines whose rupture could indirectly
 lead to a toxic release.  This phenomenon must also be avoided in automated
 process systems where actuator action can cause abrupt valve closures.  Manual
 systems may be less prone to this effect, but may not be entirely immune.

     Thermal shock can occur when bubbles of vapor trapped in condensing
 liquids suddenly collapse, causing rapid liquid influx and shock waves to
 occur within the liquid.  This can also occur in condensing two-phase systems
 where gas becomes entrapped between slugs of liquids.  Each of these forms of
 hydraulic shock can damage equipment.

     Differential shock can occur from two-phase flow in piping where the gas
 phase creates a plug of liquid from wave action, resulting in a high gas side
 pressure drop from the upstream to downstream side of the plug.  The plug
 accelerates and gains enough momentum that when a change of direction is
 encountered,  at an elbow for example, the inertia prevents the plug from
 changing direction as rapidly as  the gas and a shock occurs.  This shock can
be great enough to cause damage to the piping.

 2.3.2  Technology of Flow Control

     The flow measurement and control system is intended to prevent flow
deviation from leading to accidental releases.  Initial process design or
subsequent process modifications must provide for proper selection,
implementation,  and operation of these systems.  Adequacy and reliability are
the two evaluation criteria for these systems.

                                      45

-------
Measurement and Control—
     Flowmeters are used for sensing and measuring fluid flow.   A controller
responds to this measurement and commands the final control element to appro-
priate action.  The primary control element for fluid flow is the valve,
actuated manually for manual control or through a mechanical actuator system
for automatic control.  The reliability of the fluid flow system depends on
the reliability of the individual components.

     A distinction is made between sensing and measurement elements.  Sensing
refers to detection; whereas measurement refers to converting flow sensing to
a numerical quantity expressed in appropriate units of measurement.  This is
an important distinction when considering the appropriateness of various
components in a flow measurement system, since different combinations of
sensors and final measurement devices may encountered.  Proper sensing and
measurement of flow is the basis for controlling all other process variables:
temperature, pressure, composition, and quantities.

     The primary types of flow meters in common use in chemical process plants
include the following:

     •    Differential static pressure;

     •    Momentum transfer  (target, turbine, and positive displace-
          ment meters);

     •    Variable area displacement;

     •    Vortex shedding; and

     •    Magnetic field.

Each type  of  meter is  more appropriate  for some  applications than others.   For
example, static pressure-based meters require small holes  in either probes,
flanges, or pipe walls, which can become  clogged by solids.  Such meters  are
                                       46

-------
obviously inappropriate when suspended solids are present in fluids.  Improper
selection of a flowmeter can lead to a process hazard.

  The controller, responding to the information received from the flow
measurement system, operates either a prime mover or a control valve.  Flow
control requires only proportional and integral controller action.  The
characteristic noise found in flow systems precludes derivative control
action.  A further characteristic of flow control is that there may be some
transportation lag, but, in general, a flowing fluid responds quickly to the
control action.

     The final control element is usually the control valve.  Sometimes,
however, flow may be controlled indirectly by changing a pump setting or a gas
pressure on a pressurized fluid feed tank.

     Important criteria in the selection and operation of control valves
include the proper size, trim, and action.  Control valves and a pressurized
feed tank system usually allow a quicker control response than a pump, with
the exception, perhaps, of a complete shut off.  This should be born in mind
when evaluating flow control options for high-hazard systems.  An automatic
control valve should have a fail-safe action.  It should fail appropriately
open or shut in the event of a loss of electrical power or instrument air.

Emergency Trip Systems—
     Flow switches may be used to sense either the initiation or cessation of
fluid flow.  These are primary devices in alarm and shutdown systems for
chemical processes based on a flowing stream.

     There are two categories of flow switches:  variable-area devices and
velocity-sensing devices (17).  Low cost, simple switches based on both of
these operating principles are available.  These switches are suitable for
applications where' accurate settings are not required, such as lubricating-oil
flow to rotating machinery.
                                      47

-------
     More accurate switches may be required in critical applications,  such as
detecting flow deviations before a process is endangered.   Here variable-area
or rotameter type switches or orifice type differential pressure flow  switches
would be appropriate.   Differential type switches can be direct acting or can
transmit a pneumatic or electronic signal to the switch mechanism,  alarms, or
relays.

     Variable-area switches have good rangeability,  but usually cannot be used
for flows as large as differential switches can handle.  The latter are more
limited at low flow ranges because of the square-root dependency of the signal
or flow. They may become unreliable if the flow drops too rapidly below the
maximum design flow.  These types of switches are sensitive to the range
selected for their application.  Many other types of switches are available.
For example, a pressure switch can be used as a flow switch by sensing
pressure in a system when flow is present.

     When integrated into a total emergency trip system, flow switches actuate
valves and relays to close and open lines, and turn motors on and off.  As
will be discussed in other portions of this document, emergency systems
controlling fluid flows are the basis for emergency control of pressure,
temperature, quantity, and composition.

     In general, exceeding the operating range of these types of switches may
cause no permanent harm.  However, where the reliability of the switch is
really critical, the range must be selected with careful consideration of the
likelihood of overrange service and the risk of harm caused by it.  More
details on the role of flow switches in process emergency control can be  found
in various literature sources  (e.g., Reference 17).

Reverse Flow Prevention—
     Reverse Flow prevention can be achieved by specific equipment, equipment
configurations, and operational procedures.  Equipment  includes check-valves,
sensing, automatic shutoff valves, and positive displacement pumps  (rather
than centrifugal pumps).  Equipment configurations  include  relative elevation
differences or traps between equipment items.  Procedural approaches  include

                                       48

-------
direct shutoff with existing valves, or diversion of flow.  The procedural
methods depend on the sensing of and corrective response to reverse flow, and
on previous provision for diversion in the design or construction of a
facility.

     The technological basis for reverse flow prevention is, therefore, the
installation of the appropriate equipment.  The most common device is the
check valve.  Various types of check valves are shown in Figure 2-3.  Typical
applications of the various types are given in Table 2-6 (18).  While check
valves provide some protection, they can fail by sticking open or not
reseating properly.  Sole reliance on check valves may be undesirable in
critical service.

     The principle of reverse flow prevention using positive displacement
pumps is illustrated by comparison between a positive displacement pump and a
centrifugal pump, as shown in Figure 2-4.  Because the inherent clearances
within a positive displacement pump are less than a centrifugal pump, reverse
flow may be reduced when a positive displacement pump is not running.  When it
is running, an increase in upstream pressure is met by an increase in pumping
head and maintenance of forward flow.  In a centrifugal pump, the flow falls
off sharply as upstream pressure increases and in extreme cases reverse flow
can occur even if the pump is running.  An idle centrifugal pump offers very
little resistance to backflow.

     Reverse flow is prevented through elevation differences when the feed
vessel is sufficiently higher than the host vessel, ensuring that no condition
in the host vessel would be sufficient to overcome the fluid head differential
between the vessels.

     The trap principle of reverse flow prevention is based on interruption of
flow with an intermediate vessel.   During normal flow,  the fluid is repumped
for continued transport.  Other arrangements may exist.  The basic principle
is interruption of stream continuity so that flow is not readily reversed.
                                       49

-------
      SWING CHECK VALVE
  HORIZONTAL LIFT CHECK VALVE
       BALL CHECK VALVE
                                  CO
                                  o
Figure 2-3.   Check valve types,
            50

-------
                                              TABIE 2-6.   TYPES CF OMXVALVES
    Type
Mechanism
Application
Limitations
String check   Flow keeps swing gate open, while
              gravity and flow reversal close it.
              Tilting-type is pivoted at center
              and insures closing without slam-
              ming. Outside levers and weights
              are used on standard swing checks
              greater sensitivity for changes
              in flow is required.

Piston check  Flow pattern as in globe valve.
              Flow forces piston up and reversal
              and gravity returns it to seat.
Ball check    A lift-type check consisting of
              a ball with guides.
                                                   General:
                                                   lines.
                                  Prevent back-flow in
                        Where mininun pressure drop is
                        required-Best for liquids and
                        for large line sizes.
                        Good for vapors, steam,  and water.
                        Suitable for pulsating flow.
                        Stops flow reversal more rapidly
                        than others.  Good for viscous
                        fluids which deposit solid residue
                        that would impair operation of
                        other types.  Vertical or hori-
                        zontal installation is possible.
                         Not suitable in line subject to
                         pulsating flow.  Sane styles
                         operate only in a horizontal
                         position.
                         Many designs are for horizontal
                         service only.  Not cannon in sizes
                         over 6 in.  Nat recommended for
                         service which deposit solids.

                         Not cannon in sizes over 6 in.
                         Not suitable for lines subject to
                         pulsating flow.
Source:  Adapted fron Reference 18.

-------
                                 REVERSE
                                  FLOW
                                            NORMAL
                                           DISCHARGE
            CLEAR PATH FOR
             REVERSE FLOW
            NORMAL
            SUCTION
                                               PUMP CASING
                                                  SHAFT
                                                IMPELLER
        A.  ILLUSTRATION OF REVERSE FLOW THROUGH CENTRIFUGAL PUMP
   GEARS OBSCURE CLEAR
  PATH FOR REVERSE FLOW
          NORMAL
          SUCTION
                                           GEAR
           PUMP CASING
 NORMAL
DISCHARGE

  REVERSE
   FLOW
                                           GEAR
B.  ILLUSTRATION OF PREVENTION OR REDUCTION OF REVERSE FLOW IN A GEAR PUMP
      Figure 2-4.   Examples  of backflow  through  pumps.
                                52

-------
Blockage Prevention—
     Prevention of blockage means that any valves or pumps must be prevented
from failing in a closed position when they should remain open.  Lines, ports,
and orifices must be kept clear of debris.

     There are numerous potential sources of debris in chemical processes.
Especially during startup especially, debris is present from pipe tape,
ordinary dirt, welding drippings, corrosion scale, and the nuts, bolts, and
other items inadvertently left in lines and equipment.  Vigilance on the part
of the startup personnel is the first defense against flow blockage occurring
from such sources.  Technological solutions include screens, strainers,
filters, and traps.

     When in-line screens, strainers, and filter devices are applied to
prevent blockage, a secondary hazard is associated with the use of such
devices; if not properly maintained they can become the source of blockage.
The appropriateness of use must be evaluated on a case-by-case basis.  Also, a
filter can be provided with a bypass activated by a high upstream pressure on
high pressure drop across the filter.

     Two insidious causes of flow blockage are the buildup of corrosion
products and the accumulation of polymer materials from the side reactions of
various process fluids.  Another is the attrition and breakage of solid
materials in processes such as catalyst pellets and packing using in packed
beds.  Technological solutions here include the methods listed above, as well
as changes in the characteristics of the solid materials used in the process.

     Blockage or flow reduction is also a possibility under certain
circumstances with slurries, high viscosity fluids, and melted materials at
low temperatures.  This can occur, for example, in coolers, or due to very low
ambient temperatures.   Solidification or buildup in slurries or freezing
materials can reduce flow or cause complete blockage.  The increase in
viscosity can sharply reduce the flow rate for fluids.
                                      53

-------
Siphoning Prevention—
     Siphoning can be prevented through proper design to ensure that if piping
from a lower elevation to a higher elevation is submerged at the higher
elevation end, appropriate steps have been taken to prevent backflow
siphoning.  Another technique is an interlock system wherein closure of a
valve or cessation of pumping or failure of flow to stop will activate an
alarm.

2.3.3  Control Effectiveness

     The effectiveness of flow control is evaluated in terms of performance,
limitations, and reliability.  Proper selection is important to ensure that
these criteria are met.  Some guidelines for flowmeter selection are
summarized in Table 2-7 (19).

     The performance of individual components and complete systems depends on
the interaction of physical and design choices made by the designer and
fabricators.  Sensors are limited by how sensitive they are to pressure and
temperature beyond their design limits, and resistance to corrosion or erosion
by process fluids.  Controllers vary by type and individual vendor.

     The effectiveness of emergency shutdown systems depends on individual
components and on the overall system design.  A key factor here is the
response time required to achieve safe flow shutoff and the integrity of that
shutoff.

     Reverse flow prevention depends on the functioning of check valves and on
the prevention of overpressurization of downstream vessels.  Siphoning
prevention relies on proper process design and construction and on other
safeguards such as interlocks and alarms.
                                      54

-------
                                TABLE 2-7.  FLOWMETER SELECTION GUIDE
Flowmeter
Element
Orifice
Wedge
Venturi tube
Recommended
Service
Clean, dirty
liquids; some
slurries
Slurries and
viscous liquids
Clean, dirty,
and viscous
Turn— Down
Ratio
4 to 1
3 to 1
4 to 1
Typical
Accuracy,
Percent
+ 2 to + 4
of full scale
_+0.5 to +2
of full scale
+1 of full
scale
Viscosity
Effect
High
Low
High
Relative
Cost
Low
High
Medium
Flow nozzle


Pitot tube

Elbow meter



Target meter



Variable area
Positive
Displacement
liquids, some
slurries

Clean and dirty     4 to 1
liquids

Clean liquids       3 to 1

Clean, dirty        3 to 1
liquids, some
slurries

Clean, dirty,       10 to 1
viscous liquids,
some slurries

Clean, dirty,       10 to 1
viscous liquids

Clean, viscous      10 to 1
liquids
+1 to +2
of full scale

+3 to +5
of full scale

+5 to +10
of full scale

+1 to +5
of full scale
+1 to +10
of full scale

+0.5 of
rate
High


Low

Low



Medium



Medium


High
Medium


Low

Low



Medium



Low


Medium
                                                                                      (Continued)

-------
                                               TABLE  2-7  (Continued)
01
Flowmeter
Element
Turbine

Vortex

Electro-
magnetic



Ultrasonic
(Dobbler)

Ultrasonic
(Time-of-travel)
Mass (Coriolis)


Mass (Thermal)



Weir (V-Notch)

Flume (Parshall)

Recommended Turn— Down
Service Ratio
Clean, viscous 20 to 1
liquids
Clean, dirty 10 to 1
liquids
Clean, dirty, 40 to 1
viscous
conductive
liquids and
slurries
Dirty, viscous 10 to 1
liquids and
slurries
Clean, viscous 20 to 1
liquids
Clean, dirty, 10 to 1
viscous liquids.
some slurries
Clean, dirty, 10 to 1
viscous liquids,
some slurries
100 to 1
Clean, dirty
liquids
Clean, dirty 50 to 1
liquids
Typical
Accuracy,
Percent
+0.25 of
rate
+1 of rate

+0.5 of rate




+5 of full
scale

+1 to +5
of full scale
+0.4 of rate


+1 of full
scale


+2 to +5
of full scale
+2 to +5
of full scale
Viscosity Relative
Effect Cost
High High

Medium High

None High




None High


None High

None High


None High



Very low Medium

Very low Medium

       Source:   Adapted from Reference 19.

-------
     Overfill protection relies on proper quantity measurement, as discussed
in Section 2.6 of this manual, as well as an overall good flow control and
proper shutoff.

     The effectiveness of any system depends on its reliability.  The funda-
mental elements of reliability include measurement, attenuation, and shutoff.
The primary components of measurement are sensor and measurement devices.
Attenuation is achieved by valve action, as is shutoff.  System reliability
depends on the reliability of the individual components and the system hard-
ware and software.  Software components include dead bands, dead time, and
other dynamic response characteristics.  And, as pointed out in the discussion
on process control, the ultimate control of flow depends on the interaction of
the control system with the process flow characteristics as much as on the
characteristics of the control loop itself.  Table 2-8 presents some typical
reliability information on flow control components expressed as typical
failure rates.

     If a hazard evaluation discovers that the flow of specific streams is
critical to preventing conditions that could lead to an accidental release,
the entire flow sensing, measurement, and control system needs to be examined
critically for its integrity.  If necessary, the system needs to be modified
to function more reliably.

2.3.A  Summary of Control Technologies

     Table 2-9 summarizes major hazards or hazard categories associated with
flow, and the corresponding control technology for both new and existing
facilities.  Numerous individual control technologies or procedural changes
can be inferred for each category, based on the proceeding discussion of this
section.
                                      57

-------
         TABLE 2-8.   TYPICAL  FAILURE  RATES  OF FLOW  CONTROL  COMPONENTS



                                                    Failure Rate

                     Component                       Failures/Year
          Flowmeters



            D/P cell  and transmitter                   0.76-1.73



            Magnetic                                       2.18



          Flow controller                              0.29-0.38



          Control valve                                0.25-0.60



          Flow switch                                     1.12



          Flow indicators                                 0.026


                                                               -4
          Check valve (backflow prevention)             1.10  x 10



          Control loop                                    1.73







Source:   Adapted from Reference 1.
                                      58

-------
           TABLE 2-9.  MAJOR HAZARD AND CONTROL TECHNOLOGY SUMMARIES
Process
Variable
 Hazard
New Facility
Existing Facility
Flow
•  Low Flow
   - Blockage
• Flow, pressure,
  and temperature
  monitoring

• Screening or
  filtration

• Materials of
  construction

• Equipment selection

• Construction
  supervision

• Design for
  polymerization
  inhibitors
• Add new flow,
  pressure, and
  temperature
  monitoring

• Add screening or
  filtration

• Change materials of
  construction

• Change equipment
  type

• Enhance maintenance

• Add polymerization
  inhibitors
              - Vapor lock
                     • Design of            • Change temperature
                       temperature control    control system
                       system
                                            • Change equipment
                     • Equipment selection    type

                                            • Change process
                                              chemistry
              - Cavitation
                     • Design of            • Change temperature
                       temperature control    control system
                       system
                                            • Change equipment
                     • Equipment selection    type

                                            • Change process
                                              chemistry
                Mechanical
                failure in
                prime mover
                     • Equipment selection  •
                         Change equipment
                         type
                                                               (Continued)
                                     59

-------
                             TABLE 2-9 (Continued)
Process
Variable
Hazard
New Facility
Existing Facility
              - Leakage
                    • Equipment selection  • Change equipment
                                             type
            • Excess Flow
                    • Flow, pressure,
                      and temperature
                      monitoring

                    • Flow limiters

                    • Automatic flow
                      shut-off trips

                    • Emergency bypass
                      diversion
                       • Add new flow,
                         pressure, and
                         temperature
                         monitoring

                       « Add flow limiters

                       • Add automatic flow
                         shut-off trips

                       • Add emergency bypass
                         diversion
            • Reverse Flow
                    » Check valves

                    • Pressure control

                    • Emergency bypass
                      diversion
                       • Add check valves

                       • Add pressure control

                       e Add emergency bypass
                         diversion
                                 • Equipment selection  • Change equipment
                                                          type
            • Fluctuating Flow
                    • Use pulsation
                      dampeners

                    • Process control
                      system design

                    • Equipment selection
                       • Add pulsation
                         dampeners

                       • Change process
                         control system

                       • Change equipment
                         type
            • Hammer Blow
  System piping
  design

  Equipment selection
                                           • Change piping

                                           • Change equipment
                                             type
                                      60

-------
2.3.5  Costs

     Both rough, order—of-magnitude capital and total annual costs of the
various technological approaches to process modifications for flow have been
estimated.  Table 2-10 summarizes estimated costs.

2.3.6  Case Example (1)

     A serious accident occurred at a plant where ethylene oxide and aqueous
ammonia were reacted to produce ethanolamine.  Ammonia backflowed in the
ethylene oxide line, reaching the ethylene oxide storage tank.  The ammonia
went past several non-return valves in series, and past a positive
displacement pump through a relief valve that discharged into the pump suction
line.  The ammonia reacted with 7,940 gal. of ethylene oxide in the storage
tank, which ruptured violently.  The resulting vapor exploded, causing
widespread damage and destruction.

2.4  PRESSURE CONTROL

     Pressure is the driving force for flow, and is therefore the driving
force in any chemical release.  Control of pressure is central to the preven-
tion of accidental chemical releases.  This section discusses pressure mea-
surement and control considerations.

2.4.1  Pressure Hazards

     Overpressure and underpressure can increase the probability of an acci-
dental chemical release.   Either can cause physical failure of process or
storage equipment.  Overpressure can cause the opening of a relief device,
thereby allowing a toxic  chemical to enter the environment.  Potential
consequences range from a small release of hazardous materials through leakage
to a large,  sudden release through the total and rapid failure of containment.
Generally, overpressures  are considered more hazardous than underpressures.
                                      61

-------
  TABLE 2-10.  COSTS OF COMPONENTS
               FLOW SYSTEMS
ASSOCIATED WITH PROCESS MODIFICATIONS FOR
Basis:  4 inch diameter pipe line.
        Flow rate 250 gpm
        Pressure 50 psig.
   Capital Cost    Annual Cost
     Range ($)    Range ($/yr)  References
Flowmeter (D/P cell and
        transmitter, magnetic,
        and turbine)

Flow switch

Flow indicators

Check valve

Controllers
 - Single loop, PID
 - Simple interactive, PID
 - programmable, PID

Control Valve

Control loop
 - Conventional
                                               (1986 Dollars)
   2,500 - 5,100    380 - 780
    380 - 1.000

     380 - 570
     800 - 1.600
  $1,600 - 3,000
   2.000 - 6,000
 60 - 150

  60 - 90
 69 - 138
 138 - 260
 173 - 519
5. 20. 21

21

5. 20, 21, 22

5. 20. 21, 22


4, 24, 25
   3.000 - 6,000    450 - 900   23. 26. 27
  6.000 - 12,000
  3.000 - 15.000
900 - 1.800  Composite
260 - 1.298
                                      62

-------
but process underpressure can also result in equipment failure by collapse or
by causing leakage or backflow of incompatible materials.  Process design or
modification must include consideration of both over- and underpressure.

     Structural failures caused by overpressure will often occur initially at
a seal or joint and secondly in cracking or rupture of vessels, piping, and
casings of other equipment (e.g.. pumps).  Potential sources of process leaks
caused by overpressure include flanges, valve stems, pipe joints, welded or
riveted vessel seams, and pump or compressor seals.  Structural failures in
vessel and pipe walls and equipment casings may occur as limited cracks or
total failure.

     A second, indirect group of hazards are process effects from pressure
deviations from specified operating conditions.  Since pressure is the driving
force for flow, pressure deviations can lead to flow deviations with their
attendant hazards, as discussed in Section 2.3 on Flow Control.  Pressure also
can affect process chemistry.  Disturbances in pressure for a pressure sensi-
tive process can sometimes result in the formation of unstable or incompatible
by-products that could contribute to the pressure disturbance and result in
overpressure and accidental release.

     Initial process design and process modifications associated with pressure
must consider all factors contributing to pressure deviations and loss of
pressure control.  These include process, equipment, and operating considera-
tions.

     Three related primary process events can lead to loss of pressure con-
trol:  thermal expansion, excess material generation, and flow restriction.

     Thermal expansion may be caused by a loss of temperature control or by
excess  heat due to a high reaction rate.  Loss of temperature control may be
caused  by a malfunction in cooling and heating systems,  or inadequate heat
transfer due to inadequate mixing or fouling of heat transfer surfaces.  Loss
                                     63

-------
of reaction rate control may be caused by a loss of flow, temperature, compo-
sition control, or inadequate mixing.

     Excess material generation may occur from runaway reactions or from
uncontrolled flashing of liquids from sudden contact with high temperatures.
If a reaction generates more moles of material than it consumes, then an
accelerated reaction rate may generate enough excess material to result in an
overpressure.  Uncontrolled flashing could occur if a liquid were inappropri-
ately introduced into a high temperature process.

     Flow restrictions that occur as a result of fouling, freezing, valve
closure, or other physical blockage may lead to an overpressure upstream of
the restriction.

     In many instances, the process failures listed above are caused by a
mechanical failure in equipment.  These failures may be the result of
exceeding design capabilities, improper design, poor maintenance, defective
equipment, fatigue failure, or corrosion.

     Since not every form of mechanical failure can be prevented, insufficient
design preparation to minimize the impact of mechanical failure can also be
listed as a factor that contributes to loss of pressure control.

     A loss of pressure control may occur as a result of fundamental design
flaws, poor operating and maintenance practices, or insufficient operator
training, especially in response to non-routine operating conditions.

2.4.2  Technology of Pressure Control

     The pressure measurement and control system helps prevent accidental
releases resulting from pressure deviation.  Initial design or subsequent
                                      64

-------
process modifications must provide for proper selection, implementation, and
operation of these systems.  Pressure relief for either excess over- or excess
under-pressure is a fundamental aspect of pressure control.

Measurement and Control—
     Pressure measurement relies on both sensing and final measurement
devices.  Control relies on how a system responds to pressure to take
corrective action.  Many types of pressure sensors and measuring devices are
available, each having some unique feature in the mechanism it uses to sense
and measure pressure.  Probably the most common type of device in the process
industries is the Bourdon gage, which is described in numerous texts and
handbooks.  A second category of devices is electronic.  The most common type
in this category is probably the strain gage sensor coupled with an
appropriate signal conditioning and read-out instrument.  The choice of device
depends on the needs of the process and the operating environment.  The actual
pressure device must often be protected from direct contact with the process
fluids.  The device mechanism, combined with the method by which it is
protected from process fluids or even external environments will determine the
device's overall performance.

     The pressure controller is the next device to be considered in a pressure
control system.  Details of these devices are discussed in numerous texts and
handbooks in the general technical literature.  Pressure control is achieved
through control of the flow of a fluid (discussed in Section 2.3 on flow
control).

     Preventing the realization of pressure hazards requires the proper
selection of pressure measurement and control equipment in both initial design
and subsequent process modification.  Proper selection must consider accuracy,
precision, and reliability.  A change in a pressure sensing and measurement
element may be an appropriate process modification to enhance process safety.
                                      65

-------
Emergency Pressure Relief Systems—
     An emergency pressure relief system is the final step in preventing
overpressure or under pressure when the basic control system fails.   Under
certain circumstances a pressure relief system will be designed to vent
directly to the atmosphere. This type of system is often used for emergency
venting of explosions or where nonhazardous materials are involved.   Its
appropriateness where toxic materials are involved is debatable, unless an
explosion or other effects of overpressure are a greater hazard.  For toxic
materials, a total containment system designed to capture and store  the
released material for later treatment and disposal, or to capture and treat
the material as it is vented to render it "nonhazardous" before it is re-
leased, may be desirable.  These systems are composed of a pressure  relief
device (a rupture disc, safety-relief valve or combinations), a vent header
system, and a catch vessel or a final treatment device (usually a flare or a
scrubber).  The treatment devices are discussed in more detail elsewhere in
this document; descriptions of the remaining components in a total containment
system are presented below.

     Rupture discs—A rupture or bursting disc is a non-reclosing pressure
relief device composed of a pressure sensitive disk or membrane held in place
by a support structure.  A disc subject to reverse pressure may be fitted with
an additional support designed to prevent reverse pressure rupture of the
disc.  A typical rupture disc arrangement is illustrated in Figure 2-5.

     Types of rupture discs include domed discs, composite discs, reverse
domed discs, and flat discs.  Materials of construction include metal, plas-
tics, resin-impregnated graphite or some combination of these.  The rupture
disc is frequently constructed with a corrosion- resistant coating or liner.
A temperature shield such as an insulating flock may be installed upstream of
the disc to protect it from high temperatures; however, this device would not
be appropriate for rupture discs discharging into a downstream pipe or mani-
fold system where constrictions would trap the flock material and cause a
pressure venting discharge restriction.
                                      66

-------
   HOLD - DOWN
                     DISC
                                      1
                                      8
                           BASE HOLDER
Figure 2-5.   Typical  rupture disc installation,
                    67

-------
     Discs may be piercing or non-piercing.  A piercing disc has an assembly
that contains a knife edge against which the disc presses as it ruptures to
ensure a clean, complete, full-dimensional break.

     Rupture discs may be used alone or upstream of a safety relief valve
(discussed below).  A rupture disc is often placed upstream of a relief valve
to prevent leakage through a relief valve that may not reseat effectively,  or
to protect the valve against corrosion or even plugging from protracted
polymerization of monomer vapors.  This latter phenomenon has been known to
occur.

     Sizing and selecting a rupture disk should follow accepted design
procedures, such as those recommended by the Design Institute for Emergency
Relief (DIERS) of the American Institute of Chemical Engineers (AIChE),
American Petroleum Institute (API) or the American Society of Mechanical
Engineers (ASME).  A new set of standards that is a fairly comprehensive guide
for both manufacturers and users of bursting disks has been assembled in Great
Britain.  An overview of rupture disks with numerous references is presented
in a comprehensive book on loss prevention by Lees (1).

     The Design Institute for Emergency Relief Systems (DIERS)  has assembled a
manual and a computer program package useful to a safety-relief system
specialist; however it is not geared toward the novice.  This document is
particularly important when considering the effect of two-phase, vapor-liquid
flow on the sizing of a relief device.  Two-phase flow occurs when a pressur-
ized vessel that contains liquid is rapidly depressurized.  The occurrence  of
two-phase flow during emergency relief almost always requires a larger relief
system (two to ten times the area), compared to that required by vapor vent-
ing.  Some of the information generated by DIERS has been used by Fauske to
develop a nomograph for sizing an emergency relief device (28).

     Safety-relief valves—The term "pressure relief valve" is a generic term
applied to various types of valves used to relieve pressure.  API RP 520 gives
                                      68

-------
 additional definitions within  the  safety  relief valve category  (30).  A safety
 valve  is characterized by  rapid  full opening, or pop action, and is normally
 used for steam,  air, gases,  or vapors.  Relief valves are used  primarily for
 liquid service and  are characterized by valve openings proportional to the
 rise in pressure over the  opening  pressure.  A safety-relief valve can be used
 for either liquid,  vapor or  gas  service.  In practice, the terms safety valve,
 relief valve, and safety-relief  valve are often used interchangeably.

     A conventional safety-relief  valve is illustrated in Figure 2-6.  For
 this device, the bonnet (as  shown  in the diagram) may be vented either to the
 atmosphere or to the discharge side of the valve.  Backpressure will decrease
 the set pressure for a valve with  a bonnet vented to the atmosphere and will
 increase the set pressure  for  a  valve with a bonnet vented to the discharge
 side of the valve.  To compensate  for the effects of backpressure,  a balanced
 safety-relief valve may be used.   For this type of valve, backpressure in the
 discharge line will have very  little effect on the set pressure of the valve.
 The balanced safety-relief valve is often the most appropriate type of valve
 for a  total containment system.

     A final type of valve is  the  pilot-operated safety-relief valve, which is
 designed to achieve good mixing  of the substance being discharged and air.   A
 pilot-operated safety valve is often used when a flammable material must be
 diluted below its flammable limit with air before it can be safely released.

     The API, ASME, and the National Fire Protection Association (NFPA)  have
 each issued guidelines and standards for the sizing and installation of
 safety-relief valves (29,30,31).  Criteria for sizing include fire  exposure,
 fill rates, thermal expansion, and reaction/decomposition venting.   DIERS
manual also applies to safety relief valves.   William A.  Scully has prepared a
brief  discussion of some of the common malfunctions of safety-relief valves
and how these malfunctions can be corrected (32).   D.M.  Papa discusses the
effects of back pressure on a safety relief valve (33).   The pitfalls of
                                      69

-------
           SCREWED
             CAP
             BONNET
             GASKET
                                           ADJUSTING
                                            SCREW
                                                        -
                                                        8
               BODY
Figure 2-6.  Cross-section of a typical pressure relief valve,
                               70

-------
sizing a relief valve when the equipment (specifically, a distillation column)
will be used for more than one process is discussed by Bradford et. al. (34).
An overview of pressure relief valves, with numerous additional references,  is
presented by Lees (1).

     An important consideration in relief valve installations is to keep then
from being isolatable while still providing for their maintenance while a
process unit is-on-line.  A twin-valve configuration with a two-way,
three-port block valve, which blocks only one relief valve at a time,  is
desirable.  When a standard block-valve is used upstream of either a single  or
two relief valves, it should be locked or sealed open to prevent unintentional
or unauthorized closure.

     Vent headers—The vent header is the pipework that delivers material from
the discharge side of the relief device to a point where it can be rendered
nonhazardous.  These systems are often complex, having several relief  devices
using one common header system.  For toxic materials, it might be well to
consider addition of a header to the relief device system that leads to some
form of secondary containment or treatment.  However, depending on the
situation, even with a toxic material, a discharge directly to the atmosphere
still might be a safer condition than risking a restricted relief discharge.
The appropriate configuration must be evaluated case by case.

     Sizing the vent header for an emergency relief system is not a simple
matter.  For safety, the system must be sized to accommodate more thant the
flow from the largest single source.  For economy, the system must usually be
sized for some flow less than the sum of all sources.  In approach presented
by Fitt, overpressure due to fire, electrical power failure, instrument air
failure and cooling water failure are considered (35).  Fitt calculates the
effect of each of these failures for three different time periods and  sizes
the pressure relief header for the maximum load that results from failure of
one of the items.  A method for sizing relief headers is also given in API RP
520 (29).
                                      71

-------
     Pressure trip systems—A pressure trip system may be used instead of an
emergency relief system.  A pressure sensor activates a switch when the
pressure is approaching an unacceptable level.  The switch then shuts a valve
to isolate a part of a process from the source of pressure.  As an example, a
pressure switch in downstream equipment may stop the flow of steam to a feed
preheater or to a distillation column reboiler.

     Because of the limitations discussed for relief systems, a pressure trip
system should be several tinu-s more reliable than a pressure relief valve for
the same application.  Calculation of this reliability should be based on the
calculated proportion of the time for which a system will be in the failed
state, referred to as the fractional dead time.  This method considers both
the fault-rate of the individual components and the frequency of proof
testing.

2.4.3  Control Effectiveness

     The control effectiveness of pressure control is evaluated in terms of
performance, limitations,  and reliability.

Measurement and Control—
     Table 2-11 lists a variety of pressure sensing and measurement devices
and pressure ranges over which they may be used.   In addition to a pressure
range, each device has a variety of other performance limitations, including
acceptable sensitivity, operating temperatures, reproducibility,  and materials
of construction.  The range of values for these parameters is quite large and
a device is routinely available for almost every  temperature, pressure range,
and operating environment likely to be encountered in typical chemical pro-
cessing applications.

     Because of the large number of choices,  care must be taken to select an
appropriate device for each application.   Each pressure device can only be
expected to perform satisfactorily within its design specifications.   The
                                      72

-------
                                                       TABLE  2-11.    PRESSURE  SENSING  AND MEASURING  DEVICES
                                                                                                     Applicable Pressure Ranees
                                                                 ran Hg absolute
                                                                (Inn Hg = 133 fa)
                              type of Device
                                                      Uf1A  10 10  10"6  10 3  Uf1  1  50  200  AGO 600
                        = 250 Pa)
     PSIG
(psro = 6.9 kFa)
                                                            11   102  103   10*  10
                                                                                    10
                                                                                          -300 -200 -100 -10  -5  -1  +0.1  +1  +5 +10  +100  +200  +300
              Bellows    Abe. Press, Motion Balance
                         Abs. Press. Force Balance
                         Atm. Press. Ref. Motion Bal.
                         Atm. Press. Ref. Force Bal.
                         Aneroid Mmostata
xxxxxxxxxxxxxx
aOOQOOQUUUUUOnOt
              Bourdon    Conventional Bourdon
                         Spiral Bourdon
                         Helical Bourdon
                         Quartz Helix
              Dia-       Abs. Press. Motion Balance
              phragm     Abs. Press. Force Balance
                         Atm. Press. Ref. Motion Bal.
                         Atm Press. Ref. Force Bal.
OJ
              Elec-      Strain gauge
              tronic     Electronic Tranamtters
                         Capacitrve Sensors
              High-      Dead Weight Piston Gauge
              Pressure   Bulk hbdulus Cell
              Sensors    Manganin Cell
                                                                          jmjuouuuuuuooot
                                                                          aOQQQOOQOOOOOUC
              ffeno-      Inverted Bell
              meters     Ring Balance                                               «xjuuouoaxx»xjuoauoonQoooiiiji»ii»«iixxxxxxxiouoixxKioo(
                         Float Mancmeter                                            xxxxxxxxxxxxxxxxxxxx
                         Barometers                                             xxxxMooocxjoooQuoooouQomxjuuuuuuuuuuum      xmuuouua
                         Visual Hjncoeters                                          xiouuoQauououuuoouuuuuuuoDiixjLxioixiot      juuuuuuuui
                         Micrcasnaneters
                         Cartesian Divers

              Pressure   D/P Cell
              Repeaters  Standard Diaphragm
                         Button Diaphragm

              loniza-    Hot Cathode                       m
              tion       Cold Cathode

              Thermal    Thermocouple
                         Thermopile
                         Resistance Wire

              ffech-      McLeod
              anical     Molecular Mcmentun
                         Capacitance                                        xxxjaoooooaooaoooat
                    1:  Adapted frtin Ri>ferpnc%e 19.

-------
degree to which a device can withstand excursions beyond its operating range
varies.  Some sensors may be permanently damaged by even brief excursions out
of their operating range.  The sensitivity of devices to such excursions
should be taken into account during initial design or subsequent
modifications.

     Because there may be no external indication that a pressure device is
giving an incorrect reading, redundancy of pressure sensing and measurement
should be used in all critical processes.  For example, a common failure in a
Bourdon gage is to jam at some false reading.  It may be advisable to use two
different types of devices if the potential cause of device failure is
sensitivity to process pressure excursions.  An appropriate solution might be
to use a cruder, more robust type of device to roughly indicate the pressure
as a back-up for the more sensitive sensor actually used for process control.

     Information on the reliability of a specific device can be supplied by
the vendor, although this information may not itself be reliable and must be
used with caution.  A number of statistics on reliability have been assembled,
some of which are presented later in this section.

Emergency Pressure Relief Systems—

     Rupture discs—A rupture disc is generally preferred over a relief valve
when pressure rise may be so rapid as to virtually  constitute an explosion.
when even minor leakage cannot be tolerated,  or when the potential for
corrosion and/or blockage would limit the effectiveness of a valve.

     The set pressure for a rupture disc is usually specified by a range,  that
can vary anywhere from +/-2% to +/-25% of the mean  bursting pressure (34).

     The reliability of rupture discs varies  with type.   The simplest form is
a flat disc made of a material weaker than the vessel it is designed to
protect.   Because it is virtually impossible  to accurately predict the
                                      74

-------
bursting pressure for this type of disk, a large margin is required between
the operating pressure and the bursting pressure.  An exception is the brittle
bursting disc, often made of resin-impregnated graphite, which is often used
for low pressure and corrosive applications.

     Several types of domed discs are available.  One variety is a thin piece
of dome-shaped metal.  Because they are very thin, their bursting charac-
teristics are altered by even slight corrosion, elevated temperatures, or
minor deformations of the surface.  Pressure fluctuations near the set pres-
sure of these discs can result in premature rupture as a result of fatigue.
Generally these discs cannot be operated above 70% of their rated bursting
pressure, and even less at elevated temperatures (28).  They will collapse
under a comparatively small back pressure and are generally installed with a
backpressure support.  An improvement in domed design is a disc made of
thicker material radially scored to purposely weaken the surface.  Because
most of the disc is made of heavier material, it is less susceptible to
fatigue.  These discs can generally be operated at up to 80% of their design
burst pressure (1).

     The inverted domed disc has advantages over either of the domed disks
described above.  One variety is composed of an inverted dome with a knife
edge or some other variety of puncturing device positioned next to the disc.
When the bursting pressure is reached, the dome inverts and is punctured.
Another variety is so constructed that when the disk inverts it pops free  of
its support and is caught immediately downstream.  Both smooth and scored
surface inverted dome disks are available.   The danger with inverted domed
discs,  however, is that the disc may not be punctured when it inverts.  Tht^e
discs can operate at pressures up to 90% of their design capacity and can  be
manufactured to relieve within 2% to 5% of their design capacity (35).

     Rupture discs are potentially hazardous because they are nonresealable
and they provide total depressurization.  A rupture disc gives no external
indication that it has blown.   Once a disc  has blown, the vessel it  was
                                      75

-------
protecting is no longer isolated from whatever else may be present in the
containment system, and it is possible for material to backflow into the
vessel from the containment system.  This would be hazardous if the materials
were incompatible.  Vessels normally at atmospheric pressure are particularly
susceptible to this since a loss of pressure from the vessel would not
indicate a ruptured disc.  An undetected ruptured disc in an atmospheric
vessel could result from a previous overpressure, damage during installation,
or corrosion.

     Because a rupture disc provides sudden, total pressure relief, it may
result in two-phase, vapor-liquid flow from a pressurized vessel when liquid
is initially present.  This may be hazardous if the disk or the containment
system downstream is not sized for such a release.  Flares and scrubbers for
these types of systems are not usually designed to handle the large quantities
of liquid that could be released.  Any incompatibilities between the liquid
released and the materials within a downstream containment system might be
quite serious because of the quantity of liquid that could be present.  A
knockout vessel of some type is needed when a two-phase release is possible.
In such cases, and when a heated material whose melting point is above ambient
temperature is involved (such as molten sulfur),  particular care must be
taken.   Lines leading up to, and including the catch vessel must be heated to
prevent plugging when the liquid cools.

     A seemingly trivial,  but actually very dangerous hazard associated with
the use of rupture discs is that they can be easily installed«upside down.
The consequences of installing a disk upside down will depend on the type of
disc, but in most cases the device will relieve at a substantially higher
pressure than intended.  All disks should have a  tag indicating the proper
direction for installation; these tags should be  regularly inspected.

     Other disadvantages of rupture discs are that once installed they cannot
be non-destructively tested,  wrong discs  can be installed,  and multiple discs
nested  together can be installed.  Avoidance of these latter two occurrences
                                      76

-------
requires strict adherence to proper, installer training and auditing
procedures.

     Safety-relief valves—A properly designed safety-relief valve will:
1) open automatically at a pre-adjusted set pressure using the energy of  the
fluid. 2) open fully to its rated flow capacity at a pressure typically not
more than 10% above the set pressure, 3) shut flow off completely when the
pressure falls to a preset reseat pressure (minimally between 3% to 5% below
the set pressure).

     Both undersizing and oversizing a valve can impair its effectiveness.
Undersizing a valve presents the obvious hazard of not being able to relieve
pressure fast enough.  An oversize valve may chatter (rapid opening and
closing), resulting in excessive wear or damage to the valve.  An oversized
valve may reseat improperly, resulting in leakage into or out of the vessel.

     It is common to place a safety-relief valve downstream of a rupture  disc.
The rupture disc will prevent minor leakage of process materials and the
safety-relief valve will allow the process to be resealed when the pressure
drops.  Sometimes a rupture disk of corrosion-resistant materials is used to
protect a safety-relief valve made out of less exotic materials and expensive
materials.  Care must be taken to ensure that the presence of the blown
rupture disk does not affect the anticipated performance of the safety-relief
valve.

     The dangers associated with pressure-relief valves are the possibility of
isolation with shutoff valves either upstream or downstream, two-phase flow
through the valve, and the potential for failure of the valve because of  human
error or mechanical failure.  Another hazard is having other foulable fittings
(e.g. check valves, flame arresters) between a relief valve and a vessel  or
between a relief valve and safe discharge.  These can also cause isolation.
                                      77

-------
     Since the safety-relief valve will reseat  when the pressure drops,  the
potential for two-phase flow is not as  high as  it  is with a  rupture disk.
However, two-phase flow is possible while the valve is  open  and  rapid  release
is occurring.  In the case of a runaway reaction,  a large portion of the
vessel contents may empty before the pressure falls below the reseating
pressure.  As with a rupture disc, a safety-relief valve will be grossly
undersized for a two-phase release if it was sized taking only the vapor
release into account.  Much research has been and  continues  to be conducted in
this area by the Design Institute for Emergency Relief  Systems (DIERS).

     Human error can result in the failure of a safety-relief valve in several
ways.  Unlike a rupture disk, a safety-relief valve has internal settings  that
can be adjusted to alter the performance of the valve.   Incorrect adjustment
of these settings during installation or routine maintenance could increase
the potential for overpressure.  The physical orientation of the valve is
important during installation.  A valve should  be  installed  vertically,  or if
a type is designed for such service horizontally,  with  the discharge pointing
down.  In addition, the valve should not be required to support  the weight of
the discharge piping.

     The hazards associated with any valve are  the same with a safety-relief
valve.  Seals may leak, the valve may plug, or  corrosion and abrasion  may
destroy the integrity of the valve.  These hazards may  be more pronounced  for
a safety-relief valve since it may go for very  long periods  of time without
being called into service.  For this reason, regular inspection  and testing of
the valve is essential to ensure its proper function when required.

     If a safety-relief valve is located downstream of  a rupture disc, then a
pressure-detecting device should be placed in the  line  between the disc  and
valve.  A premature failure of the rupture disk would otherwise  go undetected
and the safety-relief valve would be exposed to the conditions the rupture
disc was installed to prevent.  Also, since the disc relies  on a differential
                                      78

-------
pressure to rupture, a leak could reduce this differential and cause the
pressure to rise well above the set pressure before the disk gave way.

     Vent header—The effectiveness of a vent header depends on its proper
sizing.  The primary danger with vent headers in a total containment system
for pressure relief discharges is that the vent header may not be sized to
accommodate a worst-case event of simultaneous discharge of all or several
relief valves connected to the header system.  A second hazard is the
potential for mixing incompatible materials in the vent header system or
cross-contaminating the contents of one vessel with material vented from
another vessel.

Pressure trip systems—
     A trip system may be preferable to sole reliance on a pressure relief
system when a toxic material is involved.  Because of its mode of operation,
no hazardous materials are discharged in the event of an overpressure.  If
properly applied, a pressure trip system may be more reliable than a pressure
relief system.  However, the system has no backup if not used in conjunction
with pressure relief.  If a safety-relief valve fails to open at its set
pressure, it may open at some higher pressure before the structural limits of
the equipment it is protecting are reached.  A pressure trip system can never
substitute for a pressure-relief valve installed to protect against
overpressure due to fire.

     The reliability of a trip system is a design criterion.  Generally, a
pressure trip system is designed to be at least ten times as reliable as the
pressure relief valve it is intended to complement.

     The reliability of a pressure trip system can be improved by a variety of
methods that may be used to improve the reliability of any control system.
Individual system components may be replaced with more reliable (and usually
more expensive)  components.  Redundancy of hardware and software in various
forms of backup systems may be used.
                                      79

-------
     For critical  applications  a  combined  system may  be configured as follows:

     •    First line of prevention - pressure control loop;

     •    Second line of prevention - pressure trip system;  and

     •    Third line of prevention - relief valve discharging to
          header with protection  technology system (e.g.,  scrubber).

The pressure for activating the system increases at each step.

Reliability of Pressure Control Components—
     The reliability of pressure  control depends on the reliability of the
individual components that comprise the pressure control system.  The reli-
ability of a full multicomponent  control system also depends on the architec-
ture of the specific system.  Table 2-12 presents reliability data for some
individual components.

2.4.A  Summary of Control Technologies

     For both new and existing facilities, Table 2-13 summarizes major hazards
or hazard categories associated with pressure and the corresponding control
technology or procedural categories.  Numerous individual control technologies
or procedural changes can be inferred for each category based on the preceding
discussions of this section.

2.A.5  Costs

     Table 2-1A presents the costs of components associated with process
alternatives  for pressure measurement and control systems.  This table
presents  a list and costs of typical components.  There are many individual
variations of  these component groupings, since other possible components  are
not  included  here.  These costs give an order-of-magnitude basis for
                                       80

-------
       TABLE 2-12.   TYPICAL  FAILURE RATES  OF  PRESSURE  CONTROL  COMPONENTS

                                                    Failure Rate
                     Component                       Failures/year
           Pressure Transducer/Transmitter             0.76-1.73

           Pressure Indicator                          0.026-1.41

           Pressure Switch                                0.34

           Control Valve                               0.25-0.60

           Pressure Controller                         0.29-0.38

           Pressure Control Loop                          1.73



Source:   Adapted from References 2.8,19,37.
                                      81

-------
          TABLE 2-13.   MAJOR HA2ARD AND CONTROL TECHNOLOGY SUMMARIES
Process
Variable
Hazard
New Facility
                                                           Existing Facility
Pressure   Overpressure
                      • Flow,  pressure,  and
                        temperature control
                        system design

                      • Emergency trip
                        system for flow
                        shutoff or
                        automatic venting

                      • Design to avoid  flow
                        blockage

                      • Provide pressure
                        relief for thermal
                        expansion

                      • Provide general
                        pressure relief
                     • Change flow,
                       pressure, or
                       temperature control
                       system

                     • Add emergency trip
                       system for
                       automatic flow
                       shutoff or
                        automatic venting

                     • Change system to
                       avoid flow blockage

                     • Add pressure relief
                       for thermal
                       expansion

                     • Add or change
                       pressure relief
                       system
           Underpressure
                        Flow,  pressure,  and
                        temperature  control
                        system design

                        Emergency trip
                        system for flow
                        shutoff or
                        automatic vacuum
                        break

                        Mechanical vacuum
                        breaker
                     • Change flow,
                       pressure,  or
                       temperature control
                       system

                     • Add emergency trip
                       system for
                       automatic  flow shut
                       off or automatic
                       vacuum break

                     • Add mechanical
                       vacuum break
           Fluctuating Pressure
                      •  Control  system
                        design
                     • Change control
                       system design
                                  • Equipment  selection   •  Change  equipment
                                                           type
                                      82

-------
  TABLE 2-14.  COSTS OF COMPONENTS ASSOCIATED WITH PROCESS MODIFICATIONS FOR
               PRESSURE MEASUREMENT AND CONTROL SYSTEMS
Basis:  4 inch diameter
        piping.  Pressure
        range 0-300 psig
Capital Cost    Annual Cost
  Range ($)     Range ($/yr)
       (1986 Dollars)
References
General purpose pressure
transducer
Indicators
Computer interface system
Pressure gauge
Control valve
Controller
- conventional
- via process control
computer
Control loop
- simple, single loop, PID
- simple, interactive, PID
- programmable, PID
Rupture disks
Relief valves
200-500
200-600
2,000
50-250
3,000-6,000
2.000
6,000-12.000
3,000-15.000


800-1,600
1.600-3,000
2,000-6,000
150-225
7,000-12,000
33-81
33-99
330
8-43
450-900
326
910-1,800
260-1,298


69-138
138-260
173-519
28-42
609-952
40
40
40
40
3,20,21
24,25,26.27



Composite



20.23,28
20.23,27
                                     83

-------
estimating costs of process modifications involving the pressure measurement
and control system.

2.4.6  Case Examples (1)

     An explosion occurred in a vinyl chloride pump on the "recovered" vinyl-
chloride monomer system (RVCM), seriously injuring an operator.   The line
sections before and after the pump had been removed and the explosion occurred
in the idle vented pump about an hour later.   Investigation showed that the
entire RVCM system was contaminated with vinyl chloride polyperoxide, an
unstable material.  There had been earlier abnormal occurrences  where the RVCM
gas compressors had not shut down at low pressure because a pressure switch
had failed.  RVCM liquid had accumulated in the storage tanks for 20 days and
the acidity level in the vinyl chloride feed  had been high.

     A failure of the control system in a chlorine cellrooin caused a back-
pressure to develop.  When operating personnel tried to shut the system down
manually, failure of these controls caused a  serious chlorine release.  One of
two compressors taking hydrogen from a low pressure gasholder continued to
operate and failure of a low level trip created a negative pressure, allowing
air to leak in and cause an explosion in the  compressor cooling  coils.  The
hydrogen/air mixture in the holder diffused into the catalyst purification
unit, a high temperature developed, and another explosion occurred.  The
gasholder trip did not operate because the timer was bypassed by a "jumper".

2.5  TEMPERATURE CONTROL

     Like flow and pressure, temperature is one of the primary variables in a
chemical process.  The temperature of a system strongly influences which
chemical reactions are preferred and the rate at which they occur.  Phase
changes are determined by temperature.  The volume of gases, and to some
extent liquids, depends on temperature.  For these reasons, a loss of pressure
control, discussed in the preceding section,  will often be the result of a
                                      84

-------
loss of temperature control.  The inability to control temperature can
therefore indirectly or directly lead to conditions that cause an accidental
release.  Proper design of a temperature measurement and control system is
therefore essential to preventing accidental releases.

2.5.1  Temperature Hazards

     For some chemical reactions a loss of temperature control may result in a
runaway reaction with excess generation of heat and materials that could lead
to an overpressure and an accidental release.

     A chemical reaction system will generally have a specified temperature
range in which it must operate to successfully produce the desired product.
This range is usually set by balancing reaction rates with economics to
achieve an acceptable reaction rate for the primary reaction, while minimizing
competing reaction rates, the size of reaction vessels,  and heating and
cooling systems.  The consequences of operating above or below the set operat-
ing temperature will be a function of the specific reaction system.

     High temperatures are usually more hazardous than low temperatures, but
both must be considered in evaluating temperature's contribution to process
hazards.  Often a low temperature will slow down or quench the reaction.  This
may be hazardous if an unreacted feed stream is incompatible with downstream
operations.  High temperatures may result in a number of undesirable conse-
quences.  At higher temperatures, reaction rates are likely to increase, re-
sulting in excess heat and material generation that may lead to an over-
pressure.  A high temperature may result in the formation of unwanted by-prod-
ucts because of thermal decomposition of the product or increased reaction
rates for competing reactions.  Thermal decomposition often results in the
generation of more moles of material than are consumed;  this could result in
an overpressure.  The consequences of unwanted by-product formation due to the
competing reactions will depend on the nature of the by-products formed.  The
presence of lighter molecular weight by-products would result in an increased
                                      85

-------
system pressure and could result in an overpressure.   A reaction may form
by-products that react with downstream materials  or that are corrosive to the
materials of construction.  Both of these events  could contribute to the
potential for an accidental release.

     Increases in temperature result in thermal expansion,  which can result in
increase in pressure and an accidental release.  A loss of  temperature control
in any process involving heating or cooling may lead to an  accidental release.
Two-phase processes are more sensitive to temperature fluctuations than
single-phase processes.  Gas phase processes are more sensitive to temperature
fluctuations than liquid phase processes.  However, thermal expansion can be
very destructive in a sealed liquid-full system;  a system with no vapor space.
Sometimes heating or cooling results in a phase change:  freezing, condensing
or vaporization.  Phase changes may lead to overpressure or underpressure.
The expansion of water on freezing is an example of one consequence of cold
temperature.

     Most physical properties vary with temperature.   The performance of any
physical operation will be affected.  The consequences of a temperature
fluctuation  must be evaluated on a case-by-case basis.  Sometimes a loss of
heat to a stream will decrease the solubility of a component in the stream to
the point where it drops out of solution.  Solidified material could clog
lines and would affect the chemical properties of the stream; this could
ultimately lead to an overpressure and an accidental release.  Partition
coefficients are temperature dependent and processes such as liquid-liquid
extractions will not function properly as temperatures vary.

     A loss of temperature control may lead to an accidental release due to
material failure.  Structural or sealing materials lose physical strength as
the temperatures increases.  At an elevated temperature, a  construction
material may stretch, bend or crack under load conditions that were acceptable
at lower temperatures.  Metals experience fatigue if subjected to repeated
heating and cooling.  This can lead to eventual failure under previously
                                      86

-------
acceptable conditions.  Plastic linings used to protect metals from corrosion
may fail at excessive temperatures.  Expansion joints are often more sensitive
to high temperatures than other process piping and may fail if temperatures
are elevated above design specifications.  Extremely cold temperatures may
result in brittle failure of metals, especially if the metal is subjected to
high stress under these conditions.  Rapid changes in temperature can also be
destructive.

     A hazard in heat transfer equipment is the possibility of accidental
mixing of a heat transfer fluid with a process fluid.  Heating and cooling are
usually accomplished via heat exchangers or various forms of jacketed equip-
ment.  A leak may develop in a vessel or pipe wall that allows the jacket
fluid to enter the vessel, or vice versa, depending on which pressure is
higher.  A special danger arises when the process side is at a higher pressure
than the jacket side.  The process side of a jacket of a vessel frequently has
a pressure rating higher than the jacket.  A leak could cause high pressure
process material to rupture the jacket or exit through the jacket's relief
valve.  If the jacket is at a higher pressure than the process, then the heat
transfer fluid will contaminate the process, which could result in an
accidental release if the heat transfer material is incompatible with the
process materials.

     Flashing may occur when a hot liquid with a high boiling point is mixed
with a lower boiling point liquid.  This flashing may result in a rapid
overpressure.  The accidental mixing of a heat transfer fluid with a process
fluid, as was discussed above, may sometimes be the cause of such an event.   A
number of accidents have occurred when a hot oil is transferred to a tank that
has been steam cleaned and not thoroughly cleared of condensation.   The
condensate has flashed and resulted in an overpressure.

      Process temperature control is closely related to flow control.   Reac-
tion rates and the heat generated by a reaction is often governed by flow
                                      87

-------
control.   The rate of heat transfer depends  on the  flow rate  of  a  heating or
cooling medium.   Therefore, a loss of a flow control  can often result  in a
loss of temperature control.

Process Considerations—
     A process-related loss of temperature measurement  and control occurs when
the temperature  measurement and control systems are functioning  according to
design standards but the heat generated by the process  exceeds the capacity of
the cooling system.

     Chemical reactions either generate or require  heat.  Anything in  a
chemical reaction system that alters the rate of reaction alters the rate of
heat generation  and/or consumption and affects the  ability to control
temperature.  As an example, loss of flow control of  a  reactant  to an
exothermic reaction may result in the generation of excess heat.  If the heat
generation rate  exceeds the ability of the temperature  control system  to
remove it, the result is a loss of temperature control.

     Failure to  achieve proper mixing may result in a loss of temperature
measurement and  control.  Improper mixing of reactants  may result in localized
hot spots.  In a jacketed process vessel, for example,  if there  is poor mixing
then there will  be very poor heat transfer between  the jacket and the  reactor
contents.  Temperature measuring probes will not measure a representative bulk
temperature when there is inadequate mixing.

Equipment Considerations—
     A failure of flow control may cause a failure  of temperature control.  As
mentioned above, in most cases, temperature  control is achieved  through
control of the flow of either the process materials or of a heat transfer
fluid.  In some cases heating is accomplished by direct heating  with gas. oil,
or electric heating elements.  These are often used to heat a hot oil, steam,
or some other heating fluid; thus flow control is still the ultimate method
for heat transfer and temperature control.
                                      88

-------
     As discussed above, a leak in the wall that divides process materials
from heat transfer fluids will sometimes result in an accidental release.
This is particularly a problem because these surfaces have fluid on each side
and are therefore difficult to inspect for signs of erosion, corrosion,  or
defect.

     Since not every form of mechanical failure can be prevented, insufficient
design preparation to minimize the impact of mechanical failure can also be
listed as a factor contributing to loss of temperature measurement and con-
trol.

Operating Considerations—
     A temperature control system will only be as accurate as the standard to
which the measuring devices are calibrated; therefore, improper calibration or
maintenance of the system can contribute to failure in the control system.

     A lack of chemical and thermodynamic data will contribute to the poten-
tial for a loss of temperature control.  To design a proper control system,
plant engineers should have a sufficient understanding of the consequences of
temperature excursions.  Operators should have training sufficient to respond
to deviations in normal operating conditions.  Often plant personnel do not
know what side reactions could occur at various temperatures and do not have
enough information to quantify the temperature dependence of all the reaction
rates.  This detailed information is often lost with the transfer of
information between research and development, or it was never obtained in the
rush to commercialize a new process.  A total understanding of a complex
chemical process may not be possible, but a lack of chemical and thermodynamic
data will always leave plant management in the position of viewing temperature
control as a mystery.
                                      89

-------
2.5.2  Technology of Temperature Control

     The first line of prevention of an accidental  release  as  a  result  of a
loss of temperature control is the temperature measurement  and control  system.
Process modifications must consider the capacity  and reliability of these
systems.  The second line of prevention is a temperature trip  system designed
to regain control of the process once temperature control has  been lost.   The
ability to design a system that will adequately control temperature will
depend on the chemical and thennodynamic data available; adequate data  will
potentially lead to better design.

Measurement and Control—
     Temperature measurement relies on both sensing and final  measurement
devices.  Control relies on the corrective actions  that a system takes  in
response to changes in temperature.  A variety of temperature  sensors and
measuring devices are available.  Each variety has  some unique feature  in the
mechanism it uses to sense and measure temperature.  Temperature measuring
devices organize the output of the temperature sensing device  and/or convert
the output to a meaningful temperature readout.

     Several commonly used temperature sensing devices are  discussed below.
Additional discussions on a wide variety of temperature sensing  devices may be
found in numerous sources (e.g., Reference 39).  Common varieties of tempera-
ture sensing devices used in the process industries include:  thermal expansion
devices, thermocouples, thermistors, resistance thermometers,  and a variety of
solid state sensors.

     One group of temperature sensing devices rely on thermal  expansion of
materials, usually metals.  The thermal expansion of these  devices is often
linear with temperature, making an additional temperature measuring device
unnecessary.  Additionally, the output from these devices is  visual and they
are generally not used for remote sensing.  Bimetallic thermometers, filled
thermal elements, and glass stem thermometers are types of  temperature  sensing
                                      90

-------
devices that rely on thermal expansion to measure temperature.  These devices
are common in older plants or in situations where a rugged local backup to an
electronic temperature sensing device is desirable.

     A thermocouple is a simple temperature device composed of two homogeneous
wires of dissimilar metallic composition joined at one end to form a measuring
junction and at the other end to a measuring device.  The measuring device
provides an internal connection between the two wires so that they form a
closed path through which current may flow.  When heat is applied to the
junction of the two dissimilar metals, a small electromotive force (emf) is
generated and current flows through the thermocouple loop.  In commercially
available thermocouples the emf is linearly proportional to the temperature at
the measuring junction.  Thermocouples are rugged and inexpensive.  They are
best suited for applications where moderate accuracy over a wide temperature
range is required and are very common in the chemical process industry.

     Thermistors are a form of solid-state sensor that use a ceramic semicon-
ductor which measures the change in the resistance of the semiconductor as
temperature varies.   The resistance is nonlinear and must be converted to a
linear temperature scale by a temperature measuring device.  Thermistors are
usually best-suited  for applications where accuracy and rapid response are
required over a narrow temperature range;  they tend not to be as well-suited
for measuring temperatures over a wide range.

     A resistance thermometer is a device that uses the change in resistance
and temperature of a conductor to measure temperature.  These devices have
conductors made of platinum,  nickel, or a nickel/iron mix.  They are accurate
and are available over a fairly wide temperature range.  They are physically
compact and are well-suited for use in microprocessor-based products.

     A variety of solid state sensors are available that measure temperature
induced changes in resistance,  frequency,  current,  or voltage.   Optical
                                      91

-------
sensors are available for measuring the temperature of a flame from a dis-
tance.

     The devices mentioned above have certain applications to which they are
well-suited.  It is best to consult with the vendors of each of these devices
to determine the particular applicability of a specific sensor.  The key to
making an appropriate selection is to understand what process conditions may
contribute to a'n accidental release and what sensor would be best suited to
measure those conditions.  Some processes must operate in a very narrow
temperature range and therefore require a sensor with high sensitivity and
accuracy over a narrow range.  A process may require a narrow operating range
for producing the desired product but will be hazardous only if it operates
well above or below that range.  In such a case it may be appropriate to
install two sensors; one with a narrow range for controlling normal operations
and one with a wide range for monitoring upset conditions.  For some processes
a loss of temperature control will develop slowly.  In such situations re-
sponse time may not be as important as accuracy.  For other processes a loss
of temperature control will develop rapidly, and in these situations a rapid
response time may be more important than accuracy.

Temperature Trip and Emergency Cooling Systems—
     A temperature trip system is essentially the same as a pressure trip
system.  This type of control system monitors temperature and is activated
when temperature has exceeded a specified limit or a specified rate of in-
crease.  When activated, the system responds in an attempt to shut the process
down by eliminating the source of heat and often by providing a source of
cooling.  Usually the goal is to prevent an overpressure.  Any decision about
whether temperature or pressure measurement should be used as the basis for
the trip system should be based on which would provide the most immediate and
accurate indication of an impending system failure.  Once activated, a trip
system will usually disrupt the process, forcing at least a partial, temporary
shutdown.  The system should be designed to trip only when necessary.  An
                                       92

-------
intimate understanding of the chemistry and thermodynamics of the process is
essential for proper design of this type of system.

     A trip system may be designed to shut off the supply of heat or it may be
designed to supply an emergency supply of cooling.  Emergency cooling may be
accomplished by a number of methods.  External cooling may be supplied by
flooding a heat exchanger or vessel jacket with cooling water.  Internal cool-
ing may be supplied by adding chilled solvent to the reaction melt.  The sol-
vent would not only cool the reaction but the extra dilution could slow the
reaction rate.  A somewhat drastic measure would be to intentionally poison
the reaction by adding a material that is known to effectively stop its
progress.  The more drastic measure of automatically dumping the contents of a
reactor into a diked, open area or into a supplementary containment vessel has
been applied in some cases; however, dumping into an open diked area may not
be appropriate where toxic or flammable materials are involved.

     If a temperature trip system is designed to replace a pressure relief
device, then the reliability of the trip system must be ten times that of the
pressure relief device for the same application.  Calculation of this reli-
ability should be based on the calculated fractional dead time (the proportion
of the time for which a system will be in the failed state).  This method
considers both the fault-rate for the individual components and the frequency
of proof testing.  If a temperature trip system is designed to supplement an
emergency relief device,  then the designed reliability must be based on the
consequences of a loss of temperature control.   In a situation where the
overpressure may be so rapid as to constitute an explosion, or where a loss of
temperature control is likely to lead to an accidental release, it is probably
appropriate to design the system to have a reliability again equal to ten
times that of the emergency relief device.

Jacketed Vessels and Heat Exchangers—
     Temperature control  is usually achieved via a heat transfer fluid circu-
lating through a vessel jacket or a heat exchanger.   Such equipment requires
some special considerations if temperature control is to be maintained.
                                      93

-------
     All vessel jackets and heat  exchangers  must  have  adequate  pressure  re-
lief.  Most heat exchangers and vessel  jackets  are  designed with  valves  on  the
inlet and outlet lines.  An overpressure could  occur if  a warm  material  is
added to a vessel whose jacket is closed at  the inlet  and outlet.   The warm
material would heat the contents  of the jacket  and  result in  a  buildup of
pressure.  A similar event could  occur  with  a heat  exchanger  if either the
shell or the tubes were valved off and  warm  material were circulated  through
the other side of the exchanger.   All vessel jackets and heat exchangers must
be inspected regularly to prevent a leak between  the heat transfer fluid and
the reaction mixture.

     General design principles for jacketed  systems are  found in  many sources.
ASME has design codes for jacketed equipment and  heat  exchangers.   As men-
tioned above, it is important that all  jacketed vessels  be  supplied with
adequate pressure relief.  Additional general design information  is discussed
in Section A of this document.

Obtaining Chemical and Thermodynamic Data—
     As mentioned above, the more chemical and  thermodynamic  data available,
the safer the design of the temperature control system.  Where  hazardous
materials are involved, a safe system must be based on as much  data as possi-
ble.

     Most plants cannot generate  chemical reaction  rate  and  thermodynamic
data.  This type of information and data on  potential  side  reactions  must
usually be obtained from a research and development laboratory.  However,  a
number of methods are available for estimating  the  chemical  hazards of a
system without extensive laboratory work.

     Thermodynamic calculations or computer  programs used  to estimate thermo-
dynamic data may be used to calculate  the potential energy  available  in  a
                                       94

-------
given molecule or system.  This information can be combined with correlations
to evaluate potential hazards.

     A number of empirical tests using reaction mixtures provide data that
will assist in the design of a safe temperature control system (these tests
also give information that can help in the design of all of the reaction
related control systems).  Differential scanning calorimetry, accelerating
rate calorimetry, differential thermal analysis, heat flow calorimetry, and a
test method developed by DIERS will all provide information useful in the
design of a temperature control system.

2.5.3  Control Effectiveness

Measurement and Control—
     Table 2-15 lists a variety of temperature-sensing and measurement devices
and certain performance information.  In addition to a temperature range, each
device will have a variety of other performance limitations, including items
such as acceptable sensitivity, reproducibility, materials of construction,
and reliability.  Care must be taken when selecting an appropriate temperature
sensing device.  Substituting an existing temperature measuring device with a
device more suited for the particular application may increase the system's
reliability and hence decrease the potential for an accidental release.

     One author has summarized a number of considerations that apply to
thermocouple application (AO).  Thermocouples come in at least two grades
related to error specifications of the American National Standards Institute
(ANSI)  and the Instrument Society of America (ISA).   Thermocouples may change
calibration over time depending on the temperature and operating  environment.
Often overlooked is that the accuracy with which a thermocouple measures the
temperature of a process fluid depends on its size,  shape and location.  For
                                      95

-------
    TABLE 2-15.  TEMPERATURE SENSOR SELECTION GUIDE FOR NON-SEVERE SERVICE
                 UNDER 932°F
  Sensor Type
         Point
       Readings
          Average
         Readings
Filled Element
Thermistor

Thermocouple
Resistance Bulb
Fair to good
Fair to excellent for
some applications
Fair to good
Fair to excellent
Fair
Fair to excellent for
some applications
Fair for some applications
Fair to excellent
Source:  Adapted from Reference 19.

example, a thermocouple that is too small for an application or improperly
located may measure a local rather than a bulk temperature.  This is espec-
ially relevant in certain equipment where poor mixing or bypassing might
occur.  Leads that are too long can lead to inaccuracies, as can electrical
interference.  The main point is that temperature control effectiveness
depends on accurate sensor information, which depends in turn on proper appli-
cation and installation.

     There may be no external indication that a temperature sensing device is
giving an incorrect reading.  Some devices, such as thermocouples, require
periodic calibration.  The readout from some temperature-sensing devices, such
as thermistors, may drift as the device ages.  Mechanical devices may stick at
some incorrect temperature.  In situations where an incorrect temperature
reading would significantly contribute to the potential for an accidental
release it may be advisable to use two different varieties of temperature
sensing equipment.
                                      96

-------
     Programming the software for a typical temperature control system is
often based more on empirical data than on a theoretical understanding of the
process.  This is because of the complexity involved in a system where a heat
transfer fluid (which itself must be heated) is used to heat the wall of a
process vessel which then heats a reaction melt where a heat producing or
absorbing reaction is occurring.  An empirical approach is adequate for
handling normal operating conditions but may be inadequate for handling the
abnormal event.  Where hazardous materials are involved, it is therefore
important to obtain as much chemical and thermodynamic data as possible and to
prepare for the unexpected with temperature or pressure trip systems and
adequate pressure relief.

Temperature Trip and Emergency Cooling Systems—
     A temperature trip and emergency cooling system may be necessary where a
toxic material is involved and where there are fairly well-defined temperature
boundaries beyond which the system will be out of control.  If no such
temperature boundaries exist, or if the boundaries are not well defined, it
may be preferable to operate the system with a pressure—activated trip system.

     Careful consideration must be given to the consequences of an emergency
cooling system.  By its nature, an emergency cooling system will tend to
temporarily shut down a portion of the process.  The possibility of liquid
reaction melts freezing, vapors condensing, or upstream materials accumulating
must be considered to be certain that the emergency cooling system does not
introduce new hazards.  In addition, the thermal stress could have a drastic
temperature change as a result of emergency cooling on the construction
materials must be considered.  A design evaluation such as a HAZOP study will
help determine the safety of an emergency cooling system.

Jacketed Vessels and Heat Exchangers—
     Some of the potential limitations of jacketed equipment and heat ex-
changers have been discussed above.   There are some additional considerations
                                      97

-------
specific to vessel jackets.  One additional hazard is the possibility that a
loss of temperature control would result from a jacket relief valve that
relieves and does not reseat properly.  Enough heat transfer fluid could
escape to prevent adequate temperature control of the vessel.  Another concern
is that there be adequate flow and mixing of the jacket fluid to avoid
temperature stratification.  The location of entry and exit nozzles on the
jacket may influence this.  In spite of these limitations, controlling
temperature via jacketed vessels and heat exchangers is usually preferable
because of the ability to provide controlled, uniform heating.

Obtaining Chemical and Thermodynamic Data—
     The test methods mentioned previously for use in designing a temperature
control system will provide information about what temperature ranges are
inappropriate for the system of interest.  They will also give an idea about
the magnitude of the disturbance that may result if these temperatures are
exceeded.  Interpretation of the test results must be made by a person with
experience in the area because the test results are qualitative as well as
quantitative and no guarantee exists that what happens in the test will happen
in the plant.  Tests, however, are better than no information at all.

Reliability of Temperature Control Components—
     The reliability of temperature control depends on the reliability of the
individual components that comprise the temperature control system.  The
reliability of a full multicomponent control system also depends on the
architecture of the specific system.  Table 2-16 presents reliability data for
some individual components.  Another factor affecting the reliability of
temperature control, which is not as significant in the control of other
variables discussed, is the relatively long response time of physical systems
and of temperature devices to temperature changes.  For critical applications,
high reliability requires that delays in detecting and acting on changes in
temperature under emergency conditions have been properly accounted for.
                                      98

-------
     TABLE 2-16.  TYPICAL FAILURE RATES OF TEMPERATURE CONTROL COMPONENTS
               Component
        Failure Rate
       (Failures/Year)
Sensor With Thermowell

  Thermocouple (TC)

  Resistance Temperature Detector (RTD)

Temperature Transducer

Temperature Controller

Control Valve

Control Loop

Cooling Water Capacity



Refrigerated Brine Capacity
            0.52

            0.41

            0.88

          0.29-0.38

          0.25-0.60

            1.73

System reliability depends on
specific design and reliability of
individual components.

System reliability depends on
specific design and reliability of
individual components.
Source:  Adapted from References 2, 8. 19, and 37.
                                      99

-------
2.5.A  Summary of Control Technologies

     Table 2-17 summarizes major hazards or hazard categories associated with
temperature, and the corresponding control technology for both new and
existing facilities.  Based on the preceding discussions of this section,
numerous individual control technologies or procedural changes can be inferred
for each category.

2.5.5  Costs

     The costs of components for, temperature measurement and control process
modifications are presented in Table 2-18.  These component types and costs
are based on a typical installation.  The costs presented provide an
order-of-magnitude basis for evaluating the economic impacts of process
modifications involving temperture measurement and temperature measurement and
control systems.

2.5.6  Case Examples (42)

     The explosion of a batch chlorinator caused the deaths of eight employees
and extensive damage.  The reaction temperature, which was controlled
automatically by manipulating the chlorine flow, fell sharply when the
thermocouple failed.  Personnel stopped the agitator and shut off the brine
cooling while the instrument was repaired, but delay in stopping the chlorine
flow led to a high temperature and decomposition reactions.  The explosion
blew the reactor cover through the roof, drove the reactor into the floor, and
ruptured chlorine and ammonia lines.  The released flammable gases burned and
caused the eight casualties.

     In another example of loss of temperature control, localized overheating
caused the failure of a refinery reactor operating at 17,225 kPa (2500 psi),
which released a large cloud of about 250,000 Ib of >C   hydrocarbons and H
that ignited and caused widespread explosions and fires.  Four people were
                                      100

-------
          TABLE 2-17.  MAJOR HAZARD AND CONTROL TECHNOLOGY SUMMARIES
Process
Variable
 Hazard
  New Facility
  Existing Facility
Temperature
• Runaway
  reaction
               • Thermal
                 expansion
                 Property
                 changes
• Reactant feed
  control system

• Emergency trip to
  shut down reactant
  feeds

• Emergency cooling
  systems

• Emergency dump
  systems
                  Design to avoid
                  blocked—in liquid-
                  full piping and
                  equipment

                  Emergency trip to
                  shut down heating
                  systems

                  Emergency cooling
                  systems

                  Insulation for
                  protection from
                  external sources of
                  heat

                  Temperature control
                  system design

                  Temperature control
                  system design
• Change reactant feed
  control systen

• Add emergency trip
  to shut down
  reactant feeds

• Add emergency
  cooling system

• Add emergency dump
  system

• Change process
  chemistry

• Change design to
  avoid blocked-in
  liquid-full piping
  and equipment.

• Add emergency trip
  to shut down heating
  systems

• Add emergency
  cooling capacity

• Insulate to protect
  from external
  sources of heat
                           Change temperature
                           control system
                           design

                           Change process
                           chemistry
                                                               (Continued)
                                      101

-------
                            TABLE 2-17  (Continued)
Process
Variable
Hazard
New Facility
Existing Facility
               • Equipment
                 or material
                 failure due
                 to excess
                 or defi-
                 cient temp-
                 eratures
               • Temperature control
                 system design

               • Equipment selection

               • Materials of
                 construction

               • emergency heating
                 system

               • Emergency cooling
                 system
                       • Change temperature
                         control system

                       • Change process
                         chemistry

                       • Change equipment
                         type

                       • Change materials of
                         construction

                       • Add emergency
                         heating system

                       • Add emergency
                         cooling system

                       • Change process
                         chemistry
                                      102

-------
                     TABLE 2-18.   COSTS OF COMPONENTS ASSOCIATED WITH PROCESS MODIFICATIONS FOR
                                  TEMPERATURE MEASUREMENT AND CONTROL SYSTEMS
        Basis:   4 inch diameter piping
                 Temperature range 0-250 degree F,
                                               Capital Cost
                                                 Range ($)
 Annual Cost
Range ($/yr)
                                                              (1986 Dollars)
References
o
03
Sensor/with Thermowell
   Thermocouple
   Resistance Temperature Detector (RTD)
   Thermistor
   Integrated Circuit (I.C)  Sensor

Transmitter and Indicator

Temperature switch

Controllers
   Simple, single loop. PID
   Simple, interactive. PID
   Programmable.PID

Control Valve

Control Loop
   Conventional
   Via process control computer

Additional Cooling Water Capacity
(10 degree approach. 30 degree range)
        Refrigerated Brine Capacity _
        (20 degree F evaporator)
                                                         200 - 300
                                                        990 - 1.680

                                                         160 - 710
                                                        800 - 1.600
                                                       1.600 - 3.000
                                                       2.000 - 6.000

                                                       3.000 - 6.000
                                                      6.000 - 12.000
                                                      3.000 - 15.000

                                                          30 - 75
                                                          per gpm
                                                        of capacity
   30 - 45
  69 - 138
  138 - 260
  173 - 519

  450 - 900
 910 - 1.800
 260 - 1.298

4.55 - 11.36
   per gpm
 of capacity
                                               3.000 - 8.000  450 - 1.200
                                                per ton of      per ton of
                                                 capacity        capacity
40
  150 - 250     40

  24 - 108      40
26.27.28.33
4.20.23.25
Composite
20
                20

-------
injured and property loss was great.   Overpressures were highly directional.

2.6  QUANTITY CONTROL

     The two primary objectives of quantity measurement and control are to
achieve proper process material ratios and the proper level and/or weight of
materials in process or storage vessels.   Failure to perform either of these
functions .could result in the overfilling or overpressuring of process
equipment, which could lead to an accidental release.

2.6.1  Quantity Measurement and Control Hazards

     Hazards associated with a failure of the two functions stated above are
discussed below.

Process Material Ratios—
     Failure to maintain process material ratios can have both chemical and
physical consequences.  For most chemical reaction systems, there are two
types of reactants: limiting reactants and non-limiting reactants.  Often the
controlled flowrate of the non-limiting feed stream will be ratioed to the
flowrate of the limiting feedstream.   In  this situation, one feed stream
controls the flowrates of all other feed  streams, and a failure to measure or
control the quantity of this stream may result in losing control of the
quantities of all of the other process streams.  Depending on the chemical
reaction involved, such a loss in control could result in an overpressure
caused by excess heat or material generation.  For the non-limiting constitu-
ents, deviation from an acceptable quantity range may also lead to overheating
or overpressure.

Level Control—
     A failure to monitor and control the level in a process vessel or a
storage tank may result in the overpressure of a closed vessel or in the
overflow of a vented vessel.
                                      104

-------
     Process problems include disturbances that lead to a change in the
chemical or physical properties of a system, resulting in a loss of quantity
measurement and control.  Altering the physical properties of a process stream
may affect quantity measurement.  For flowing streams, a quantity measuring
device will often be calibrated for a stream of a certain composition; a
change in that composition will often alter the accuracy of a flow meter.  For
many types of quantity sensing and measuring equipment, the presence of solids
or foams may alter the accuracy of the system.

     Quantity deviations or loss of control may be caused by some other
control malfunction.  For example, a system failure such as a loss of temper-
ature control results in an acceleration in the rate of reaction, then the
excess reaction rate may exceed the ability of the quantity control system to
respond in reducing a reactant feed and result in an overpressure.  As with
all sensing and control equipment, a number of equipment-related malfunctions
may result in a loss of quantity control.  Improper application, poor design,
defective equipment, fatigue failure or corrosion may all result in a failure
to measure and control process quantities.  Quantity control is often a flow
control problem; therefore, reliable quantity control depends on reliable flow
control.  A quantity control system may act as a backup to a flow control
system to shut down flow when quantities are too high.  Flow control conside-
rations and their role in process hazards are discussed in Section 2.3 of this
document.

     Since a quantity determination and control system will only be as
accurate as the standard to which the measuring device has been calibrated,
improper calibration or maintenance can result in a failure in the control
system.  Some types of quantity determination systems, such as weighing
devices, are sensitive to conditions exceeding their range,  to physical abuse,
ambient conditions, and other factors.   Good operating practices and operating
                                      105

-------
personnel who understand the limitations of the device are important to
ensuring reliable service from the equipment.

2.6.2  Technology of Quantity Control

     Quantity measurement and control devices  can be divided into several
categories according to their function:

     o    Flow meters,  either mass or volume;

     o    Weighing devices such as load cells; and

     o    Level measuring devices.

     Controlling quantity with weighing devices and level measuring devices is
usually accomplished via a trip system and/or  alarm.  A trip system will often
be used to stop the feed of material once a certain weight or level of mate-
rial is reached.  If a level indicator is used in process equipment such as a
distillation column, then a trip system may be used to alter a heating rate
when a high level in a reboiler is reached. An alarm may be used in conjunc-
tion with a trip, or by itself with the quantity detection devices.  Operating
personnel must then decide what response to the alarm is appropriate.  This
type of arrangement will work only where the hazard potential associated with
an overfill is low or where no appropriate controlled response to an overfill
can be determined.

Flow Meters—
     Probably more varieties of flow measuring devices are available than any
other type of process sensing instrumentation.  One author has assembled a
list of well over 50 different flow-meter types (43).  Flow measurement and
control are discussed as a separate topic in Section 2.3 of this document.
                                      106

-------
 Weighing  Systems—
     Weighing  devices  are  usually used  in batch operations.  Weighing, a
 method  of measuring and  regulating  the  amounts of materials charged to a
 reactor,  is preferred  in situations where the feed material is difficult to
 handle.   Solids,  slurries, and extremely viscous materials are examples of
 materials that may better  be quantified by weighing than by measuring flow.

     Both mechanical and electrical weighing devices are available.  Mechani-
 cal weighing systems are more common than electrical and include platform
 scales, hopper scales, tank scales and  tank truck scales.  Mechanical scales
 can be  extremely  accurate  and are generally simple to maintain and operate.

     Electrical weighing devices are often referred to as load cells.  These
 devices have the  advantage of being small and easy to install.  Load cells
 give quick response, are not subject to the same type of wear as a mechanical
 scale,  and provide a signal for a readout at a remote location.

     It is important to  design a weighing system so that the damaging effect
 of various environmental factors will be minimized.  Methods for isolating the
 weighing  device from vibration by strengthening support foundations or by
 providing vibration absorption should be considered.  The design must also
 ensure  that the system is unaffected by connecting pipe stresses.  In some
 instances it may be necessary to add temperature compensation.  Weighing
 devices should be housed to ensure adequate drainage and protection from
 moisture  or chemical contamination.

     Regular inspection  and maintenance of weighing devices is essential.
 Mechanical devices in particular must be readjusted and serviced frequently to
 ensure accurate results.

     Depending on the consequences of inaccurate weighing,  a backup to the
weighing system may be desirable.   A level measuring device may be a suitable
backup for a weighing device.
                                      107

-------
Level Measurement—
     Level measuring devices have a number of different uses.   A level
measuring device may be designed to sound an alarm or activate a switch only
if the level passes above or below some fixed point,  or it  may be used to give
a continuous level readout accurate enough to precisely track  inventories.
Devices may be designed to give a local indication of process  vessel levels or
to send a signal to a flow controller.   Thus, level detection  may be used
either as a backup for other control systems or as a  primary control device.
Some devices must actually contact the  liquid to sense level while some can
measure level without contacting the liquid.  Some detectors function mecha-
nically and some function electronically.

      Probably the most common variety  of level measuring device is the flat
glass gauge.  This device is composed of a shielded external loop, portions of
which are made of glass.  The liquid level is then observed in the glass
portions of the loop.  Some of these devices can send a signal to another
location.  Their advantage is that they provide a visual means of measuring
the level in a vessel.  They are often  used as a backup for a  more sophisti-
cated variety of level measuring device.  Other mechanical  level detection
devices, such as floats and displacers, are also available.

     A common variety of level measuring device is the differential pressure
level detector, which measures level by detecting the pressure difference
between two different points in a tank.  Electronic devices such as
capacitance, ultrasonic, optical, and radiation level detectors are also
available.

     Generally, level devices must be inserted into process vessels and
involve additional piping or fittings.   Since fittings are  a potential weak
point for a process vessel, they must be designed to withstand the same
conditions that the vessel is designed  to withstand.   Some  applicability
criteria for selected level detector devices are shown in Table 2-19.
                                     108

-------
               TABLE 2-19.   LIQUID LEVEL DETECTOR  SELECTION GUIDE
Trananitter
Level Detector Type
Float
Level Gauge
Capacitance Probe
Conductivity Probe
Diaphragm
Differential Pressure
Displacement
Radiation
Ultrasonic
Tape
Local
Indicator
Fair
Fair-Good
Poor-Fair
N/A
Poor-Fair
Fair-Good
Fair-Good
Good
Fair-Good
Good-Excellent
Clean
Fluid
Poor-Fair
N/A
Fair
N/A
Poor
Good
Excellent
Good
Fair
Good
Difficult
Fluid
Poor
N/A
Poor-Fair
N/A
Poor
Fair
Poor-Fair
Excellent
Good
Poor-Fair
Switch
Clean
Fluid
Good
N/A
Good
Fair
Fair
Good
Excellent
Good
Good
Good
Foaming
Fluid
N/A
N/A
Poor-Fair
Poor
N/A
N/A
N/A
N/A
Poor-Fair
N/A
Source:  Adapted fron Reference 19.
                                       109

-------
2.6.3  Control Effectiveness

     The effectiveness of various approaches to maintaining quantity control
is evaluated in terms of performance,  limitations,  and reliability.

Flow Measurement and Control—
     The effectiveness and secondary hazards associated with flow measurement
and control are discussed in Section 2.3.

Weighing Systems—
     When functioning properly,  weighing devices are an effective means of
monitoring the quantity of material added to a process vessel;  however, all
weighing devices are sensitive to a variety of environmental factors that may
impair their performance.

     Vibration and other related mechanical disturbances (such as impact
damage when a load is dumped onto a weighing device) can seriously affect
performance.  Accuracy, stability, and repeatability can all be affected by
mechanical disturbances.

     Temperature will affect the accuracy of most weighing devices.  Most
mechanical scales have built-in temperature compensation; however, most
mechanical devices will not weigh accurately if subjected to a rapid tempera-
ture change.  Electrical devices are also sensitive to temperature changes.
Sometimes temperature compensation will be built into an electrical device,
and sometimes it will be necessary to add temperature compensation.  If
several load cells are used to weigh the contents of a reactor, any nonuni-
formity in the temperatures of the load cells is likely to result in a weigh-
ing error.

     Additional environmental factors, such as moisture and chemical conta-
mination, can damage a weighing device.
                                      110

-------
Level Measurement—
     Level measurement is sometimes used directly to control the flowrates of
streams into and out of a process vessel.  In some situations this may be a
simpler method for controlling flows than direct flowrate measurement and
control.  In most process situations, however, vessel feed streams are not
controlled by level detection, since the failure of a level detector to
control feed flowrates could easily result in an overfill, an overpressure
and, potentially, in an accidental release.  Level detection devices are
well-suited to be a backup to flow control by activating high or low level
trip systems or alarms.  Where level detection is used as the primary control
device for process flows (this is often the case for filling and emptying
storage tanks and sometimes for charging to batch reactors), then two diffe-
rent types of level detection devices should be used in series.

     The operation of some varieties of level detection equipment makes them
fairly product specific..  These types of devices should be avoided where
stream compositions may vary.  Many level detection devices cannot accurately
measure the level of foamy solutions.

     Installation requirements for level detection equipment will influence
the suitability of a particular device for hazardous chemical service.  Flat
glass gauges that stick out from the vessel must be protected from being
sheared off during a collision.   Flat glass gauges are also often the first
point of failure during the overpressure of a pressure vessel.   Some devices
require two points of entry into a vessel,  one of which is low in the tank and
below normal liquid levels.  This increases the possibility of leaks.  Some
require that a probe be inserted below the liquid level.   Care must be taken
to ensure that the construction materials of such a probe are compatible with
the process conditions.  Additionally, care must be taken to ensure that the
additional obstruction of a probe is acceptable.  Some probes can operate from
the top of a vessel without contacting the liquid.  These may be preferred in
many instances;  however,  constructions materials are still important in
                                     111

-------
devices that operate above the liquid level.  The vapor phase in a process
vessel is often more corrosive than the liquid phase.

Reliability of Quantity Control Components—
     The reliability of quantity control depends on the reliability of the
individual components that comprise the quantity control system.  The reli-
ability of a full multicomponent control system also depends on the architec-
ture of the specific system.  Table 2-20 presents reliability data for some
individual components expressed as typical failure rates.

2.6.4  Summary of Control Technologies

     Table 2-21 summarizes major hazards or hazard categories associated with
quantity control, and the corresponding control technology or procedural cate-
gories for both new and existing facilities.  Numerous individual control
technologies or procedural changes can be inferred for each category.

2.6.5  Costs

     The costs of components found in quantity measurement and control systems
are presented in Table 2-22.  These component types and costs are based on a
typical installation.  Since there are other types of systems, and many
variations of systems within a given type,  these costs only provide an
order-of-magnitude basis for evaluating the economic effects of quantity
measurement and control system process modifications.

2.6.6  Case Examples (42)

     In one example of a loss of quantity control, overfilling of a salt dome
storage well created a cloud of butane 1.25 mi.  in diameter.  Two explosions
occurred,  one 800-1000 ft. above grade.   Twenty four people were injured.
                                      112

-------
       TABLE 2-20.  TYPICAL FAILURE RATES OF QUANTITY CONTROL COMPONENTS

                                                     Failure Rate
                    Component                       (Failures/year)
         Load Cell Weigh System                          3.75

         Level Detection System

           Differential Pressure Transducer              1.71

           Float System                                  1.64

           Capacitance System                            0.22

           Electrical Conductivity Probes                2.36

         Flow Totalizer                               ca. 1.0



Source:  Adapted from Reference 2, 8,  19. and 37.
                                      113

-------
            TABLE 2-21.  MAJOR QUANTITY RELATED HAZARDS AND CONTROL TECHNOLOGY SUMMARIES

Process
Variable                Hazard                       New Facility                Existing Facility


Quantity           • Incorrect reactant          • Flow control design         • Change flow control
                     ratio, catalyst                                             system
                     level, or inerts            • Equipment selection
                     concentration                                             • Change type of
                                                 • Level sensing and             equipment
                   • Incorrect level               alarms
                     leading to                                                • Change or add level
                     overfilling or              • Weight sensing and            sensing and alarms
                     underfilling                  alarms
                                                                               • Change or add
                   • Incorrect volume or         • Emergency trip                weight sensing and
                     mass of material              system to shut down           alarms
                     leading to                    flow
                     overfilling or                                            • Change or
                     underfilling                                                add emergency trip
                                                                                 system to shut down
                                                                                 flow

-------
TABLE 2-22.  COSTS OF COMPONENTS RELATED TO PROCESS MODIFICATIONS FOR QUANTITY
             MEASUREMENT AND CONTROL SYSTEMS  (EXCLUDING FLOW RATE MEASUREMENT.
             SEE SECTION 2.3)


Basis:  Load cell weigh system:  10,000 gallon batch reactor.
        Level system:  10,000 gallon vessel.
        Flow totalizer:  33 gpm and 667 gpm.

                               Capital Cost      Annual Cost
   Component                    Range ($)        Range ($/yr)       References
                                       (1986 dollars)


Load cell weigh system            13,800            2,100               41

Level detection system -

     Sight gage                    1,100               77               41
     Float system                  1,400              210               41
     Capacitance system            2,400              365               41
     Ultrasonic system             2.600            1,150               41
     Nuclear system               14,900            2,260               41
Flow totalizer
     33  gpm                        N/A              N/A
     667 gpm                        N/A              N/A
                                      115

-------
     Another accident occurred in an ethylene producing plant in Holland,
where failure of a level controller on a column caused cold liquid to pass out
of the relief valve and into a carbon steel flare header,  which cracked.   The
released cloud of 12,000 Ib. of propylene ignited at a furnace 150 ft. away.
Fourteen were killed, 104 injured and property damage was  valued at almost A3
million dollars.

2.7  MIXING

     Many processes can safely operate under a wide range  of mixing rates. If
there is an upper limit for a safe mixing rate, then it is likely to be set by
foaming problems or some similar characteristic.   Some processes must operate
in a very specific mixing regime.  Formulating processes often fall into this
category.  Usually there is a minimum mixing requirement below which reactants
are not properly contacted or heat transfer is not sufficient and uniform.

     There are three basic types of mixing systems:

     •    Direct mechanical mixing;

     •    Induced flow mixing; and

     •    Static mixing.

     Direct mechanical mixing refers to mixing by blade agitators such as
turbines or propellers.  Induced flow mixing is accomplished with pumps or
other devices, especially where a recirculating liquid stream back to a vessel
is involved.  Induced flow mixing can also involve ejectors and eductors.
Static mixing involves using pipeline mixers that contain  stationary mixing
hardware elements inserted in the piping.
                                      116

-------
2.7.1  Mixing System Hazards

     One group of authors has defined three basic categories of mixing
problems (44).

     •    Loss of agitation;

     •    Insufficient mixing; and

     •    Excess energy input from mechanical friction.

     A loss of agitation is usually the primary hazard in mixing systems.
Hazards associated with a loss of mixing include:

     •    Incomplete reactions or formation of unwanted by-products;

     •    Reactant accumulation in poorly mixed zones; and

     •    Poor heat transfer with overall overheating or overcooling
          of a reaction or localized hot or cold spots.

     The hazards of incomplete reactions or the formation of unwanted
by-products is related to the chemical and physical properties of the
unreacted materials or by-products.  When there is insufficient mixing to
contact reactants, a potentially dangerous excess of unreacted material can
accumulate in the reaction vessel.  With highly reactive materials, or in
exothermic reactions, such a mixture could react at an uncontrolled rate if
agitation began or if additional heat were added to the system.  Even without
this hazard, the unintended excess of a toxic reactant in downstream
processing might cause problems.  Failure to react & gaseous material because
of insufficient agitation might lead directly to overpressure.  Unwanted
byproducts could include gaseous species leading to excess pressures, or
corrosive materials that could damage equipment.
                                      117

-------
     A loss of mixing control can cause poor heat transfer that results in
localized hot and cold spots.  Runaway reaction and/or overheating and
overpressure could result.  Decomposition reactions might also occur with heat
sensitive materials.  Hazards from overcooling include freezeups, solids
deposition, and heat transfer surface fouling, with all their attendant
process upsets, such as plugged lines, and accumulation of unreacted material.
An accidental release could occur if adequate protection were not available to
handle such an event.  The hazards associated with a loss of temperature or
pressure control are discussed in Subsections 2.3 and 2.4 of this manual.

     A potential hazard associated with too much mixing is overheating as a
resulting from the energy generated by mechanical friction.  A well-insulated
vessel left agitated for long periods of time may experience a temperature
rise from mixing friction.  Such a temperature rise could begin the chain of
events that leads to an accidental release.  For example, the additional heat
input could start a decomposition reaction which could lead to gas evolution
and overpressure.

     A hazard associated with mixing is the generation of a static charge
between the process stream and the process vessel.  This is a particular
problem where process vessels and piping are coated with glass or plastic
materials that act as electrical insulators.  Static charge can arc and result
in fire and explosion if a flammable atmosphere is present.

     Any event that leads to a dramatic change in the physical characteristics
of the process materials being mixed may result in a decrease or loss of
mixing.  For example, a loss of heating resulting in frozen process materials
would result in a loss of agitation.  An increase in liquid viscosity could be
caused by a decrease in temperature or by other unexpected conditions (e.g.,
improper reactant ratios).  The viscosity of some liquids can increase with
increased temperature, which is particularly hazardous if the increase in
temperature leads to an increase in reaction rate and impaired mixing.

     The hazard potential associated with freezing or viscosity changes is
most severe where high speed, high shear mixing is involved.
                                      118

-------
     Probably the most frequent cause of a loss of mixing control is some type
of mechanical failure, which includes:

     •    Electric motor failure (either power outage or mechanical
          failure);
                                                !

     •    Shaft seizure or breakage in the mixing equipment; and

     •    Breakage or detachment of a mixing impeller.

     A variety of mechanical agitation devices are available.  The possible
failure modes of these devices depends on the specific type of equipment
involved.  Most systems involve rotating equipment subject to common failures
such as bearing failure, shear pin failure, belt slippage or breakage, elec-
trical malfunction, and others.  Corrosion or wear may also cause a failure in
the portion of the agitator system that actually contacts the process fluid.
Agitators tend to experience more severe erosion and corrosion than do process
vessels.  Induced flow agitation systems may be subject to more potential
failure modes than a mechanical agitation system.   An induced flow system may
fail because of a pump failure, valve failure, or piping failure.

     Static mixers do not have rotating or moving components and are therefore
not directly subject to all of the failure modes associated with mechanical
agitators; however,  a static mixer requires sufficient flow to induce adequate
mixing.  Therefore,  a reduced flow through the static mixer may result in
insufficient mixing.  As with mechanical mixing systems, the static mixer is
subject to corrosion or erosion from the process fluid.

     Where mechanical agitation is involved in a batch process, it is possible
for operators to forget to begin agitation at the proper time.   Beginning
agitation after materials have been charged may result in a runaway reaction,
overpressure, and in an accidental release.
                                      119

-------
2.7.2  Technology of Mixing Control

     Before an adequate mixing system can be designed it is important to
determine what the effect of various mixing rates,  including no mixing, may
have on the process.  One author has suggested that the effect of mixing on a
chemical reaction system may be assessed using a heat flow calorimeter, which
is capable of measuring instantaneous heat generation rates, heats of reac-
tion, reactant heat accumulation, specific heats,  and heat transfer data under
simulated industrial process conditions (44).

     Once the effect of mixing on a chemical process is understood, the
effects of a mixing failure can be evaluated.  It  is then possible to design a
system that minimizes the adverse effects of such a failure.  If a mixing
failure is potentially hazardous, it may be appropriate to provide an agita-
tion detection system that is tied into flow and/or temperature control
systems so that protective measures may be taken if agitation stops.  An
example would be to stop or reduce the flows of reactor feeds when agitation
ceases.  An agitation detection system does not necessarily have to directly
measure agitation; it may be more appropriate to place a temperature probe or
flow meter at a location that would be sensitive to changes occurring as a
result of a loss of agitation.  Where mechanical agitation is involved it is
possible to monitor the mechanical equipment as an indicator of agitation.

     As discussed above, in some situations it will be hazardous for an
operator to begin a reaction addition sequence without agitation.  For these
situations it may be appropriate to provide an interlock that prevents the
addition of a reactant when agitation is not present.

     Proper maintenance of a mixing system is important.  Mechanical agitators
are used for batch or semibatch reactors of moderate size.  They are appro-
priate when thorough and continuous mixing of the  bulk liquid is required.  An
induced flow system may be used in conjunction with or independent of mecha-
nical agitation.  When applied by itself, an induced flow system is used when
                                      120

-------
less agitation is required.  A storage tank is often mixed using an induced
flow mixing system.  An induced flow system is also used when it is desirable
to inject a reactant into a flowing stream before it is blended with the bulk
solution.  With this type of system there will be high shear and good mixing
at the point of injection without going to the expense of more thorough
agitation of the entire bulk solution.  For all but small vessels, an induced
flow system would be less expensive than a mechanical agitation system.  An
in-line static mixer is used in continuous processes where short duration
mixing is satisfactory.

2.7.3  Control Effectiveness

     People with experience in the area must determine the potential hazards
associated with a loss of mixing control.  The data obtained from a device
such as a heat flow calorimeter may not be scaled up for a full-size process
without interpretation or pilot plant experimentation.

     When selecting an indirect method for agitation detection,  it is
important to evaluate whether the device selected will reliably  detect a
problem with agitation for all potential failure modes.

     Mechanical agitation is generally very effective in providing good bulk
mixing.  Because mechanical agitation involves a large rotating  piece of
equipment, it is possible that a severe failure in the agitator  will result in
additional equipment damage.  Agitators may become off balance,  a situation
that tends to become more severe as the device continues to rotate, and may
destroy other portions of the system.   If jammed, an agitator may shear and
puncture a vessel.   Most  agitators have shear pins designed to prevent exces-
sive torque on the  agitator; however,  with a shear pin an agitator system
could stop at an inappropriate time because of excessive liquid  viscosity and
premature shear pin failure.
                                      121

-------
     While providing a high rate of local mixing to the material in the
pump-around loop, an induced-flow mixing system will usually provide less
mixing to the bulk liquid than will a mechanical mixing system.   This type of
mixing system requires additional piping and therefore creates  additional
potential for a piping leak.  It is possible to run the mixing  loop pump with
a valve closed or with a line plugged and be unaware that no mixing is
occurring.

     An in-line mixing device is generally physically smaller and less expen-
sive than an agitator-type mixing system.  Such a device is  appropriate where
single pass, short duration mixing is acceptable and where heat  transfer
performance is satisfactory and where gas or vapor evolution are not of
concern.  The extent of mixing for these devices depends on  the  length of the
mixing section, the design of the internals and the flow rate through the
section.  Higher flow rates create a higher shear and better mixing, but they
also require more energy input to overcome pressure drop.

     Since mixing involves high shear,  a mixing device is often  more prone to
corrosion and erosion than are other equipment  components of a process system.

     The reliability of mixing system depends on the reliability of individual
components that comprise the system.  The reliability of a full  multicomponent
control system also depends on the specific equipment and detailed design of
the system.  Table 2-23 shows reliability data,  expressed as typical failure
rates, for some individual components.

2.7.4  Smnmary of Control Technologies

     Table 2-24 summarizes, from the point of view of both new and existing
facilities, major hazards or hazard categories  associated with mixing control,
and the corresponding control technology.  Numerous individual control
technologies or procedural changes can  be inferred for each  category.
                                      122

-------
        TABLE 2-23.   TYPICAL FAILURE RATES OF MIXING SYSTEM COMPONENTS

                                                     Failure Rate
                     Components                    (Failures/year)


    Mechanical Agitator (agitator motor only)

           - "Normal" Service                           0.088
           - "Severe" Service                           8.8

    Induced Flow Pump System (pump and motor only)

           - "Normal" Service                           0.26
           - "Severe" Service                           8.8
                                                          a
    Static Mixer                                        	

    Flow Switch                                         1.12

    Pressure Switch                                     0.34

    Tachometer                                          0.044
  ot Available

Source:  Adapted from References 8, 19, 37.
                                      123

-------
             TABLE 2-24.  MAJOR MIXING-RELATED HAZARDS AND CONTROL TECHNOLOGY SUMMARIES

Process                                              Control Technology or Procedural Category
Variable               Hazard                    New Facility                  Existing Facility


Mixing             • Loss of cooling             • Mixing detection            • Add mixing
                                                                                 detection
                   • Reactant                    • Backup power supply
                     accumulation                                              « Add backup power
                                                 • Materials of                  supply
                   • Loss of heating               construction
                                                                               • Change materials of
                                                 • Equipment selection           construction

                                                                               • Change type of
                                                                                 mixing system

-------
2.7.5  Costs

     Table 2-25 presents costs for components related to mixing system process
modifications.  These component types and costs are based on a typical
installation.  Since there are other types of systems and many variations of
systems within a given type, these costs provide an order-of-magnitude basis
for evaluating the economic effects of possible process modifications involv-
ing mixing systems.

2.7.6  Case Example (1)

     In one instance of a loss of mixing control, the agitator stopped in a
batch nitration reactor, but the process operator was unaware of this since
instrumentation that would have stopped the acid feed to the reactor and given
an alarm signal of agitator stoppage failed to work.  When the agitator
started up again, the reactor exploded.

2.8  COMPOSITION CONTROL

     Varying a stream's composition affects its chemical and physical proper-
ties.  Stream composition must usually fall within a fairly narrow range if a
process system is to operate within design specifications.  Proper design and
operation of composition control systems may be important in preventing
accidental releases.

2.8.1  Hazards Associated With the Loss of Composition Control

     As a stream's composition varies from the design specifications, its
chemical and physical properties also vary.  The consequences are
process-specific and may range from a lower quality product to an explosion
and massive chemical release.
                                      125

-------
  TABLE 2-25.  COSTS OF COMPONENTS ASSOCIATED WITH PROCESS MODIFICATIONS FOR
               MIXING SYSTEMS

Basis:  Mixing vessel volume:  10,000 gallon
        Agitator power:  2 hp/1.000 gallons (20 hp)
        Mixing rate:  10,000 gallons/15 minutes (667 gpm)
        Static mixer diameter:  50 inches (200 gpm)
        Induce flow pump:  667 gpm, 50 psig

                               Capital Cost      Annual Cost
        Component               Range ($)        Range ($/yr)       References
                                       (1986 Dollars)
Mechanical agitator (turbine),
single impeller, impeller
speed to 45 rpm) carbon
steel
316 stainless steel
Induced flow pump system
Static mixer
Flow switch
Pressure switch



31,600
50,600
8,300
N/A
530
530



4.800
11.800
1.250
N/A
80
80



20
20
20
N/A
22
38
                                      126

-------
     Physical properties such as vapor pressures and boiling and freezing
temperatures will vary as composition varies.  Some possible consequences
include an overpressure caused by increased vapor pressure or a ruptured line
caused by frozen process materials.

     The chemical properties of a process stream will vary as the composition
varies.  Potential reactions and their corresponding rates will be affected by
variations in the composition that could result in a variety of consequences.
An altered composition could lead to a much more rapid reaction rate than
desired, which could result in an overpressure, which could result in unwanted
side reactions, or in an altered composition that could stop the desired
reaction completely.

     Primary composition considerations involve reaction rates.  Chemical
reaction rates are usually highly temperature dependent and are sometimes
pressure dependent.  For a system where chemical reactions are involved,
anything that affects pressures or temperatures may affect stream
compositions.  Additionally, any alternate event (such as catalyst decay) that
alters the nature of the chemical processes involved will affect stream
composition.

     Any number of mechanical or electrical malfunctions could alter stream
compositions.  A loss of flow control resulting from equipment malfunction may
lead to a loss of composition control.  No flow, too much flow or reverse flow
of feed streams will all affect the composition of the process unit into which
they feed.  Contamination of the stream via the rupture of a heat exchanger
tube is another example of a mechanical failure resulting in a loss of stream
composition control.

     The instruments used to monitor composition are often sensitive, and in
some cases, prone to failure when exposed to adverse conditions.  For some
varieties there is a time lag from when the sample is taken until the results
are known.  In this situation it will be difficult to determine the actual
                                      127

-------
composition at any given time if the composition is changing rapidly.  The
consequences of this time delay will depend on the nature of the reaction
system involved.

     A potential shortcoming of many composition monitors is that they often
have a fairly specific range of materials that they can detect.   An ideal
detector would be able to monitor the products and reactant  in a given reac-
tion and all of the unwanted by-products and contaminants.   Not  selecting the
best detector for the given application is another potential cause of  loss of
composition control.

     Operational considerations also influence composition control. A lack of
proper maintenance and training will contribute to a loss of composition
determination and control.  Composition determination systems require  regular
maintenance to function properly.  Since most systems will monitor only a few
components in the system, an operator must be trained to interpret what may
actually be happening to the entire system.

2.8.2  Technology of Composition Control

     A composition analyzer is an excellent device for monitoring the  overall
condition of the process, but it is rarely used directly to control a  single
variable such as flow because many process variables may affect  composition,
and rarely can composition be entirely controlled by one variable.  An excep-
tion might be controlling pH by metering an alkaline or acid solution  into a
process stream.  In most cases, a composition analyzer is usually used to warn
operators when the composition of a process stream has deviated  from normal
conditions.

     Composition analysis may be achieved by manually taking samples from a
process stream and analyzing them in the laboratory or by installing an
automatic on-line analyzer.  An industrial equivalent exists for most  common
instruments used in laboratory analysis.  Laboratory analysis of a process
                                      128

-------
sample is usually much slower than on-line analysis, though it may be more
accurate than on-line analysis.  Where a process involves hazardous materials,
some type of on-line composition analysis that provides an early warning of
significant deviations may be desirable for critical streams.

     Composition analysis equipment may be divided into two broad categories:
devices that analyze for chemical species in stream, and devices that measure
a chemical or physical property of the stream.  Devices for measuring the
chemical and physical properties of a stream are typically used where the cost
of individual chemical species determination is excessive, or where the
information obtained from a chemical or physical property measurement is
adequate.

     Common instruments used for on-line chemical species analysis include
oxygen and moisture analyzers, chromatographs, ultraviolet analyzers, flame
ionization analyzers, mass spectrometers, and infrared analyzers.  Common
chemical and physical properties measured on line include density, molecular
weight, pH, viscosity, and oxidation-reduction potential.  Some of these
devices take a continuous reading from an in-line probe, some take continuous
readings from a slip stream, while others automatically withdraw samples
periodically.

     The output from composition analyzers varies according to the type and
sophistication of the instrument.  Many of the physical and chemical property
probes generate a signal that may be read directly from a scaled meter.  These
devices usually require periodic calibration.   Most analyzers generate some
type of graphical spectrum.  The presence of various chemical species is then
interpreted either by the operator or by the computer software available with
some modern systems.

     Two important considerations in the design of a composition analyzer
systems are:  1)  the location of the sensing device, and 2) the composition
data required.  These considerations might be addressed by a formal evaluation
                                      129

-------
of the process using a hazard and operability study or some similar method
that would help identify which stream compositions are most important from the
perspective of safety and which stream conpositions best indicate the status
of the process.

     Once the location and chemical species to be monitored have been
selected, the analyzer is selected.  It may be impossible or prohibitively
expensive to monitor all the species desired.  In such cases, the potential
hazard associated with a change in composition and the amount of useful
information that may be obtained from monitoring the composition must be
weighed against the expense.

2.8.3  Control Effectiveness

     Composition deviations indicate that something is potentially wrong with
the process and provide information for diagnosing the problem's source.
However, an incorrect result on a composition analyzer may cause a process
problem to be missed and a good reading from a composition analyzer is no
guarantee that everything is in order.

      The information obtained from all varieties of composition instrumenta-
tion is limited.  There are no perfect analyzers, and it is likely that no
single analyzer is available to monitor every potential species within a given
process stream.  Since cost and complexity prevent every process stream from
being monitored, it is important to carefully choose which streams should be
monitored and which type of composition analyzer will give the most meaningful
cost-effective information.  As with all instrumentation systems accuracy,
precision, sensitivity, and tolerance to overrange are important
considerations in analyzer selection.

     Interpreting the results from a composition analyzer is not necessarily
straightforward.  The problem with interpretation is two-fold: 1) the output
from the device may be misread or misunderstood or 2) a correct instrument
                                      130

-------
 reading may be made and a wrong conclusion drawn.  Instruments that provide a
 graphical trace are most easily misread or misunderstood.  In chemical analy-
 ses impurities may be obscured by the signal of other species, the chemical
 character of a compound may make it invisible to the detector or it may
 respond more intensely than other compounds and appear to be present in a much
 highar concentration than it actually is.  Any number of process deviations
 that may result in composition deviations, and correct interpretation of a
 composition analysis does not mean that a correct assessment of the state of
 the process will be made.

     The maintenance requirements of a composition analyzer depend on the
 device.  The sensing element in most devices must be cleaned and usually
 recalibrated regularly.

     The reliability of composition control depends on the reliability of the
 individual components that comprise the composition control system.  The
 reliability of a multicomponent system also depends on the architecture of the
 specific system.  Table 2-26 presents reliability data expressed as typical
 failure rates for some individual components.

 2.8.4  Summary of Control Technologies

     Table 2-27 summarizes,  from the point of view of both new and existing
 facilities,  major hazards or hazard categories associated with composition and
 corresponding control technology.    Numerous individual  control  technologies
 or procedural changes can be inferred for each category.

 2.8.5  Costs

     Costs of components  related to composition measurement and  control  system
process modifications are presented in Table 2-28.   These component types  and
costs are based on typical  installations.   Since there are other  types  of
systems,  and many  variations of systems  within a given type,  these  costs
                                     131

-------
      TABLE  2-26.   TYPICAL  FAILURE  RATES  OF  COMPOSITION SYSTEM COMPONENTS

                                                       Failure Rate
                     Component                        (Failures/Year)
         Composition  Determination  Equipment

           Density  Sensor
           - indicator                                    	
           - transmitter                                  	

           pH Meter                                       5.88

           Viscosity  Sensor
           - indicator
                                                          —a
           - transmitter                                  	

         Chemical  Species Analyzers

           Chromatograph                                 30.6

           Infrared Analyzer                              l.AO

           Oxygen  Analyzer                              2.5-5.65

           Moisture Analyzer (gases)                       8.0

           Conductivity Sensor                         14.2-16.7
 rtot available

Source:   Adapted from References 1,  8,  19, and 37.
                                      132

-------
                   TABLE 2-27.  MAJOR COMPOSITION-RELATED HAZARDS AND CONTROL TECHNOLOGY SUMMARIES
        Process
        Variable
     Hazard
   Control Technology or Procedural Category
New Facility                 Existing Facility
        Composition
• Excess or deficient
  reactant

• Excess or deficient
  catalyst

• Excess corrodant
  Initial design and
  selection of
  composition
  analysis system
• Change type of
  composition
  analysis

• Add composition
  analysis to process
  stream
u>
u>
                            • Excess toxic
                              material in wrong
                              stream

-------
TABLE 2-28.  COSTS OF COMPONENTS ASSOCIATED WITH PROCESS MODIFICATIONS
             FOR COMPOSITION DETERMINATION AND CONTROL
Capital Cost Annual Cost
Range ($) Range ($/Yr)
(1986 Dollars)
Composition Determination
Equipment
Density Sensor
- indicator
- transmitter
Molecular Weight Sensor
pH Detector
Viscosity Sensor
- indicator
- transmitter
Chemical Species Analyzers
Chromatograph
Infrared Analyzer
Refractometer
Oxygen Analyzer
Moisture Analyzer
Spectrometer
Conductivity Sensor

500-1,500
1.500-5.000
5.000-10.000
A. 000-5. 000
2,000-5.000
5.000-12.000

10,000-40.000
3,000-10,000
4.000-10,000
3,000-8.000
4.000-15.000
10,000-40.000
700-2,000

92-275
275-917
917-8,834
734-917
367-917
917-2,200

1.834-7.340
550-1.834
734-1.834
550-1.467
734-2,751
1.834-7.340
129-367
References

20,41
20,41
20,41
20,41
20,41
20,41

20,41
20,41
20.41
20.41
20,41
20,41
20.41
                                  134

-------
provide an order—of-magnitude basis for evaluating the economic effects of
possible process modifications involving composition measurement and control
systems.

2.8.6  Case Example (42)

     A day tank containing 6500 gallons of ethylene oxide became contaminated
with ammonia.  The tank ruptured, dispersing ethylene oxide into the
atmosphere, where the cloud ignited and created an explosive force equal to
18 tons of TNT.  One person was killed, nine were injured and property loss
was valued at approximately 16 million dollars.
                                      135

-------
2.9  REFERENCES

1.   Lees,  F.P.  Loss Prevention in the Process  Industries,  Volume 1 and 2.
     Butterworths,  London,  England, 1983.

2.   Hix, A.H.   Safety and  Instrumentation Systems.   Loss Prevention, Volume
     6.  American Institute of Chemical Engineers, New York, NY,  1972.

3.   Considine, D.M. (ed.).  Process Instruments and Controls Handbook,
     McGraw-Hill Book Company, New York, N.Y.,  1985.

4.   Shinsky, F.G.   Process Control Systems.   McGraw-Hill Book Company, New
     York.  NY,  1979.

5.   Green, D.W. (ed.).  Perry's Chemical Engineers' Handbook, (Sixth
     Edition).   McGraw-Hill Book Company,  New York,  NY, 198A.

6.   Control Engineering.  Any issue.  Technical Publishing, Inc., Barrington,
     Illinois.

7.   Cost indices obtained  from Chemical Engineering.  McGraw-Hill Publishing
     Company, New York, NY.  November 1972, June 1974, December 1985, and
     August 1986.

8.   U.S  Nuclear Regulatory Commission.  Reactor Safety Study.  National
     Technical Information  Service, WASH-1400 (NUREG 75/014), October 1975.

9.   Process Safety Management.  Chemical Manufacturer's Association.
     Washington, D.C., May  1985.

10.  Guidelines for Hazard  Evaluation Procedures. The Center for Chemical
     Plant Safety.   American Institute of Chemical Engineers, 1985.

11.  Kletz, T.A.  Make Plants Inherently Safe.  Hydrocarbon Processing.
     September 1985.

12.  Hazard Survey of the Chemical and Allied Industries.  American Insurance
     Association.  Engineering and Safety Service, AIA, New York, NY, 1979.

13.  Groggins, P.H.  (ed.).   Unit Processes in Organic Synthesis,  Fourth
     Edition.  McGraw-Hill Book Company. New York. NY. 1952.

14.  Herrick, E.G., J.A.King, R.P. Ouellette and P.N. Cheremisinoff.  Unit
     Process Guide to Organic Chemical Industries.  Ann Arbor Publishers, Ann
     Arbor. MI. 1979.

15.  Courty. P.H..  J.P. Artie, A. Converse. P. Mikitinko, and A.  Sugier.
     C.-C, Alcohols From Syngas.  Hydrocarbon Processing.  November 1984.  pp.
     105fS.
                                      136

-------
16.  Kreniers, J.  Avoid Water Hammer.  Hydrocarbon Processing.  March 1983.

17.  Rasmussen, E.J.  Alarm and Shutdown Devices Protect Process Equipment,
     Chemical Engineering. May 12, 1975.

18.  Rase, H.F.  Piping Design for Process Plants.  John Wiley and Sons, Inc.,
     New York. NY, 1963.

19.  Liptak, B,G. and V. Christa (ed.).  Instrument Engineers' Handbook,
     Revised Edition.  Chilton Book Company, Radnor, PA, 1982.

20.  Peters, M.S. and K.D.  Timmerhaus Plant Design and Economics for Chemical
     Engineers, Third Edition.  McGraw-Hill Book Company, New York, NY, 1980.

21.  Liptak, B.C.  Costs of Process Instruments.  Chemical Engineering.
     September 7. 1970.

22.  Flow Measurement Handbook.  Omega Engineering Corporation.  1985.

23.  The Richardsen Rapid Construction Cost Estimating System, Volumes 1-4.
     Richardsen Engineering Services, Incorporated, San Marcos, CA, 1986.

24.  Floar, P.C.  Programmable Controllers Directory, First Edition.
     Technical Data Base Corporation, ConroeL Texas, 1985.

25.  Telephone conversations between J.D. Quass of Radian Corporation and  a
     representative Of Foxboro Corporation.  Corpus Christi, Texas, 1986.

26.  Telephone conversation between J.D. Quass of Radian Corporation and a
     representative of Fisher Controls.  Stafford, TX. 1986.

27.  Liptak, B.C.  Safety Instruments and Control Value Costs.  Chemical
     Engineering.  November 2, 1970.

28.  Fauske, Haus K.  Emergency Relief System Design.  Chemical Engineering
     Progress.  August, 1985.

29.  Recommended Practice for the Design and Installation of Pressure
     Relieving Systems in Refineries:  Part I - Design; Part II -
     Installation.  American Petroleum Institute.  API RP 520, 1977.

30.  Guide for Explosion Venting.  National Fire Protection Association.  Vol.
     68. 1978.

31.  American Society of Mechanical Engineers.  Code for Pressure Piping B31.
     Chemical Plant and Petroleum Refinery Piping.  New York, NY.

32.  Scully. William A.  Safety-Relief-Valve Manfunctions:  Symptoms, Causes
     and Cures.  Chemical Engineering.  August 10, 1981.
                                      137

-------
33.  Papa,  D.M.   How Back Pressure Affects  Safety Relief Valve.   Hydrocarbon
     Processing.   May 1983.

34   Bradford,  Mike and David G Durrett.  Avoiding Common Mistakes in Sizing
     Distillation Safety Valves.  Chemical  Engineering.   July 9,  198A.

35.  Fitt,  J.S.   The Process Engineering  of Pressure Relief and  Slowdown
     Systems, Loss Prevention and Safety  Promotion in the Process Industries.
     First  International Loss Prevention  Symposium,  Amsterdam, Holland.   1974.

36.  Lawley, Herbert G. and  Trevor A.  Kletz.  High-Pressure-Trip Systems -for
     Vessel Protection.  Chemical Engineering.  May 12,  1975.

37.  Anyakora,  S.N.  G.F.M.  Engel, and F.P. Lees.  Some  Data on  the
     Reliability of Instruments in the Chemical  Plant Environment.  The
     Chemical Engineer.  Number 255,  1971.

38.  Pressure and Strain Measurement  Handbook and Encyclopedia.   Omega
     Engineering Corporation, 1985.

39.  Temperature Measurement Handbook and Encyclopedia.   Omega Engineering
     Corporation, 1985.

40.  Bartosiak,  G.  Guide to Thermocouples.  Instruments and Control Systems.
     November,  197.8.

41.  Liptak, B.G.  Costs of  Viscosity, Weight, and Analytical Instruments.
     Chemical Engineering.  September 21, 1970.

42.  Davenport,  J.A.  A Survey of Vapor Cloud Incidents.  Loss Prevention.
     American Institute of Chemical Engineers.  Volume 17, September 1977.

43.  Weir,  E.D,  G.W. Gravenstine, and T.F.  Hoppe.  Thermal Runaways:  Problems
     with Agitation.  Plant/Operations Progress.  July 1986.

44.  Wilmot, D.A., and A.P.  Leong. Another Way to Detect Agitation.  Loss
     Prevention.   American Institute  of Chemical Engineers.  Volume II,  New
     York,  NY.  1977.
                                      138

-------
                                   SECTION 3
                     PHYSICAL PLANT DESIGN CONSIDERATIONS

     The preceding section of this manual  addressed process  design  considera-
tions associated with basic process variables, the chemistry of a process, and
process control.  This section addresses the  physical  plant  design  and hard-
ware of a process facility.  Process and physical plant design taken together,
whether of a new  facility  or of  the modification  of an existing  facility, are
the basis for preventing accidental chemical  releases.   In the words of  one
author:  "The safety  of  the  plant is  determined primarily by the quality of
the basic design rather than the  addition  of  special  safety  features.   It is
difficult to overemphasize this  point"  (1) .   Safety features  are part of  that
basic design, but in some facilities there may have been oversights  in design
and construction that warrant the addition of safety  features to an existing
facility.

     Physical plant design considerations  address  the specific hazards caused
by hardware failure,  the proper design and construction of equipment to reduce
those hazards, and the siting and layout of the equipment within the process
facility.  Specific hardware-related prevention measures can be identified to
reduce the probability of accidental chemical releases.

     General and  detailed  principles  for  the design of chemical  process
facilities comprise a vast technical  literature.   It  is  not  within  the  scope
erf this manual to review all  aspects of  design, nor the intent of this manual
to be used for design.  The reader  is referred to other technical  literature
for these purposes.  It is the purpose  here  to highlight significant general
considerations related to accidental release prevention.

     Since the fundamental  purpose of  the physical plant and its equipment is
to contain the chemicals under normal process  operating  conditions  and within
                                      139

-------
limited ranges  of  deviation, sound  design practices that  are thoroughly
understood and faithfully followed are essential to prevent releases.  Design
principles related  specifically to release prevention can be grouped into four
broad categories:

     •    Standards, codes,  recommended practices,  and guidelines;

     •    Siting and layout;

     •    Miscellaneous considerations; and

     •    Equipment.

     Each of these  categories  is  discussed in the subsections  that follow.
Some important potential hazards and their control,  related to the equipment
and its layout in a process  facility, are examined.

3.1  STANDARDS. CODES, AND RECOMMENDED PRACTICES

     Equipment used in a process facility must be selected  to  function under
the specified  process  conditions  and under upset conditions; it must  ensure
containment of the  chemicals  being processed and must be resistant  to fire and
explosion.  To help  industry meet  these requirements, numerous codes, stan-
dards of practice,  recommended practices,  and  guidelines (referred to here-
after as standard design criteria) exist  for categories  and specific kinds  of
equipment.   Different organizations developed standard  design  criteria  over
the years in response  to knowledge gained  from actual accidents or  in  antici-
pation of operating and safety  problems based on technical analysis.   Many  of
the standard design  criteria were developed to  meet  the needs of  property
insurer's and worker health  and safety concerns.  It  is beyond the scope of
this manual  to even present  a detailed summary  of all  the standard design
criteria applicable in the chemical  process  induscries.   Table 3-1, however,
lists some major organizations  involved in developing such standard design
                                      140

-------
criteria.  Table  3-2 summarizes some  of  the areas applicable  to chemical
process facilities (2).

     Two major equipment categories addressed by codes are vessels and piping.
Table 3-3 shows the  design  and  physical  components of vessels covered by the
American Society  of  Mechanical  Engineer's (ASME) code for  pressure vessels
(3) .  This is  shown  as an  example  of  how much detail must be  addressed by
fabricators and constructors of process  equipment  and facilities.  This code
has been adopted  as  a legal standard in many areas.   For  piping,  an important
code was developed by the American  Petroleum Institute (API); it applies  to
petroleum refineries  and petrochemical plants,  and may be applicable to other
chemical process facilities as well (A).   Many individual companies have their
own standard design  criteria,  especially major corporations  in the chemical
process industries.  Design criteria must always be carefully scrutinized when
toxic chemicals are  involved, especially  in  new situations, because the such
criteria have often  been developed  for known sets of  conditions,  and it  is
possible that adherence to  a standard  criterion such  as a code  without  a full
appreciation of its  basis or limitations  could lead to unforeseen  secondary
hazards.

     In the  context  of accidental  release  prevention, any standard  design
criteria, even codes, should be viewed as a  minimum basis or starting  point
for equipment and  plant  design.  Many specific  situations  may  suggest  more
stringent specifications than the standard design  criteria  require.  This  if
often an overlooked  aspect  of code  and standards compliance that  can lead to
problems.

3.2  SITING AND LAYOUT CONSIDERATIONS

     Siting and layout considerations  are an important aspect of accidental
release prevention.   Siting refers  to  the location of the  process facility
within a community, while layout refers to the positioning of equipment within
the process facility.
                                      141

-------
    TABLE 3-1.   SOME OF THE MAJOR ORGANIZATIONS PROVIDING CODES. STANDARDS.
                RECOMMENDED PRACTICES. AND GUIDELINES FOR EQUIPMENT FOR
                CHEMICAL AND ALLIED INDUSTRY PROCESS PLANTS

                                                                 Abbreviation
          Name                                                      Symbol
Technical and Trade Groups
  American Water Works Association
  Air Conditioning & Refrigeration Institute
  Air Moving and Conditioning Association
  American Association of Railroads
  American Gas Association
  American Petroleum Institute
  Chlorine Institute
  Compressed Gas Association
  Cooling Tower Institute
  Chemical Manufacture's Association
  Manufacturers Standardization Society
  National Electrical Manufacturers Association
  Pipe Fabrication Institute
  Scientific Apparatus Makers Association
  Society of Plastics Industry
  Steel Structures Painting Council
  Tubular Exchanger Manufacturers Association

U.S. Government Agencies
  Bureau of Mines
  Department of Transportation
    U.S. Coast Guard
    Hazardous Materials Regulation Board
    Federal Aviation Administration
  Environmental Protection Agency
  National Bureau of Standards
  Occupational Safety and Health Administration

Testing Standards and Safety Groups
  American National Standards Institute
  American Society for Testing and Materials
  National Fire Protection Association
  Underwriters Laboratories, Inc.
  National Safety Council

Insuring Associations
  American Insurance Association
  Factory Insurance Association
  Factory Mutual System
  Oil  Insurance Association
AWWA
ARI
AMCA
AAR
AGA
API
CI
CGA
CTI
CMA
MSS
NEMA
PFI
SAMA
SPI
SSPC
TEMA
BM
DOT
SCG
HMRB
FAA
EPA
NBS
OSHA
ANSI
ASTM
NFPA
UL
NSC
AIA
FIA
FM
OIA
                                                                (Continued)
                                       142

-------
                             TABLE 3-1 (Continued)
                                                                 Abbreviation
          Name                                                      Symbol
Professional Societies
  American Conference of Governmental Industrial                       ACGIH
    Hygienists
  American Industrial Hygiene Association                              AIHA
  American Institute of Chemical Engineers                             AIChE
  American Society of Mechanical Engineers                             ASME
  Amer. Soc. of Htg.. Refrig. & Air-Cond. Engs.                        ASHRAE
  Illumination Engineers Society                                       IES
  Institute of Electrical and Electronic Engineers                     IEEE
  Instrument Society of America                                        ISA
Source:  Adapted from Reference 2.
                                    143

-------
    TABLE 3-2.  SOME OF THE AREAS COVERED BY CODES, STANDARDS. GUIDELINES.
                AND RECOMMENDED PRACTICES OF DESIGNATED ORGANIZATIONS
                (SEE TABLE 3-1 FOR SYMBOLS DEFINITIONS)

Accident Case History - NFPA. NSC. AIA. FIA. FM. OIA, AIChE. AGA, API.  CMA.
USCG. OSHA

Plant & Equipment Layout - NFPA, NSC. AIA. FIA. FM. OIA. AWWA, AAR, API.  CGA,
CMA. USCG. HMRB

Electrical Area Classification - ANSI. NFPA. NSC, AIA, FIA, FM, OIA. API.  CMA.
USCG. OSHA

Electrical Control and Enclosures - ANSI. NFPA, UL, NSC, AIA, FIA, FM.  OIA.
IEEE, ISA. ARI. MCA, NEMA. USCG, OSHA

Grounding and Static Electrical - ANSI, NFPA, UL, NSC, AIA, FIA, FM, OIA,
IEEE, API. NEMA, USCG, OSHA

Power Wiring - ANSI, NFPA, UL, FIA, FM, OIA, IEEE, API. NEMA, USCG, OSHA

Lighting - ANSI, NFPA, UL. NSC. FM. IEEE. IES. NEMA. USCG

Emergency Electrical Systems - NFPA, AIA, FM, IEEE, AGA. NEMA. USCG

Instrumentation - ANSI. ASTM. NFPA, UL, AIA, FIA, FM, OIA.  IEEE, ISA, AWWA,
ARI, API, CGA, SAMA, USCG, HMRB, NBS

Shutdown Systems - NFPA, UL, AIA. FIA, OIA, API, USCG

Pressure Relief Equipment Systems - NFPA, AIA, FIA, FM, OIA, ASME, API, CI,
CGA, USCG, HMRB, OSHA

Venting Requirements - NFPA, FIA, FM. API. USCG, HMRB

Product Storage and Handling - ANSI, NFPA, AIA. FIA. FM. OIA. AIChE, AAR,  API.
CI, CGA, MCA. USCG. OSHA

Piping Materials and Systems - ANSI, ASTM. NFPA, UL, NSC, AIA, FIA. FM. NBS
ASHRAE. IES. AWWA. ARI. AGA. API. CI. CGA. MSS. NFPA, PFI.  SPI. USCG. HMRB,

Materials of Construction - ASTM, ANSI. NFPA, UL, NSC, AIA, FM. OIA,  ISA.
AWWA. CI, CGA, CTI, MCA, TEMA, USCG, HMRB, NBS

Insulation and Fireproofing - ANSI, ASTM, UL, AIA. FM, OIA, ASHRAE, USCG

Painting and Coating - ANSI, ASTM. UL. AIChE, AWWA, SSPC, HMRB. NBS,  OSHA

Ventilation - ANSI, NFPA. UL, NSC. FIA. FM. ACGIH. AIHA, BM, USCG

                                                                   (continued)
                                      144

-------
                              TABLE  3-2  (continued)
Dust Hazards - ANSI, NFPA. UL.  NSC,  FIA,  EM,  ACGIH,  AIHA,  BM,  USCG

Noise and Vibration - ANSI,  ASTM,  NFPA, UL,  NSC,  AIHA,  AIChE.  ASHRAE, ISA.
ARI, AMCA, AGA, API, NFPA, EPA,  OSHA

Lubrication - ANSI, NFPA, ASME.  AMCA

Fire Protection Equipment -  ANSI,  NFPA, UL,  NSC,  AIA,  FIA, OIA, AWWA, API,
CGA, CMA, NEMA, BM, USCG, OSHA

Safety Equipment - ANSI, UL,  NSC,  FM,  ACGIH,  AIHA,  CI,  CGA, MCA, BM, USCG,
OSHA

Pumps - ANSI, UL, OIA, AIChE, AWWA,  HI NFPA.  USCG

Fire Pumps - ANSI. NFPA. UL.  FM,  IEEE,  HI, USCG

Fans and Blowers - FM, ACGIH, AIHA,  ASME, ARI,  AMCA,  USCG

Compressors - AIA, FM. OIA,  ASME,  ASHRAE, ARI,  USCG

Air Compressors - ANSI, AIA,  FM,  USCG

Steam Turbines - AIA, FM. OIA.  IEEE, USCG

Gas Turbines - NFPA, FIA, FM, OIA, AGA, USCG

Gas Engines - NFPA, FM, OIA,  USCG

Electric Motors - ANSI, NFPA, UL,  IEEE, CMA,  USCG

Shell & Tube Exchangers - AIChE,  ASME.  ASHRAE,  ARI.  AGA,  CGA,  PFI, USCG

Air-Fin Coolers - OIA, ASHRAE,  ARI,  USCG

Cooling Towers - NFPA, FM, OIA,  CTI

Boilers - ANSI, NFPA, UL, NSC

Fired Heaters - ANSI, NFPA,  UL,  FIA, FM,  OIA, ASME,  USCG

Combustion Equipment & Controls  - ANSI, NFPA, UL, NSC,  FIA, FM, OIA, USCG

Refrigeration Equipment - ANSI,  NFPA,  UL, FM, ASHRAE,  ARI, USCG

                                                                   (continued)
                                      145

-------
                             TABLE 3-2  (continued)
Dust Collection Equipment - NFPA, FIA. FM, USCG

Pneumatic Conveying - ANSI. NFPA, FIA, USCG

Solids Conveyors - CMA

Storage Tanks - NFPA. UL. OIA, AWWA. CI. USCG. NBS. OSHA

Pressure Vessels - NFPA. NSC. AIA. ASME. ARI. CGA, HEI. DOT.  USCG,  OSHA

Material Handling - NFPA. NSC. CMA. OSHA

Jets and Ejectors - HEI. USCG

Gear Drives Power Transmission - ANSI. NSC. AIA. AGMA. USCG

Stacks and Flares - OIA. USCG. FAA

Drain and Waste Systems - AIChE. AWWA. CMA. USCG

Inspection and Testing - ASTM. NFPA. NSC, AIChE. ASHRAE,  IEEE,  AMCA,  ABMA.
API. AGMA, AWWA. CGA, CTI. HEI. HI. MSS. NFPA. PFI, DOT,  USCG



Source:  Adapted from Reference 2.
                                      146

-------
       TABLE 3-3.  PHYSICAL COMPONENTS. DESIGN, AND FABRICATION FEATURES
                   OF VESSELS COVERED BY ASME CODES AS INDICATED
Component
   ASME
Code Section
                          Component Codes
Full face gasket
Welded connection
Reinforcement pad

Code termination of vessel
Lap Joint stub end
Loose type flange
Ellipoidal head, pressures, int.
Head skirt
Optional type flanges
Nuts and washers
Studs and bolts
Applied linings
Integrally clad plate
Corrosion

Stiffener plate
Support lugs
Longitudinal joints
Tell tale holes
Attachment of jacket
Jacket vessels
Plug welds
Bars and structural shapes

Stay bolts

1/2 Apex angle
Support skirt
Studded connections

Optional type flange
Bolted flange, spherical cover
Manhole cover plate
Flued openings
    Fig. UW-16.1
          UG-82, Utf-15,
UA-6, UA-45
UW-15, UW-16
G-37. UG-40, UG-A1
UA-280
U-l (e)
UG-11, G-44. UG-45
UG-44. UA-45 to 52, Fig. UA-48
UG-32, Ext.UG-33, UA-4, UA-275
UG-32. Fig. UW-13.1, UW-13
UG-14, UG-44, UW-13. Fig.
UW-13.2, UA-45 to 52, UA-55,
Fig. UA-48, Appendix S
UG-13, UCS-11. UNF-13
UG-12, CS-10, UNF-12
Part UCL., UG-26, Appendix F
Part UCL, Appendix F
G-25, CS-25, UCL-25. UA-155 to
UA-160
UG-6, UG-22, UG-54, UG-82
G-6. UG-54, UG-82, Appendix G
UW-33, UW-3. UW-35.-UW-9
UG-25. UCL-25
Fig. UA-104. Fig. UA-105
UG-28, UG-47(c) Appendix IX
UW-17. UW-37
UG-14, UW-19, Fig. W-19.2 Stayed
surfaces, UG-47
UG-14, UG-27f, UG-47 toUG-50,
UW-19, Fig. UW-19.1
G-32
UG-6, UG-22, UG-54. UA-185 to
UA-189, Toriconical head
pressures. Int. UG-32, UG-36,
Fig. UG-36. Ext. UG-33. A-275
UG-43. UG-44,W-16, Fig. UW-16.1,
UW-15
UG-14, UG-44, UW-13, Fig
UA-45 to 52. UA-55. Fig. UA-48,
Appendix S
UA-6
UG-11. UG-46
UG-32. UG-38, Fig. UG-38
                W-13.2.
                                                             (Continued)
                                      147

-------
                           TABLE 3-3 (Continued)
Component
              ASME
          Code Section
                           Component Codes
Yoke
Studs, nuts, washers
Spherically dished covers
Flat face flange, Appendix Y
Welded connection
Opening
Multiple openings
Non-pressure parts
Hemispherical head, pressures, int.

Unequal thickness

Shell thickness
Stiffening rings
Welded connection
Flat head
Openings, flat heads
Backing strip
Circumferential joints
Flat head
Tube sheet, no code. TEMA acceptable,
Tubes

Baffle
Channel section, cast steel

Integral type flange

Reinforcement pad

Compression ring
1/2 Apex angle
Conical heads, pressures
Small welded fittings
UG-11
UG-12, UG-13, UCS-10, UCS-11,
UNF-12, UNF-13
UA-6, Fig. UA-6
Fig. UA-1110
UW-15, UW-16. Fig. UW-16.1
UG-36 to UG-42, UA-7, UA-280
UG-42
G-6, UG-22, UG-55, UG-82
UG-32. UA-A. UA-3. Ext. UG-32,
UA-275
W-9. Fig. UW-9. UW-13, Fig.
UW-13.1
UG-16, UHA-20, Pressures,
Int. UG-27, UA-1, UA-2, UA-274.
Ext. UG-28, UA-270 to UA-272
UG-29, UG-30, UA-272
W-15, UW-16, Fig. UW-16.1
UG-34. Fig. UG-34. UW-13,
UG-93(d)(3), Fig's. UW-13.2 &
UW-13.3
UG-39
Table UW-12, UW-35
UW-3. UW-33,UW-35
UG-34. Fig. UG-34, UG-39
U2(g)
UG-9, Pressure, Int. UG-31,
Ext. UG-28, UG-31
G-6
UG-24 part UCS, UHA, Cast Iron,
UC1
UG-44, UA-45 to UA-52. Fig. UA-48,
UA-55, Appendix S
UG-22, UG-37, UG-40, UG-41, UG-82,
UW-16. UA-280
UA-5
UG-32
Pressures. Ext. UG-33. UA-275.
Int. UG-32, UG-36, Fig. UG-36,
A-4.
UG-11.UG-43, UW-15. UW-16.
Fig. UW-16.1. Fig. UW-16.2
                                                           (Continued)
                                     148

-------
                             TABLE 3-3 (Continued)
Acitivity
    ASME
Code Section
                                Component Codes
Threaded openings
Heat attachment
Fillet welds
Knuckle radius.
Torispherical head, pressures
UG-43 (e)
UW-13. Fig. UW-13.1
UW-18. UW-36 Table UW-12
UG-32. UCS-79
Int. UG-32. UA-4, Ext. UG-33.
A-275
                      General Design and Fabrication Codes
Heat Treatment
Inspection
Joint Efficiency
Lethal Service
Loadings
Low Temperature

Materials

Pressure. Design

Temperature. Design
Pressure Vessels Subject to
Direct Firing
Radiographic Exam
Relief Devices
Repairs
Stress

Test, Hydrostatic
Stamping and Data
Unfired Steam Boilers
UG-85. UW-10. UW-40. UCS-56,
Table UCS-56, UCS-79(d). UCS-85.
UNF-56, UHA-32, UHA-105. & UCL-34
UG-90 thru UG-97. U-l (j)
UW-12, & Table UW-12
UW-2(a), UCD-2, & UC1-2
UG-22
UG-84, UW-2(b), UCS-65. UCS-66.
UCS-67, UNF-65, & UCL-27
UG-5 thru UG-15, UG-18, UG-77,
UCL-11 & UW-5, Tables NF-1 & NF-2
UG-19, & UG-21. Max. Allowable
Working UG-98
UG-19, UG-20
UW-2(d), U-l(h)

UW-11, UW-51. UW-52, UCS-57.
UNF-57. UHA-33. & UCLK-35, Spot
Exam of Welded Joint UW-52, No
Radiograph "W-ll(c)
UG-125 through UG-136. App. XI
UG-78. UW-38, UW-40(d)
Max. Allow., Value UG-23.
W-12(c), UNF-23. UHA-23, UCL-23
G-99. UC1-99, UCL-52, & UA-60,
Pneumatic UW-50 & UG-100; Proof.
UG-101; Non-Destructive, UG-103,
UNF-58, & UHA-34; Mag. Part,
UA-70 thru UA-73; Liq. Pene,
UA-91 thru UA-95; Ultrasonic,
UA-901 thru UA-904; Impact,
UG-84, UCS-66, UHA-51.NF-6
UG-115 thru UG-120
UW-2(c). U-l(g)
Source:  Adapted from Reference 3.
                                     149

-------
3.2.1  Siting

     Siting, as related to accidental chemical releases,  is usually thought of
in terms of mitigating the consequences of a release rather than in preventing
it.  Siting from the perspective of mitigation, the consequences of a release
is dealt with in a  companion  manual  on mitigation in this  series.   Certain
conditions of siting,  however,  can influence the probability of a release.
These conditions primarily are  related to natural disasters  and climate,  but
also to circumstances at neighboring facilities, or transportation accidents,
that could play a role in causing releases.

     Examples of natural  phenomena and disasters include  lightening, wind-
storms, floods, earthquakes,  subsidence,  and landslides.   Climatic  factors
include rainfall patterns, temperature extremes,  and temperature variability.

     These factors  directly  influence physical  plant  design,  and  if not
properly accounted for they can result in hazardous design deficiencies.  For
example, a facility  in a flood-prone area  may  require different  types  of
foundations  for  storage  tanks  or  process  equipment.   Ambient  temperatures
might be important if a line freezeup in a particular process could lead to  a
failure that causes an accidental release.

     Lees discusses  siting  from a process  hazard  perspective  and cites  a
number of literature references on siting (1).

     Materials of construction are influenced by the temperature extremes the
facility is subjected to and by any  corrosive characteristics of the ambient
air.  For example,  areas  of  high humidity,  or the  presence of  nearby salt
water  or  of a  facility  that  emits a  corrosive  gas should  influence the
selection of construction materials.  The level  of  dust  in the air  and  the
                                      150

-------
potential for  severe  dust  storms may require special protection  for  certain
types of equipment.   Special  precautions  should be taken wherever subfreezing
temperatures are common.   Such  precautions  may  include  the addition of extra
insulation or heat tracing and may dictate the types of seals and gaskets used
on equipment.

     Material strength requirements  are influenced by the frequency of  severe
wind and weather conditions.  Process  equipment and their supporting struc-
tures may need extra  reinforcement or protection where high winds  or severe
hail occur.

     As a final example, the  presence  of  a  neighboring  facility where a fire,
explosion, or accidental release could trigger an incident in one's own  plant
may require consideration.

3.2.2  Layout

     Layout refers  to the  placement and  spacing  of the various  parts of a
process facility,  including the individual equipment in the various parts.   A
properly designed layout reduces  the potential  for and  the consequences  of an
accidental release by enhancing process operability and by segregating hazard-
ous areas within the  facility.   A great deal has  been written on  plant  layout
in the  technical  literature.   Both  the Chemical Manufacturers Association
(CMA) and the  National  Fire Protection Association (NFPA) have issued  stan-
dards or guidelines for plant layout (5).

     Increased distances between  process  units  tend to reduce the  potential
for,  and the impact of an accidental release.   The value  of  distance  depends
on the nature of the  hazard.  An explosion  in one process unit can result in
an accidental release  in another process unit because of damage from the blast
wave.  The blast wave pressure  front travels rapidly but its  intensity de-
creases rapidly with  distance.  A vapor cloud associated with an accidental
release travels much more slowly than a blast wave but usually affects a
                                      151

-------
larger area before it is diluted enough to present no  danger.   A fundamental
layout consideration where flammable or explosive vapor clouds  may occur is to
locate away from obvious ignition sources.  While unexpected ignition sources
may still  ignite  a  flammable cloud, there is no  reason to make the process
easier.

      Whenever possible,  a quantitative  method  should be used  to aid in
choosing the spacing between process units.   This can be done by first devel-
oping a relative  hazard ranking of individual process units.  One method of
quantifying the hazard  of  a given process unit  assigns a  hazard number to
various features  of  a  substance or process.  These numbers  are based  on  an
arbitrary scale.   The numbers for various  portions of the system are combined
by multiplying by weighting factors and  summing the results  to create  an
overall hazard rating.   The Dow Index is  an example of  this  type of approach
for ranking  processes  in  terms  of fire  and  explosion  potential (6) .   An
extension of the DOW Index  is  the  Mond  Index, which extends the ranking  to
include toxicity.   Other methods for quantifying  relative  hazards and develop-
ing spacing requirements have been developed (7,8.9).

     A list of basic concepts  for  achieving optimal layout has been assembled
by Lewis (8):

     •    Roads need to allow  entry to the plant  from  at  least two
          points  on  the site perimeter,   preferably from  opposite
          sides.

     •    All units in  the  area with a moderate  or  high fire  risk
          should  have access  for  emergency  vehicles  from at least
          two directions.

     •    Control  rooms, amenity buildings,  workshops, laboratories
          and offices should be sited close  to the site perimeter.
                                      152

-------
•    Pipebridges should be laid  out  to  minimize  easy transfer
     of incidents  from  one unit to another.  Key pipebridges
     should be  assessed independently of adjacent  units  for
     hazard potential.

•    Wherever possible, units of high risk should be separated
     from each other by units of mild, low or medium risk.

•    Appropriate distances should separate units  from  identi-
     fied  ignition sources,  such as  furnaces,  electrical
     switchgear, flarestacks, etc.

•    Control rooms, amenity buildings, workshops, laboratories
     and offices should be adjacent  to units of mild  or  low
     risk, which  act as  a barrier  from higher  risk units.
     Medium risk units  are only acceptable adjacent to popu-
     lated buildings  (a)  if  lower risk units  are not available
     for separation purposes, and (b) if the risk level is only
     just inside the  "medium" band  of Overall Risk Rating as
     assigned by the Mond Index method.

•    Units with the  highest  values  of  the  Major Toxicity
     Incident Index, assigned by the Mond Index method, should
     be suitably distant from all facility buildings containing
     many people,  and also from activities outside the works
     boundary.  (This particularly applies  to  the locations  of
     schools, hospitals, places of entertainment  etc.)

•    Units having  the highest values of the Aerial Explosion
     Index, assigned by the Mond  Index  method,  should  not be
     located close to a plant  or  facilities  boundary; they
     should be  separated  by  areas   occupied  by  low  risk
                                 153

-------
          activities with low population densities (up to 25 people
          per acre).

     •    Major pipebridges with  a  medium to  high  "Overall Risk
          Rating"  (assigned by  the  Mond Index method)  should  be
          located  so that they are at  minimal  risk from  incidents  on
          tall process units  and  from transport  accidents arising
          from the regular movement  of vehicles taking materials to
          or away  from the plant site.

     •    Units previously  and  separately  assessed  for  hazard
          ratings  can be combined into a larger single unit provid-
          ing (a)  the risks are similar,  (b)  the potential direct
          and consequential losses do  not  become  excessive and  (c)  a
          reassessment of the  rating of the  combined  unit  is accept-
          able.

     •    As far as  possible,  units  should be  laid out for a logical
          process  flow to minimize the pipebridge requirement.

     •    Pipebridge routes should be chosen  so  that they are not
          likely  to  contribute to  the spread of an accident.
          Alternative route selection  should allow as much  process
          control  as possible.

     •    Storage  units should  be adequately separated  from opera-
          tional areas and, as  far  as possible,  located away from
          road and rail  traffic routes within  the plant  site.

     In general, optimum spacing arrangements provide straight, unobstructed
access ways that are continuous from one end of a processing unit  to the other
and are connected  to roads that surround the unit.  Piping should  be laid out
in a way that minimizes the amount of  piping.   Piping associated with various
                                      154

-------
utilities and  process  units should be  segregated,  since  this will help to
avoid confusion  during  operations.   Adequate spacing must  be provided  for
maintenance and  construction.  More than  one  escape  route should be available
for any location within the  facility.   In the initial  facility design,  extra
room should be provided for  future expansion  to avoid creating future conges-
tion hazards.

     The  layout  for indoor  process units requires special considerations.
Hazardous or flammable vapors  can accumulate  in  an indoor facility.  Proper
ventilation  is  a primary  consideration for indoor facilities that  handle
hazardous materials.  Many air changes per hour with little recirculation may
be in order where a hazardous material is involved.  Any potential  leak source
should be protected.  Vents  and  pressure relief  discharge  lines  which  may
release toxic  or flammable materials  should be piped to  a  safe area.   The
holdup of hazardous materials inside of process buildings should be minimized
and generally  limited  to  material in  process equipment and  piping.   Some
additional considerations  for  indoor facilities are  listed  in this manual  in
Section 3.3.4.

     A safe control room is essential  if a plant  is to respond to an acciden-
tal release once it has occurred.  As  far as  possible,  a  control  room should
be located in an area where exposure to fires, explosions  or toxic  releases is
minimum.  Wherever a control room is located,  it  should be  designed  to mini-
mize the potential for injury  to the  employees in the  event of an accident.
Examples of precautions include, explosion  shielding, shatterproof windows, a
ventilation system that provides  clean air while  keeping the control  room
under slight positive pressure, and extra fire protection.  If a control room
is located within a process  unit, then  other  buildings  such as laboratories,
lunchrooms or  offices  should not be added  onto  the control room.   Support
structures where personnel tend to congregate should be  located outside of  the
processing area.
                                      155

-------
     Many of the layout precautions listed above are necessary for the sake of
fire prevention.   Additional  layout considerations  specifically for  fire
protection are discussed in Subsection  3.3.A.

3.2.3  Storage Layout Considerations

     The arrangement of storage facilities follows the same general  principles
just discussed for general siting and  layout.   Storage facilities may merit
special consideration,  however,  because they contain  large inventories of
chemicals.

     Storage near high-hazard process  areas and loading and unloading termi-
nals should be the minimum required for the needs of  the process or shipping
requirements.  Storage facilities should be located on, at most, two sides of
a processing area so that the area is  open on at  least two sides.   Inventory
should be kept to a minimum.  Tank  storage areas  should be located  away from
offices and  other  locations where  people congregate.  A tank storage area
should be  located  as far  from  a community population center  as possible.
Prevailing wind direction should be considered so  that the  effects of a large
release from  storage  facilities are minimized.   The  natural  ground contour
should be considered so that  runoff from a spill would not  contaminate a large
area or would not find its way to a source of  ignition.

     One basis for selecting  tank spacings are NFPA standards  (5) .  These are
based on flammable materials but are a useful guide  for separating  flammable
and toxic materials.  Two  materials  that  may react and generate heat upon
contact should not be  stored  within  the same  diked area.   A chemical should
not be stored in a  diked area with a  tank constructed of  material  that it
would react with.  For example,  concentrated hydrochloric  acid should  not  be
stored in a diked area with a carbon steel tank that contains another hazard-
ous chemical.
                                     156

-------
     Adequate spacing for fire control and maintenance should be available for
all tanks.  Access roads should surround groups of tanks.  As far as possible,
tanks should be  located  away from heavily traveled roadways to minimize  the
potential for vehicle collisions with tanks.  Fittings and pipe runs should be
protected from vehicle  collision.  This applies especially  to  pipe bridges
with pipes carrying  toxic chemicals.  Appropriate  fire protection  in  the  form
of deluge systems, and/or foam systems should be permanently in place.

3.2.4  Miscellaneous Design Considerations

     A number of  miscellaneous design considerations  are an inherent  part of
physical plant design.  These include:

     •    Availability and dependability of utilities;

     •    Operability;

     •    Fail-Safe Design;

     •    Fire prevention and protection;

     •    Electrical system requirements;

     •    In-process inventories;  and

     •    Special safety requirements.

Availability and Dependability of Utilities—
     The loss of a utility can result in  an  accidental release  if  control of
the process is consequently lost.   The potential for an accidental  release may
be reduced if two principles are followed in designing a  utility system.

     The first principle  of safe utility  design  is.  if  the failure  of  a
utility to a portion of a facility can result in a  loss of control  in  that
                                      157

-------
section of the facility,  then that utility should  be supplied  with a  backup in
at least that portion of the  facility.  A facility  electrical system backup
could be a diesel generator system.  An instrument air system could be backed
up with a nitrogen system.   Backup for a utility does not  mean that there must
be a duplicate of the entire  system.  Backup for a cooling water system  could
be a set of pumps that deliver municipal  water to a few  crucial portions  of
the cooling system  in the  event  of a cooling system breakdown.   It  may  not
always be possible to provide backup  to a  utility,  but when  a failure could
lead to an accidental release a backup should be considered.

     The second principle of safe utility  design is  that  the  loss  of  a utility
in one section of  a plant  should not result in the  loss  of that  utility to
other sections of  the plant.  Breaking or plugging  a  utility line  in  one
process unit should not result in the loss of that utility to another area  of
the plant.  This  implies  parallel rather than series distribution  for critical
utility systems.  Loop piping systems are more effective in meeting  this
criterion than are branch systems.   Complete  adherence to this principle will
sometimes be difficult to achieve, but it  should be attempted whenever possi-
ble.

Operability—
     Considering the human  aspect of process  operation and maintenance during
the design phase of a project, may  help to reduce the potential for  an acci-
dental release by enhancing operability of a  plant.   A plant  should be capable
of  running under  manual  control  long  enough to  complete a safe  shutdown.
Automatic process control systems can be expected to  fail from  time  to time.
Valves, gages, and other  instruments and controls  should  be located where they
are easy to use.   Important instruments and controls should be readily distin-
guishable from less  important instruments.   Unnecessary  complexity should be
avoided.  An overcontrolled plant may be  as  difficult to operate  as  an  un-
controlled plant.  Operators may bypass control systems that are difficult  to
maintain or that  result  in  frequent process upsets or interruptions.

     Any actions that are essential  for safe operations should be  set up in a
way that minimizes effort to the  operator  in  order to facilitate their imple-
                                      158

-------
mentation.  An important task that  is  difficult  to  perform may be overlooked
or implemented too late.  Preventing this kind of error is the  responsibility
of both management  and  the design engineer.  For example,  if  water must be
regularly drained from  a vessel  or if samples must be  regularly withdrawn,
then the drain or sample loop should  not be located at the top of a ladder.
Important valves should be readily accessible.  Movement of personnel from one
task to the next should be  taken  into  consideration.  For example, people may
take the easiest route  between  two points even  if  it  means  inappropriately
climbing over equipment.

     Unnecessary clutter such as extra piping and equipment can make a  process
difficult to operate and may increase the potential  for an accidental release.
Facilities often evolve as modifications and additions are made.  Care should
be taken to streamline  and  simplify by removing  unnecessary piping and equip-
ment as modifications are made.

Fail-safe Design—
     A fail-safe control device is one designed  to  move to  a preset  position
upon failure of  the instrument  air or electricity.  For  example,  fail-safe
pneumatic control valves are designed to go to the fully open or fully closed
position on air failure.  The purpose  of fail-safe  equipment is to reduce the
potential for a process upset by  preassigning the failure modes for process
controls.   A correct decision as  to whether  a device  should  close or open on
failure is essential for safe plant design.  For most processes, some type  of
formal design evaluation procedure, such  as  a Hazardous and Operability Study
(HAZOP) study, may  be  useful for evaluating what failure mode  should be
selected.

Fire Prevention and  Protection—
     A properly designed plant will have fire protection  systems  external  to
the process unit, such  as  sprinklers,  as well as inherent  fire protection
design features.   From an accidental release  perspective, fire prevention and
protection is  important because  fire  damage  could  lead  to  an accidental
release and because  many design  considerations associated  with  fire prevention
                                      159

-------
are actually accidental release prevention measures.  Much has been written on
fire prevention and protection.

     The National Fire  Protection  Association has issued guidelines  in the
form of  "Flammable and  Combustible  Liquids  Code"  (5) .   Generally,  local
ordinances will  have  specific guidelines  for fire  protection systems.   A
detailed discussion of  the  design  of fire protection systems such as sprin-
klers,  foams, etc. is outside  the  scope  of this  text;  however, this  section
provides an overview of some fire protection design  measures.

     The supply of fire  fighting water and the availability of utilities in
the event  of  a  fire is important.    In addition  to  controlling fires, fire-
fighting water (and steam) are often used to control the spread of vapors from
an accidental release.  The loss of  utilities to the entire facility because
of a fire  in  one  process  unit  may  result in a loss  of process  control  that
could end in an accidental release.

     The fire fighting water distribution system is important.  A loop  design
rather than a branch layout design  may be the best arrangement for water lines
in high hazard areas because a loop design ensures water availability even  if
lines have been  cut  off in one area of  the  plant.   Valves  should be placed
throughout the distribution system  so  that a damaged line  can be isolated.
These valves may need to be remotely operable.

     The primary water  supply  is usually designed to supply water  for  fire
fighting for at least four hours.  All sources combined  are usually designed
to be able  to supply  water for  an additional two  hours  (5) .   Many  other
features of  a  fire  fighting  water  system, including specifications on  water
requirements, pumps and  pumping, sprinkler systems, fire extinguishers and
other aspects of  fire  protection,  are presented in additional NFPA publica-
tions.   Specialized fire fighting equipment, such as foams or extra sprinklers
or water curtains, should also be considered in highly hazardous areas.
                                      160

-------
     Fireproofing of  structural steel,  piping,  and  machinery  is  often
necessary.  Fireproofing  may include  special  insulations or materials  of
construction.

     Adequate drainage  is  important  for fire  prevention,  especially for
flammable liquid spills.  Flammable solvents may be carried to other locations
within a plant on the surface of water.  The contents  of a drainage  trench may
ignite and spread fire throughout a plant.   Submerged  equipment  is  likely to
malfunction and  contribute  to  the  hazard.   Drains should be sized to handle
the maximum anticipated load.  The presence  of  debris  such  as insulation and
tags that may clog  drains should be accounted  for  in.  the design.   To avoid
this, trenches sometimes have a  cover  two  thirds  closed and one third grate
(5).  This dampens flames within the trench if a fire  occurs.   Flame traps are
usually spaced periodically  throughout a  trench to prevent the  spread of a
fire.

     Indoor facilities require  additional  fire  protection.   Where flammable
dust or vapors may be present,  buildings  should be  constructed  with nonload-
bearing walls so that walls  lost because  of  an  explosion will not result in
collapse of the  building.  In addition to area sprinklers, it  may be necessary
for each piece of equipment  to  be  protected  by  a local device.   Local flam-
mable gas detectors and/or area monitors are often used and placed near likely
release points.   Air is handled through ducts in indoor facilities.   Flammable
dusts, vapors and  vapor condensate can  collect in these ducts.  For this
reason, vent and duct systems are  specifically  designed with  safety features
such as those suggested in the literature (8).

     Fugitive emissions of  flammable  materials  are sometimes controlled  by
constructing vented enclosures  around equipment.   Process  fittings  such  as
valves or flanges,  or  process  machinery such as  pumps  or  compressors  are
potential candidates for  this  type of control.   The  vent lines from these
enclosures are often piped  into a  common manifold  and sent to a treatment
device.  Air in  the vent manifold  can  lead  to  fire and explosion.   Air leaks
into the vent system can be prevented by creating a slight positive  pressure
                                      161

-------
with an inert gas.  Diluting with an excess of air is another approach to keep
the concentration below the flammable or explosive limits.   A probe  could be
installed to monitor oxygen levels in the vent.

Electrical Systems—
     Fire hazards are reduced by selecting the appropriate class of electrical
equipment.  Electrical equipment  is  given a  classification  and a division
within that classification  by  the manufacturer which indicates what type of
environment the equipment can safely operate  in without becoming an  ignition
source.

     Class I equipment is often  referred to as  "explosion proof" and is  the
class required where flammable atmospheres may be present.   A  summary of  some
locations encountered in  a  chemical  plant and the equipment classification
that would apply to each location is specified by  the National Fire Protection
Association (5).  The following definitions of Class  I,  Divisions 1 and 2, are
provided by the National Fire Protection Association:

     Class I,  Division 1.   A Class I, Division 1  location is a location:   1)
     in which ignitible concentrations of  flammable  gases  or vapors  can exist
     under normal operating conditions; or 2)  in  which ignitible  concentra-
     tions of such gases  or vapors may  exist  frequently because of repair or
     maintenance operations or because of leakage; or 3)  in which breakdown or
     faulty operation  of equipment  or processes might  release  ignitible
     concentrations of flammable gases or vapors,  and might also  cause simul-
     taneous failure of electric equipment.

     Class I,  Division 2.   A Class I, Division 2  location is a location:   1)
     in which  volatile flammable liquids  or  flammable gases  are handled,
     processed, or used,  but  in which the liquids,  vapors, or  gases  will
     normally be  confined within closed containers  or  closed systems from
     which they can escape only in case of accidental rupture  or  breakdown of
     such containers or systems,  or in case of abnormal  operation of equip-
     ment; or 2) in which ignitible concentrations of gases or vapors are
                                      162

-------
normally prevented by positive mechanical ventilation, and which might become
hazardous through failure or abnormal operation of the ventilating equipment;
or 3)  that  is adjacent to  a  Class I, Division  1  location, and to  which
ignitible concentrations of gases or vapors might occasionally be communicated
unless  such  communication  is  prevented by  adequate  positive-pressure
ventilation from  a  source of  clean  air, and effective  safeguards  against
ventilation failure are provided.

     It may be appropriate to  use  Class  I  equipment  exclusively throughout a
plant that handles highly toxic  chemicals.  Ordinary  electrical equipment is
usually considered acceptable  in these locations if it is installed in a  room
or enclosure maintained under positive pressure by ventilation air that is not
contaminated by flammable vapors.   If such enclosures are  used where  toxic
chemicals are involved, then  it would be  appropriate to install an  alarm
system to sound when the enclosure loses pressure.  Additional  details may be
found in the  National  Electrical Code,  1984, put out by the National Fire
Protection Association (10).

Storage and In-Process Inventories—
     The potential effects  of  an accidental release  will be reduced as both
storage and  in-process inventories of  toxic  and  flammable materials are
reduced.  No  generalized  formal methods appear  to have  been developed for
reducing inventories.  Each process is unique and potential  reductions  will be
specific for that  process.

     Reducing the volume  of process vessels  is  probably the  most  obvious
method available  for  in-process  inventory  reduction.   While it is sometimes
possible to reduce the volume  of intermediate hold and  feed vessels  or  of
process piping in an existing  plant,  this is best accomplished  in the initial
design of the plant.   A more practical approach  for  an  existing plant  is to
reduce the volume contained in  process  vessels  rather  than to reduce  the
actual volume of  the vessel.   Improved process control would assist in this
type of volume reduction.   Better process control would  reduce fluctuations in
upstream and downstream processes and allow for a smaller intermediate  storage
volumes.
                                      163

-------
     Substitution of chemicals or equipment may be used to reduce both storage
in-process inventories.  Some of  these  substitutions  are practical modifica-
tions for an existing plant and some are best considered in the initial plant
design.  Heat  transfer systems are  good candidates for  substitutions.   A
flammable heating fluid may  be  replaced with a nonflammable  heating fluid.
High temperature unit operations such as distillation may possibly be replaced
with lower temperature unit operations such as adsorption, crystallization or
liquid-liquid extraction.   An example of an equipment substitution is suggest-
ed by Lees  (1):   replace  a kettle  reboiler with a  thermosiphon  reboiler.
Thermosiphon reboilers hold a smaller inventory than do kettle reboilers.

     Altering the process  chemistry may reduce inventories.  For example, the
necessity of  storing an intermediate could  be  eliminated by combining two
reactions and running them simultaneously in the  same  reactor.  A more effi-
cient catalyst could reduce reactor residence time and inventory at an equiva-
lent production rate.  A non-toxic or nonflammable  solvent could be substi-
tuted for & flammable or toxic  solvent,  or  it  might be possible to eliminate
the solvent altogether and run  the  reaction "neat."  It may be possible  to
substitute a nonflammable  or  non-toxic  raw material for  toxic  or flammable
material.  As with all potential  inventory  reduction  methods,  some of these
alternatives would best be explored  in  the  process  development  stage and  are
more easily applied  to new rather  than existing facilities,  but certain
changes still might  be developed for existing facilities.

Special Safety Requirements—
     A hazardous process,  or a  process  that handles toxic  or flammable mater-
ials may require special safety requirements that were not called  for  in  the
previous principles  of  design.   Such features  are  generally mitigative in
nature but may also  include  the addition of extra  preventive  or  protection
measures.  Some of these,  discussed  later in this manual, are scrubbers and
flares.  Blast shields, water or  steam curtains, specialized  spill  cleanup
equipment and specialized  release  detection equipment and alarm systems are
                                      164

-------
examples of mitigation measures that may be required.  Mitigation measures are
discussed in the companion manual on mitigation, in this series.

3.3  EQUIPMENT DESIGN CONSIDERATIONS

     The equipment  in a chemical process  may  be broadly divided into four
categories:

     •    Vessels;

     •    Piping (including valves);

     •    Process Machinery; and

     •    Process Instrumentation.

     This section focuses  on  some fundamental  design considerations,  typical
failure modes, and  control measures for these  process  equipment categories
that are  necessary  to  prevent  failures from  causing  accidental releases.
Certain general topics applicable to all equipment are discussed first.   These
include materials of construction and general equipment failure modes.

3.3.1  Materials of  Construction

     Selecting the  wrong material  of  construction  can  lead to equipment
failure by  corrosion,  erosion,  or mechanical  wear.   A variety  of  process
characteristics determine  an  appropriate material of construction.   Process
fluid characteristics  such as alkalinity,  acidity,  abrasiveness,  and  re-
activity must  be considered  in  combination with pressure  and  temperature
extremes and the frequency and magnitude of temperature and pressure  fluctua-
tions.   General procedures for selecting appropriate materials of construction
are well defined in  the technical literature  (11).  Even if  an appropriate
material is  specified in the original  design, a contractor  or vendor  may
substitute one material  for another or maintenance  personnel may  replace a
part with a part made of an inappropriate material.  It is valves,  flanges,
                                      165

-------
gaskets, bolts or other small parts of a process unit  that  are likely to be
made of an incompatible material.  These small substitutions  are  potentially
dangerous because their significance as a potential  cause  of  system failure
leading to a release may not be fully  appreciated.

     An example qualitative guideline  for  evaluating  the appropriateness of a
material of construction  under acid conditions is presented  in Figure 3-1
(11).  The graph presents qualitative information on the range  of conditions
for different materials.  The variables include oxidizing environment, reduc-
ing environment and chloride content.   This chart does  not  show temperature
dependency, which is also an important consideration.

     The material strength requirements depend on the temperature  and  pressure
to which a piece of equipment is subjected.  Calculation of strength require-
ments should be based  on  the anticipated normal operating  conditions, ex-
tremes, and on the  frequency of heating-cooling, pressurization-depressuriza-
tion cycles that the system will undergo.  A detailed discussion of the design
specifications that would be required for different conditions is outside the
scope of this text, but is fundamental in  the  field  of  design  and fabrication
for vessels and other equipment.

     For vessels, piping, pipe  fittings and other hardware, design codes or
standards are available that define in detail the steps  required  to properly
account for stresses that equipment will experience.  These procedures first
define specific criteria for establishing  the  design  pressure  and  temperature.
The design conditions  are established by taking into  account the  maximum
temperature and pressure that will  be  experienced under normal operations,  and
the frequency and severity of occasional excursions  from the  normal maximum
conditions.  After  the design  conditions  are set,   the  standards outline
methods for determining wall  thickness based  on the design temperature  and
pressure and  on  forces other than pressure forces that  result in torsion,
axial compression or tension, and bending.   Examples  of additional forces are
stresses caused by repeated temperature and  pressure  cycles  or stresses caused
by  the  thermal expansion  and  contraction of  piping.   An  allowance   for
                                      166

-------
MATERIAL OF
CONSTRUCTION
   REDUCING ENVIRONMENT
                OXIDIZING ENVIRONMENT
TANTALUM
ZIRCONIUM
HASTELLOY B-2
Ti-Pd
TICODE-12
Ti
HASTELLOY C-4
MONEL 400
HASTELLOY G
XXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXX
         xxxxxxxxxxxxxxxxxx
                  xxxxxxxxx
                     xxxxxx

                      xxxxx
                      XXX
                           X
                                                   XXXXXXXXXXXXXXXXXXXXXXXXXXX
              xxxxxxxxxxxxxxxxxxxxxxx
              xxxxxxxxxxxxxxxxxxxxxxxxxxx
               xxxxxxxxxxxxxxxxxxxxxxxxxx
              xxxxxxxxxxxxxxxxxxxxxx

              xxxxxxxxx
                                                             CHLORIDES
COPPER ALLOYS
ALUMINUM
MONEL 400
NICKEL 200
INCONEL 600
430 SS
304 SS
316 SS
CARPENTER 20 Cb-3
INCOLOY 825
HASTELLOY B-2
HASTELLOY C-4
HASTELLOY G
Ti
Ti-Pd
CAST IRON. STEEL
ZIRCONIUM
  :«;*:»,»;*:»;»;»:•:«:•;»:».»:»
:x
    xxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxx
      :»:»:»;«>:•:»»;»;»>:»,«:»;»,»;»,»:*:
                          X
                       xxxx
                       txxxx
             xxxxxxxxxxxxxx
               xxxxxxxxxxxx

               xxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxx
                                   :»•••*•»:*»»»« »«••»«««*«
              XX
                                xxxxxxxxx
                  xxxxxxxxxxxxxxxxxxxxxxx
                xxxxxxxxxxxxxxxxxxxxxxxxx

              xxxxxxxxxxxxxxxxxxxxxx
                                                             NO CHLORIDES
                               xxxxxxxxxxxxxxxxxxxxxx
                               xxxxxxxxxxxxxxx
                                  xxxxxxxxxxxxxxxxxxxxxxxx
                               xxxxxxxxxxxxxxxxxxxxxxxxxxx
                               xxxxxxxxxxxxxxxxxxxxxxxxxxx
                Figure  3-1.  Example  guide  for material selection under acidic conditions.

-------
corrosion, erosion, or the depth of threads or other grooves must  be made by
the designer.  Such an allowance is necessary since  these  factors  weaken the
basic material.   An  additional allowance is usually provided where toxic
chemicals are involved.

     The published standards  for determining  the strength  requirements  for
process equipment should be considered minimum  standards where  toxic chemicals
are involved.  These  standards are general and  cannot cover  all  possible
design, construction,  and operating conditions.   For  example,  standards cannot
account for unrelieved stresses created  during  fabrication or installation.
The equipment designer of a facility  that handles toxic chemicals  should try
to account for all  stresses  and allow a safety  factor consistent  with  the
hazards involved.

     At high  pressures,  over  3000  psig,  special designs  not  necessarily
covered by design standards or codes are  sometimes used. For example, at such
pressures, a vessel constructed from  ordinary  low-carbon-steel plate would
become too thick  for practical fabrication by ordinary  methods.  The  alterna-
tives are to make the vessel of high-strength plate, use a  solid forging,  or
use multilayer construction.    Such specialized fabrication methods may not be
subject to any particular standards or codes.

     Very low or  high temperature  operations also require  special  considera-
tion.   These extremes  are more a problem of material selection than they are
of material  strength  requirements   (though  one  is closely  related to the
other).  Brittle  fracture  is  possible wherever very low temperatures  are
involved.  The materials used  in plants handling  low  temperature  fluids should
have a  ductile/brittle  transition  temperature below not only the normal
operating temperature but  also below  the minimum  temperature  that  may  be
expected to occur under abnormal conditions.  Brittle  fractures  are  serious
since the fracture can propagate at a velocity close to that  of sound.  For
high temperatures a lining is often used to protect  the outer  equipment  from
                                      168

-------
the high temperatures.  A specialized lining must be placed inside a vessel of
special construction when high temperatures and pressures are involved.

3.3.2  General Equipment Failure Modes

     A number of failure modes  are  common  to  all  categories  of  equipment,  and
each of the  three  fundamental equipment categories of vessels,  piping,  and
process machinery have failure modes to which they are especially susceptible.
This subsection presents a general  discussion of  potential failure modes and
is a basis for the  discussions  specific  for each of the equipment categories
presented in later subsections.

     Categories of failure modes that may lead to an accidental release are:

     •    Process upset causing  pressure or temperature to  exceed
          design limits of the equipment;

     •    Faulty fabrication;

     •    Faulty repair or installation;

     •    Corrosion;

     •    Erosion;  and

     •    Mechanical failure.

Process Upsets—
     A process upset, as meant  here,  is  any  event  that  leads  to a loss of
process control that could result in  an  accidental  release.  A runaway reac-
tion and overpressure, an  internal  explosion, or even failure  caused  by an
external explosion in an adjacent process  or  storage  unit  would all be exam-
ples of process upset failures.  Thus  a  failure occurring as a  result of  a
fire would also be a process upset failure.  Numerous  events, including
                                      169

-------
instrument failure, operator failure, or mechanical  failure,  can  result  in a
loss of process control.   Process upsets,  which can lead to equipment failure.
were discussed in Section 2 of this manual on Process Design Considerations.

Faulty Fabrication—
     An equipment failure could  result from  faulty  fabrication.   A poor  weld
would be an example of a  fabrication  fault.   Incomplete penetration, lack of
fusion, or a  porous weld could  result  from improper  or careless welding
techniques.  Improper heat treatment of a metal  component can result in unre-
lieved stresses.  As will be discussed latter,  these stresses can contribute
to  several  forms of structural  failure.   Poor dimensional  tolerances  can
result in excess mechanical stress or poor fit at  gasketed joints.  The use of
an  improper material of  construction can  result in  premature corrosion  and
failure.   Additionally, attempted cost saving steps  such as  substituting one
grade of equipment for a  lower grade  can  result in premature equipment fail-
ure.  Detailed consideration of fabrication faults is beyond the scope of this
manual, but  there is a  voluminous literature on the subject (e.g., 13).

Faulty Repair or Installation—
     Another contributor to equipment failure can be faulty  repair or instal-
lation.  One  author  believes that most initial process plant designs  are
relatively safe  but  that problems arise  because  changes, substitutions  or
mistakes are made during the initial construction  of the plant (1A).

Corrosion—
     The materials of construction in a  chemical plant are subject to a number
of  types of corrosion.   Corrosion can structurally weaken equipment to  the
point of failure under either normal  process  operating conditions or process
upset conditions.

     There are numerous categories of corrosion.  Some of these are  (1):

     1)   General corrosion,
     2)   Scaling,
     3)   Exfoliation,
                                      170

-------
     4)   Intergranular corrosion,
     5)   Stress-related corrosion,
          a)  stress corrosion cracking,
          b)  corrosion fatigue,
          c)  stress-enhanced corrosion,
     6)   Galvanic corrosion,
     7)   Corrosion pitting,
     8)   Knife-line corrosion,
     9)   Crevice corrosion,
    10)   External corrosion.

These are all discussed in the cited reference.  Some categories are discussed
further below.

     Stress corrosion cracking  is the brittle  failure  of normally  ductile
metals that occurs under the  combination of.corrosion and tensile  stress. The
stress may be internal or  external.   The American Petroleum Institute states
that almost  any alloy can be  made to fail by  a  stress  corrosion cracking
mechanism (15).   Caustic embrittlement  is  a  common form of stress  corrosion
cracking, as is  the well known chloride stress corrosion cracking of stainless
steels.

     Intergranular corrosion occurs when austenitic  steels are heated in the
temperature range of 750 to 1650°F, or  cooled through  this range.   A complex
carbide precipitates out and  collects  along  grain boundaries.   These pockets
of carbide are susceptible to corrosion by relatively mild aqueous corrodants.
The end result of this type of corrosion is the formation of cracks.

     Galvanic corrosion is  used to describe  an accelerated electrochemical
type of corrosion  that  occurs when two different metals are in  contact  with
each other in the presence of an  electrically conductive solution such as an
aqueous salt  or  acid  solution.   An electrical current flows between  the two
metals and rapidly corrodes the metal that acts as the anode.
                                      171

-------
     Other general  categories of  corrosion include  graphitic corrosion,
dezincification and biological corrosion.  Many  additional  chemical-specific
varieties of corrosion are possible.   Discussions of corrosion are numerous in
the technical literature (16.17,18).

Erosion—
     Erosion is the physical wearing away  of process equipment materials by
the abrasive action of rapidly moving liquids, gases, or solids.  Erosion can
result in an equipment failure because  of physical weakening.  The  rate of
erosion is a function  of the velocity of  the  process  stream, the angle of
impingement upon  the  surface of concern,  the  solids concentration  of  the
stream and the  temperature of the stream.  Erosion and corrosion may sometimes
occur together.   Some  materials  form  a layer  of  corrosion  that acts as a
barrier to  further corrosion.   These  protective layers usually have  less
physical strength than the  material  on which  they are formed.  If  erosion
destroys this layer, then the surface of  the material  will  be eroded away as
new corrosion layers are formed and eroded off.  A common site of  erosion is
in the bends of piping.

Mechanical Failure—
     Mechanical failure of equipment  results from overstress,  whether internal
or external.  Extremes or cycles of  temperature and pressure  can  result in
mechanical failure of  process equipment.   Externally applied  stresses such  as
vibration and supported  loads can  also  result  in  the mechanical  failure of
process equipment.

     Creep is the flow of metals held  for long periods of  time  at  stresses
lower than the  normal  yield strength.  Stress rupture  is  the failure of a
metal at stresses lower than the normal yield strength after it has  reached  a
point beyond which it cannot creep.

     Repeated heating  and cooling cycles  may  sometimes result  in  thermal
fatigue.  Thermal  fatigue produces cracks and may ultimately result  in a
                                      172

-------
structural failure.  A  sudden change in temperature can sometimes result  in
thermal shock.  Thermal  shock which causes the sudden  unequal  expansion or
contraction of different parts of a piece of equipment,  can result in cracking
or separation.

     Vibration can be very  destructive.  Metals can  become fatigued  and fail
in a manner similar to  that of thermal  fatigue.  Concrete foundations can  be
destroyed by  vibrating  equipment.  The  weight  of insufficiently supported
equipment or  the stress  caused by settling foundations  or  supports  is  also
destructive.

     The ensuing  subsections discuss some  of the  design  considerations,
failure modes, and  control  technologies specific  to each  of  the previously
named equipment categories:   vessels, piping,  and  process machinery.

3.3.3  Vessels

     As used  here, vessels  include all  major items  of  equipment containing
significant inventories  of  liquids or gases;  this includes both process and
storage equipment.   Vessels  include  tanks,  reactors, heat exchanger shells,
receivers,  columns,  and similar  equipment.  Vessels may  be atmospheric,
pressurized,  or operate  under vacuum.

     Vessel equipment failures  that could  result  in an accidental release
could occur in one  of  the following locations:

     *    Piping joints  at vessel  nozzles;

     •    Vessel seams,  including  welded attachments  such as nozzles
          and support  lugs;

     •    Vessel shell wall  failure;  and
                                      173

-------
     •    Vessel flanged joints  such  as where a  head joins  the
          shell.

Vessel Pipe Joint Failure—
     Joints of  piping  to vessels are either  threaded,  flanged,  or welded,
although flanged joints  are probably the  most  common for  larger process
vessels with connections over two inches.  Faulty installation or repair may
be the most common  causes  of failure at  a flanged attachment.   Incorrect
gaskets may be used.  Flanges may be bent by excessive bolt tightening, which
results in insufficient  pressure  on  the gasket to assure a  complete seal.
Gasket faces may be scratched or dented.  A gasketed joint may be bolted with
the gasket half in the grove and half out.  Mechanical  stress due to inade-
quately supported loads  or  vibrations may overstress  bolts and  result  in a
leak. The bolts  around  the  perimeter of a gasketed joint often  require  a
specific tightening sequence at  a  specific tightening torque.  A failure  to
follow these specifications can result  in  a poor  seal.   Flanges  or bolts  of
incorrect specifications may be  substituted during a repair,  but  substitutions
of this kind could result in a  premature failure  of the  flanged joint.

     Flanged or  threaded joints are sometimes used  to  join  equipment  and
piping of  different  materials  of construction.   A joint of  this  type is
potentially subject to galvanic corrosion.  The threads on a  threaded attach-
ment can be destroyed by galvanic corrosion,  resulting in a  complete failure
of the joint.

Vessel Seam—
     Generally, two types of seams are  used on vessels:   welded  and riveted.
Riveted vessels are not  recommended for use with  toxic chemicals because the
overlap at a riveted seam is subject  to both  internal and external corrosion
and each rivet is the potential source  of  a leak  due  to  corrosion.   Stresses
can be  concentrated  around  each rivet and stress or  stress corrosion cracks
can form around rivets.  Vessels for toxic chemicals  should  have  welded seams,
but even these may fail under certain circumstances.
                                     174

-------
     With vessel  seams,  the  primary  preventive measure  is  proper initial
welding.  Sloppy welding may  result in a  porous or incomplete weld that does
not provide the necessary  structural  strength.   Also,  a welded seam may leak
because of  corrosion.  The metal surrounding a weld is  heated  during the
welding process, and this heating can result in unrelieved stress in the metal
which may contribute to  the  formation of  stress corrosion cracking.  Heating
can also  create  the precipitation of complex carbides,  which can result in
intergranular corrosion.

     Sometimes welding is  used to join two different  metals.   This type of
weld is subject to  thermal  fatigue  when  it is subjected to  repeated heating
and cooling cycles  caused  by differential expansion and  contraction  of the
different metals.  Cracks from thermal fatigue will initially form  slowly but
will progress more rapidly with time.

     Some welds are actually designed to fail in the event of an overpressure.
An  atmospheric  storage  vessel will  often be  designed to  fail  at the
shell-to-head joint to prevent the entire contents of the tank from emptying.

Vessel Shell Failure—
     The nozzles attached  to  a vessel shell are sites  for  potential  vessel
failure.  Inadequately supported  loads on  fittings connected to a nozzle may
result in failure of the nozzle.  Thermal expansion and contraction of  piping
may create excessive stress on a  nozzle.   A tank settling under subsidence  of
the ground beneath it can  cause connection and  nozzle  failure.   Vibration of
support piping  or  equipment may  also cause  a  nozzle  failure.   Unrelieved
stress formed during fabrication may contribute to stress corrosion cracking.
Galvanic corrosion is a potential wherever a fitting made of a different metal
is attached to a nozzle.

     External forces may cause the main vessel shell  to be susceptible to
failure.  Unsupported loads such as support piping, platforms or walkways can
                                      175

-------
cause the collapse of a vessel shell.  Loads  created  by foundation settling
can also cause a vessel  shell to  collapse.

     Thermal shock caused by a rapid temperature swing will result in unequal
expansion or contraction of different parts of  a vessel, which may result in
damage.  Thick walled vessels are more susceptible  to  cracking due to thermal
shock than are thin walled vessels.   Some vessel coatings  may pull loose and
fittings may pull away because of thermal  shock. A vessel  shell (particularly
around a nozzle)  may  crack because of repeated heating and  cooling cycles.
The effect is similar to thermal  shock except that  the  fatigue of  the metals
and of the joints between different metals  develops more slowly.

     A vessel shell is subject to  several types of corrosion.  -Corrosion  in
the plate body of the shell,  as  opposed to seam welds, can result  in  thinning
of the wall and cracks which lead to  shell plate failure.  A bottom plate in
contact with  a  pad is particularly  susceptible to external  corrosion.   An
insulated vessel  may  be  subject  to external  corrosion  in  situations where
moisture has  soaked  into insulation and is trapped next to  the vessel.   A
vessel head  is  susceptible to corrosion that accompanies  evaporation  and
condensation of trace quantities of water.  Numerous  additional varieties of
corrosion specific to the  chemicals and materials   of construction are pos-
sible.

Vessel Failure Prevention Controls—
     The primary  prevention control for vessel  failure  related to the equip-
ment itself is proper design  and construction and  the avoidance of the kinds
of conditions, discussed above, that can lead to failure.   The ASME Boiler and
Pressure Vessel  Code, which  specifies  design  standards for boilers,  and
pressure vessels,  was referred to in Subsection 3.2  of this manual.   Most
states have incorporated all  or  part  of the Code  into  their legal require-
ments.  Where toxic chemicals  are  involved,  it  may be appropriate to use the
ASME Code as  a minimum  standard  for the design  of  vessels.  This may not  be
practical for large storage vessels, however, where at a minimum, design might
                                     176

-------
be according to API (19,20.21).  For all vessels, more stringent design may be
appropriate than these minimum standards where toxic chemicals are involved.

     Most processing vessels are designed in accordance with ASME Code Section
VIII, Division  1.   Subsection  B of Section VIII  provides  some specific in-
structions for the fabrication of vessels used  in "lethal  service,"  which is
defined as a vessel used to handle poisonous gases or liquids of such a nature
that a very small amount of  the  gas or of the vapor of the  liquid mixed or
unmixed with air is dangerous  to life  when  inhaled.   The Code specifies that
all vessels in lethal service shall have all butt-welded joints.  These joints
must be  fully  radiographed  to  test their integrity before use.  All vessels
made of  carbon  or low-alloy  steel  shall be  postweld-heat-treated.  The ASME
Code stipulates that  brazed vessels cannot be  used  in lethal service.  In
general, butt-welded  or  flanged  joints should be used  throughout a  process
handling hazardous materials.  Threaded or riveted joints should be  avoided.

     A storage vessel usually has less strength than a process vessel (such as
a reactor).  For example large atmospheric  storage vessels are  often designed
to withstand only 8 inches of water and will burst at  about  three times this
pressure.  These same vessels  can only tolerate about 2.5 inches of vacuum.
Because they are easy to rupture or collapse,  this type of  tank may  not  be
suitable for storing  large quantities  of  toxic  chemicals.  Care must be taken
when sizing vents and inlet  and outlet lines  on these vessels.  The  vent
should be sized to accommodate the  maximum  possible flowrates into and out  of
the vessel.  To prevent  an  overflow from overpressuring the  tank, the vent
line and overflow lines must not rise more than eight inches above the side of
the vessel.  Rapid heating or cooling of these vessels can cause a rupture  or
collapse due to expansion or contraction in  the vapor space.

     Other storage vessel designs commonly  used  in the chemical industry may
not be appropriate for storing  toxic chemicals.   For example, because of vapor
loss, external floating roof tanks are probably not appropriate.
                                      177

-------
     The American Petroleum Institute has stated that corrosion  is  the prime
cause of deterioration in vessels  (14).  Because this deterioration is often
slow, it may  go  undetected.   The primary defense against  corrosion is the
selection of  the correct materials  of construction.  Very  rarely  will a
material be completely resistant to corrosion where  it  is being used.  In most
cases, an allowance for corrosion  is provided by increasing  the thickness of
the material.

     Protective coatings are often used to slow the rate of corrosion.  These
coatings should be used with care when  hazardous materials are involved. Very
thin coatings  (less than 0.75 mm thick) should not be relied on  for  corrosion
protection because coatings of this thickness may have very  small  flaws that
will allow  material  to contact  the  surface  below the  coating  (3).  Most
coatings are permeable to some chemicals.   When  a coated material is used, it
should be resistant  to all components to which  it  will be exposed.   If  a
coating is permeable  to  some  species in a mixture,  then this  species will
penetrate the  coating  and  contact  the  surface below.   Even if the permeable
species is not corrosive to this surface it  may  damage  the bond between the
coating and the  support  surface and ultimately  result  in  a  failure of the
coating.

     Vessels should be constructed to minimize crevices  and allow for complete
drainage, cleaning, and easy inspection.   The internals  of a vessel  should be
so arranged that all exposed surfaces can be  cleaned and so that liquid is not
held up when  the vessel  is emptied.  External corrosion can be reduced by
protecting all outer  surfaces  with a coating.  If insulation  is used, care
must be taken  to  seal  the  insulation so that moisture  does  not get in and
become trapped against the vessel wall.

     Care must be  taken when  dissimilar  metals  must be  contacted with each
other as galvanic  corrosion can  result.  The degree  to  which galvanic corro-
sion will occur will depend on  the metals  involved,  on  the area of  contact,
and on the electrolytic character  of the liquid contacting the metals.  Table
                                     178

-------
3-4 shows the  Galvanic  Series of Metals and Alloys.   The  farther apart two
metals appear on this table,  the more  susceptible  to  galvanic  corrosion they
will be when in contact with each other.  The American Petroleum Institute has
compiled a list of design recommendations to combat galvanic corrosion (21):

     •    Select combinations of metals as close together as possi-
          ble in the galvanic series.

     •    Avoid making combinations where the area of  the less  noble
          material is relatively small.  It is good practice to use
          the more noble metals for fastenings or for  other small
          parts in equipment built  largely of less resistant
          material.

     •    Insulate dissimilar metals wherever practical.   If com-
          plete insulation cannot be achieved,  materials  such as
          paint or plastic coatings at.  joints will help to increase
          the resistances of the circuit.

     •    Apply coatings with caution.   For example, do not paint
          the less noble material without also coating the more
          noble, otherwise greatly  accelerated attack  may be concen-
          trated at imperfections in coatings on the less noble
          metal.  Keep such coatings in good repair.

     •    In cases where the metals cannot be painted  and are
          connected by a conductor  external to the liquid,  increase
          the electrical resistance of  the liquid path by designing
          the equipment to keep the metals as far apart as  possible.

     •    If practical,  add suitable chemical inhibitors  to the
          corrosive solution.
                                     179

-------
               TABLE 3-4.  GALVANIC SERIES OF METALS AND ALLOYS
                     Corroded end (anodic, or least noble)
Magnesium
Magnesium alloys
Zinc
Aluminum alloys
Aluminum
Alclad
Cadmium
Mild steel
Cast iron
Ni-Resist
13% chromium stainless (active)
50-50 lead-tin solder
18-8 stainless type 304 (active)
18-8-3 stainless type 316 (active)
Lead
Tin
Muntz metal
Naval brass
Nickel (active)
Inconel 600 (active)
Yellow brass
Admiralty brass
Aluminum bronze
Red brass
Copper
Silicon bronze
70-30 cupronickel
Nickel (passive)
Inconel 600 (passive)
Monel 400
18-8 stainless type 304 (passive)
18-8-3 stainless type 316 (passive)
Silver
Graphite
Gold
Platinum
                    Protected  end  (cathodic,  or most noble)
 Source:  Reference 3.
                                     180

-------
     •    If dissimilar materials well apart in the series must  be
          used,  avoid joining them by threaded connections,  since
          the threads will probably deteriorate excessively.   Welded
          joints are preferred,  and the use of filler material more
          noble  than at least one of the metals to be joined.

     •    If possible, install relatively small replaceable sections
          of the less noble material at joints, and increase  its
          thickness in such regions.  For example, extra-heavy wall
          nipples can often be used in piping, or replaceable pieces
          of the less noble material can be attached in the vicinity
          of the galvanic contact.

     •    Install pieces (sacrificial anodes)  of bare zinc, mag-
          nesium, or steel to provide a counteracting effect  that
          will suppress galvanic corrosion.

Control Effectiveness—
     The control effectiveness of various vessel design factors  is measured in
terms of the reliability of vessel components.  Some reliability data related
to vessels are  summarized  in Table 3-5.  The  overall  reliability of  multi-
component control  measures  depends  on  the reliability of  the  individual
components and on the specific design or procedure.

Costs—
     Costs for each vessel control  measure are  summarized in Table 3-6, which
lists vessel hazards,  corresponding control  technologies, and both  typical
capital and total  annual  costs  associated with each control measure.  Costs
are in 1986 dollars.  Table 3-7  presents design bases for  the costs.

Case Examples (1)—
     A cylindrical LNG storage tank  ruptured  and discharged  its entire con-
tents over the plant and nearby  areas.   The LNG vapor ignited and an intense
                                     181

-------
            TABLE 3-5.  TYPICAL FAILURE RATES FOR VESSEL COMPONENTS

                                                        Failure Rate
Component                                              (Failures/Year)
Vessel shell                                                     ,
   Complete failure                                       3 x 10~
   Rupture equivalent to 6 inch opening                   7 x 10

Flanged head joint                                        N/A

Flanged nozzle piping connections, flange                 0.0026
   leak or rupture

Seam welds                                                N/A
Source:  Adapted from References 1, 23 and 24.
                                     182

-------
                                 TABLE 3-6.  VESSEL HAZARDS AND CONTROL TECHNOLOGIES
                   Costs represent incremental costs over the baseline system presented in Table 3-7.
                                                                             	(1986 Dollars)
Basis:
        Hazard
                          Control  Technology
                  Total Annual
Capital Cost ($)  Cost ($/Yr)
        General Failure
oo
        Flanged Joint Failure
        Welded Joint or
        Seam Failure

        Vessel Wall Rupture
Corrosion resistant materials.
Higher pressure rating.
Greater corrosion allowance.
Vibration control in attached piping
  systems, and on agitators.
Extra heavy foundations and extra
  support structures.
Fire protection.
Increased inspection frequency.
Pressure/temperature cycling control.
Adequate pressure relief.
Protection from external physical
  damage (curbing or barrier).

Correct flange/gasket combinations for
  intended service.
Full diameter, correctly torqued, and
  full circle bolting.
Leak monitoring.

Correct weld type and materials.
Correct weld procedure.

Double-walled vessel.
Wall thickness testing.
                                                                      30.000
                                                                      16.000
                                                                       6.000
                                                                         630

                                                                       1.500

                                                                    6.60/ft2

                                                                       9.500
                                                                         600
                                                                     6.00/ft
                                                                      17.000
                       5.200
                       2.800
                       1,100
                          55

                         280

                     0.60/ft'
                         800
                       1.400
                          50
                     0.50/ft
                         320

                         320

                       1.000

                         320
                         320

                       3.000
                       1.200
        Source:  Adapted from references 25,  26 and 27.

-------
                 TABLE 3-7.  DESIGN BASES FOR VESSEL CONTROLS
Vessel baseline - 10,000 gallon carbon steel pressure, storage vessel, 50 psig
rating, ellipitical heads.

Increased corrosion resistance - same as vessel baseline except 316 stainless
steel.

Higher pressur.e rating - same as vessel baseline except 100 psig rating.

Greater corrosion allowance - same as vessel baseline except 1/8" thicker wall
and heads.

Vibration control for attached piping - assume increase in piping supports
from one per 1A ft. to one every 7 ft. for 100 ft. of pipeline, 4 inch pipe.

Extra heavy foundations and extra support structures - Assume 50% increase in
cost over that required for baseline vessel, where cost for the vessel is
assumed to be 10% of the baseline vessel allowed, without any peripheral
equipment.

Fire protection - Assume the addition of a water deluge system over the
baseline vessels.

Increased inspection frequency - Assume an increase of 40 hours per year at an
hourly total labor cost of $20/hour.

Pressure/temperature cycling control - Assume the installation of a better
control loop somewhere in the process unit of which the vessel is a part.
Assume a conventional control loop.

Adequate pressure relief - Assume the addition of a 4-inch rupture disk to the
vessel.  The baseline vessel is assumed to already have a safety relief valve.

Protection from external physical damage - Assume the addition of vehicle
curbing around the vessel process area.

Correct flange/gasket combination - Assume increased supervisory labor at 8
hours per year and $40 per hour.

Full diameter, correctly torqued bolts, and full circle bolting - Assume
increased supervisory labor at 8 hours per year and $40 per hour.

Leak monitoring - Assume monitoring costs as primarily labor at an extra 40
hours per year at $25 per hour.

Correct weld type,  materials, and procedure - Assume increased supervisory
labor at 8 hours per year and $40 per hour.

                                                                (Continued)

                                      184

-------
                             TABLE 3-7 (Continued)
Double-walled vessel - Same basic specification as baseline vessel except with
double wall allowing for space between inner and outer wall.

Wall thickness testing - Assume inspection labor requirement at 40 hours per
year and $30 per hour.
                                       185

-------
fire burned at the plant, causing great  loss  of life and extensive  damage.
More LNG flowed from the plant as liquid  down  the  storm  sewers, where it  mixed
with air and  exploded.   Though the  cause of the  ruptures is  uncertain,  an
investigation concluded that the low carbon  steel  used in  the  vessel  construc-
tion may have been unsuitable and that failure may have  been caused by vibra-
tion or seismic shock.   The  final death toll was 128  and the number of injured
was estimated to be between  200 and  400.

     In another  incident, an estimated 30  tons of ammonia escaped  from a
ruptured anhydrous ammonia storage tank.   A  gas cloud 492  feet in diameter and
66 feet deep formed, killing 18 people both  inside and outside the plant.  The
cause of the  failure was brittle fracture of  the  dished  end  of  the tank.
Evidence suggested there  had  been no overpressure or overtemperature of the
tank contents,  and  no  other  triggering  event  was determined.   Ultrasonic
investigation of  the dished end  of  the  tank   revealed  numerous  subsurface
fissures,  perhaps caused by  progressive cold-forming  of  the  dished end.

3.3.4  Piping

     The term  "piping"  is used  here  to  describe  three closely  associated
categories of equipment:  piping,  fittings and valves.   Piping can be drawn,
rolled and welded, or cast.   Fittings  are used to connect various pipe  sec-
tions or connect pipe to  another piece of equipment, to change the direction
of flow, or to provide  a branch.  Valves  are used  to  regulate the flowrate or
direction of flow through lines.  Valves  use  a number of  different mechanism
to regulate flow.  Some  common varieties  include,  ball  valves, gate valves,
globe valves,  plug valves,  diaphragm  valves,  butterfly valves,  and check
valves.  Check valves  as a  control  technology  for preventing backflow have
been discussed in Section 2 of this  manual.  Materials of  construction for all
of these devices commonly include both metals  and  plastics.

     Piping failures may occur at the following locations:

     •    Piping wall (including fittings);
                                      186

-------
     •    Joints;

     •    Valve stems;

     •    Valve bodies;

     •    Internal valve mechanisms;  and

     •    A hose or hose connections.

Pipe Wall Failure—
     Piping can be  drawn,  rolled and  welded,  or cast.  Welded  piping is
fabricated with a welded seam running  the length of the pipe.  Welded seams
are subject to stress  corrosion cracking,  intergranular corrosion and  defec-
tive welds, which can  cause a pipe wall failure.   For toxic chemicals, seam-
less rather than welded piping is preferable.

     A pipe wall  is subject  to the  same failure modes as  a  vessel  shell,
including excessive stress.  Piping can be subjected to excessive stress by:

     •    Vibration;

     •    Misalignment; or

     •    Thermal expansion and contraction.

     Vibration can  be  a very destructive force  to process  piping.   For
example,  18-8 stainless piping subjected  to a  stress  of 30,000  psi  at  a peak
deflection failed after approximately  one million  cycles.   This same  pipe
subjected to a vibration frequency  of  60 cycles/sec,  failed from fatigue in
five hours (26).  Causes of vibration  include  periodic  mechanical  motion,
pressure  pulsation associated  with reciprocating machinery,  high-pressure  drop
across a  control valve  or unstable two-phase  flow conditions.
                                      187

-------
     Misalignment of pipe may result in failure by fatigue or in the formation
of stress  corrosion cracking.   Misalignment may  be  caused by  an  error in
installation of by  shifting  equipment.   Sometimes during  construction,  two
piping ends come together and are not  completely  in  line.   These out of line
ends are usually forced into position.  Forcing the  pipes  into  position will
subject them to a stress probably unanticipated in the original design  speci-
fications.  This unanticipated stress can  result  in  premature pipe  failure.
Even if the initial installation was done  correctly,  equipment  can settle or
poorly placed foundations and stress a pipe  run in  the same way as  would a
misaligned pipe. Broken or defective anchors and  hangers  can create stresses
on a pipe run that can result in premature  failure of the  pipe.

     Thermal expansion and contraction that is not properly  accounted  for in
the initial design  can cause  internal  stress.   Even if the  original design
provided for thermal expansion,  broken or defective  sliding saddles or rollers
could cause excess  stress during expansion and  contraction.   In addition to
stress caused by  thermal  expansion,  repeated thermal temperature cycles  can
result in failure caused  by thermal  fatigue.

     Piping is often insulated.  Moisture can get trapped beneath the insula-
tion and cause external corrosion.   Piping  will be particularly  susceptible to
this near joints and fittings where it is difficult to ensure a good seal for
the insulation.   The potential problem of atmospheric corrosion under insula-
tion applies for all insulated equipment.  It is  discussed here under process
piping because piping systems are often complex and  it is  difficult to monitor
all portions of the piping system for corrosion problems.

Pipe Joint Failure—
     Some of the  potential  failure  modes for pipe joints  were  discussed in
Subsection 3.3.A on vessels.

     Most flanges  are  attached  to  the end  of  a  pipe in  the form  of  a
flanged-end fitting (a few varieties of pipe may  be  purchased as  flanged-end
pipe).  Some types of flanged-end fittings  have a  weaker tolerance  for cyclic
                                      188

-------
stress loads  than  the piping  to  which they are joined.   These varieties
include  slip-on,  socket-welded,  and  lap-joint  flanges.   Subjecting  these
flanges to cyclic stresses may  cause  an  unanticipated  failure.   Flanges may
fail as a result of  thermal  shock.  Flanges must be made of a heavier gage of
metal  than  the surrounding pipe  because  they  may  be more susceptible to
thermal shock cracking than  the surrounding pipe. Selecting flange bolts with
inappropriate strength and corrosion  resistance can lead  to  a flanged joint
failure.

     Pipes can be joined  by  welding.   One variety of  welded joint is  the
socket-weld joint, which  cannot resist bending stress  as  well  as  the pipe
which  it  joins.   This joint may  fail prematurely  under bending stresses.
Additionally, a crevice between the two pipe ends is formed  in  a socket-weld
joint.  Liquid can enter  this  crevice and  result  in  corrosion.  A second
variety of welded joint  is the butt-weld joint.  For most types of piping,
this joint is as strong as the  pipe to which it  is  joined and may,  therefore,
be preferred for toxic chemicals.   The exception is where a butt-weld  joint  is
used to connect work-hardened pipes annealed by the welding  (3) .   All vari-
eties of  welded pipe can fail because  of  sloppy  welding.

     A threaded joint can be  used  to connect pipe sections.  A threaded joint
is not as strong and resistant  to  fatigue as the pipe it is joining.   Threaded
joints have  other  disadvantages.  Turbulence will form  at the  contraction
caused by a threaded joint.  This turbulence can contribute to corrosion at a
point where the pipe is already thinned by  threading.   A threaded  joint may
keep its  seal even after most of the threads or  pipe wall are destroyed.   Such
a joint may fail completely before any leakage  occurs and before any external
decay is detected.   Threaded joints can be  crushed by  the force of the pipe
wrench used to tighten the joint,  which will weaken  the connection  and possi-
bly result in  later  failure.   A threaded  joint  can  loosen when  subjected to
torque.  Such torque  could be caused by thermal  expansion or  contraction  or by
shifting  equipment.   A loosened joint  may  not seal completely and may  not  have
as much resistance to stress  as a  tight joint.
                                      189

-------
Valve Stem Failure—
     A common source of leaks in a piping system is valve stems.  Most valves
are constructed with some type of packing material  around the valve stem that
allows the  valve stem to  rotate  while preventing the  process  fluid from
escaping around the stem.  Exceptions are diaphragm valves where  the process
liquid is separated from the  stem by the diaphragm and ball valves where face
seals are used..  Valve packings are made of  a  number  of materials including
plastics, metals, and metal composites.   Because  the valve packing experiences
wear every time the valve is opened or  closed,  it is usually  the weakest  point
of the piping system and will be  the first point to  fail in  the event of an
overpressure.

     Leaks around a valve stem are frequent but are rarely serious unless the
leak results in a fire or explosion.  It is possible to  tighten  the packing  to
stop a leak when the valve  is  in operation.  However,  the  life  of valve
packing and the number of times  that  the packing  can be  compressed is limited,
requiring periodic replacement.   A valve packing  failure on a very large  valve
might be sufficient to discharge a significant amount of  toxic  chemical, but
in most cases a  release from  a valve steam blowout would not be catastrophic.
Leakage around valve stems could indirectly lead  to major equipment or process
failures, however.  For example, small  amounts of  leakage  over  a  long period
of time could result in corrosion  that  makes the valve  inoperable.   Such a
failure at a critical time in a critical line could lead to a major equipment
or process failure.

Valve Body Failure—
     The failure of a valve body would  be comparable  to a pipe  failure,  and
could occur for the same reasons;  excessive stress, corrosion or erosion.

     The effect of  excessive stress  is of special  concern with  valves.   Valve
bodies are constructed in irregular shapes that  may not withstand bending or
twisting stresses.  Where valves consist of two or  more  pieces forming a  body,
the seal between the parts is a weak point,  especially  if the assembly bolts
                                     190

-------
are improperly tightened.  Overstressing could also  occur  in the body parts
themselves  if  not  joined properly to the piping.  A valve that is rapidly
closed will experience a tremendous surge in pressure.  This surge is  known as
a  "water-hammer11  or "hammer blow."   This  surge  in pressure  can  result  in
failure because  of overpressure of  the  valve body,  of the  pipe-to-valve
fittings, or of the pipe near the valve.

     Since  valves  disrupt  the fluid  flow,  considerable turbulence occurs,
which can contribute to erosion.

Internal Valve Mechanism Failure—
     The potential  cause of  failure  of an internal valve mechanism depends on
the type of valve.  Basic types include:

     •    Gate valves;

     •    Globe valves;

     •    Plug valves or cocks;

     •    Ball valves;

     •    Diaphragm valves; and

     •    Check valves.

A  failure of  the  internal  valve mechanism can result  in low  flow  or  excess
flow with all their attendant hazards (see Section 2  of this manual).

     A gate valve is composed  of a body containing a gate that interrupts the
flow.   The valve is normally used in the  fully open or fully closed positions.
Gate valves must usually be  constructed  of metals, which  could  limit their
usefulness in some corrosive environments.
                                      191

-------
     When handling high-velocity flow of dense  fluids,  the  gate  assemblies  can
shake violently.  This vibration can result in failure of  the gate  assembly,
the valve body or the attached piping and equipment.  Gates have been known to
fall off gate valve stems (27).

     Some portion of the stem on a gate valve must be exposed to  the process
fluid.  For some varieties the threaded portion of the stem is exposed.  This
could result in corrosion or erosion of the stem.   Liquid entering the bonnet
of this valve when it is opened can be trapped  in  the bonnet when  the valve is
closed.  Thermal expansion or contraction could rupture the bonnet.

     Globe valves  are  commonly used to regulate  fluid flow.  The valve is
composed of a disk  (or  plug)  that  moves  axially to seat  in the valve  body.
These valves have a  large pressure  drop  and can be the source of  vibrations.
In most designs  the disk is  free  to  rotate on the stems,  which  prevents
galling between  the  disk and the seat.  However,   the ability to  rotate can
result in a tilted  and  misaligned  disk on closure and the  disk on  a  globe
valve can detach from the stem.  Process  fluid solids, scaling, or  corrosion
of the seat of disk can result in an inadequate seal.

     A plug valve is composed  of a  tapered  or  cylindrical  plug  fitted  snugly
into a seat in the  valve body.   When  in  the open  position, the plug has  an
opening in line with the flow openings in the valve body.   A plug  valve can be
constructed from metals, coated metals, or plastics.

     The surface area between  the plug and the valve body is large, which can
make the plug difficult to rotate.   Some types  of  plug  valves  use  a lubricant
to act as a seal and to allow the  plug to be more easily rotated.  A common
way these valves can fail is by seizure of the  plug.  Temperatures above 500°
can cause differential  expansion between the plug  and  the  body  and  result  in
seizure.  A loss  of lubrication between  the plug and body can result in
                                      192

-------
seizure.  Seizure of  the  valve could contribute to an accidental release if
the inability to open or close the valve results in a loss of  control  of  the
process.  An opposite problem is that a small plug valve could  vibrate  open  or
shut if the  fit  between the plug and valve  body  became too loose (through
wear, for example).

     Plug valves can trap a  small quantity of  the process  fluid in the plug
cavity whenever the valve is  closed.  If the process fluid has a high coeffi-
cient of  thermal expansion,  this trapped fluid could result in a ruptured
valve if  it  were heated.  An  example  of such a fluid  is  liquid  chlorine.
Since water  expands as  it freezes,  this  could  also occur with  water  that is
frozen when  trapped in  the valve.   Some  valves have a bypass built into the
plug, which  relieves the plug  cavity to  the  high  pressure  side of the valve
when it is  closed.   As  long as  the  relief bypass  does  not become plugged.
these valves solve the  fluid  expansion problem.   These  valves  are unidirec-
tional and are likely to leak if installed backwards.

     A ball valve is similar to a plug valve except the  plug is in the  shape
of a ball.   Plastic seats are  used  to  seal the ball.  Though not  as  prone to
seizure as plug valves, ball valves  can  seize  as  a result  of thermal expan-
sion, corrosion or fouling.   The ability  of  a  ball valve to seal depends on
the performance of  the plastic seals.  Thus,  once  these  seals  are  damaged or
worn, the valve  could fail to function  properly.   Ball valves are usually
constructed of metals, which could limit their usefulness  in some corrosive
environments.  A ball valve also has the same  disadvantage as a plug valve in
trapping process material  in the ball when  the valve  is  closed.   Again,
unidirectional ball  valves are available with  a vent  from  the  ball cavity to
the upstream side of the valve to prevent liquid entrapment.

     A diaphragm valve  is usually  a packless valve composed of a  diaphragm
made of a flexible material  which functions as both a closure  and a  seal.   A
compressor mechanism closes  the valve by  forcing the diaphragm  against  a  seat.
Failure of the diaphragm can result  in  the leakage of the process  fluid  around
the stem,  since some varieties of diaphragm valves have no packing around the

                                     193

-------
stem.  A diaphragm rupture in a packless valve could  result  in  a significant
release of a toxic chemical.

     A butterfly valve is composed of a  disc  mounted  on a stem  in  the flow
path.  A 90  degree  turn of the stem changes  the  valve from closed to com-
pletely open.  The butterfly  valve forms a complete seal around  the perimeter
of the pipe.   However,  minor corrosion or erosion of  the  disk  and  seal  may
cause them to not seal properly.  The presence of solid deposits around the
sealing surface also may prevent a tight seal  upon closure.

     A number of varieties of check valves  are  available.   Common varieties
include  swing,   lift  (piston  check or  ball  check).  tilting-disk or
spring-loaded wafer-type check valves.   Check  valves  are also discussed under
backflow prevention in Section 2 of  this manual.

     The common varieties of  check  valves vary slightly  in their  mode  of
action; however, they all  incorporate  certain common features necessary for
their performance.

     Successful function of all check valves  depends on a  reliable  seal.  The
two surfaces that form the seal must  remain clean and  smooth.   The sealing
surfaces could be marred by corrosion,  erosion,  and solids  in the fluid stream
that could lodge between the  sealing  surfaces and prevent a  complete  seal.
The portions of a check valve that form the seal have  a coefficient  of  thermal
expansion typically 24 to 45  % greater then  that  of  cast  or forged carbon
steel  (4) .   This  could  cause unequal thermal expansion of portions of the
valve and prevent a tight seal.

     All common varieties of check valves have moving  parts  that must  remain
flexible and function under the influence of slight pressure changes.  Corro-
sion, solids in  the  fluid  stream, or formation of scale or  polymer buildup
could prevent these moving parts  from  operating  correctly.  Corrosion could
also weaken springs and prevent valve  closure.
                                     194

-------
 Hoses and Hose Fittings—
     Hoses are a  frequent  source  of leaks and may result in large releases..
Two common causes  of  hose failure are physical wear  and poor connections.
Because hoses are usually  applied  for intermittent use or quick connection, a
release can result from an incorrectly attached hose.   Threaded hoses could be
incorrectly secured by  only  a few threads, by different thread types incor-
rectly combined, or by the attachment made with a gasket missing.

     A release could result  from  the use  of  a hose-to-end  connection that is
not strong enough.  An example would be the use of a  clamp  or  metal  compres-
sion band connection of the  type  used to  attach automobile  hoses.  These are
not suitable for use with toxic materials.

     An operating error could result in an accidental  release from  a  hose that
is disconnected before the line is properly isolated  from the process.

Release Prevention Controls for Piping—
     The American National Standards  Institute has published  standards  for
chemical plant piping. ANSI  standard B31.3 applies to most  of  the piping that
would be present at a  facility  handling  hazardous chemicals.  The standards
prescribe minimum  requirements  for the materials  of  construction, design,
fabrication,  assembly, support,  erection,  examination, inspection,  and  testing
of piping systems subject to  pressure or vacuum.

     Where possible, seamless piping should be  used for  hazardous  chemicals.
All joints should be either welded or flanged and threaded  joints and fittings
avoided.  As far  as  possible, all joints  should  be  butt-welded.   Properly
done, this provides joint  strength  equivalent  to  the  original  pipe.  Flanges
should be used only where a removable joint is necessary.  If a threaded  joint
or fitting must be  used,  then it  should  be  seal-welded.  Because  of their
superior strength, welding-neck flanges may be  preferred over  other  kinds  of
flanges.  An exception  must  be  made for  some  kinds of coated or specialty
piping that can only use lap-joint flanges. The potential for cyclic stresses
should  be  considered  when  an  alternate kind of  flange  (other  than
                                      195

-------
welding-neck) is  used.   Flange bolts must  be consistent  in  strength and
material of construction with the design requirements of the system.

     Metal-polyfluorinated ethylenes and metal-graphite  spiral-wound gaskets
should be used instead of metal-asbestos gaskets where hazardous chemicals are
involved.   These  gaskets  will often  provide  a  better  seal  than  the
metal-asbestos -type.  A metal-ring-joint facing may  sometimes  be  preferred
over a conventional gasket.  In the event of a fire,  this type  of seal is less
likely to leak.   The  sealing  surface is  less  likely  to be  damaged  in  handling
than a conventional gasketed  seal.  The  metal-ring-joint facing can be more
resistant to the fluid being handled than a conventional gasket.  This type of
seal is more difficult  to disassemble  because the flanges  can  be  separated
only in the axial direction.

     As shown in  the  previous  sections,  stress  is  a  common failure mode  for
all portions of  a piping system.  The potential for  stress-related  failures
can be reduced by proper design.  Some considerations are:

     •    Shorten connections to reduce bending moment and raise the
          fundamental  frequency of  vibration  (destructive  fre-
          quencies tend to be less than 60 cycles/sec).

     •    Use pulsation dampeners where applicable.

     •    Provide engineered anchors and braces.

     •    Account for the potential for two-phase flow conditions by
          providing extra bracing.

     •    Use pipe  loops  to  control  movement  and vibration at
          equipment connections.   Avoid the  use of  bellows where
          hazardous materials are involved.
                                   196

-------
     •    Allow for thermal expansion by using sliding supports.

     •    Do not  support a valve body  and use it to  support  the
          attached piping  but support  the attached piping  sepa-
          rately.

     •    Do not allow a vessel or pump fitting  to  support attached
          piping but support the attached  piping separately.

     •    Consider  the   destructive  force  of  "water-hammer"  or
          "hammer blow"  when installing automatic valves.  Valves
          should not  be  allowed to  close  more  rapidly  than the
          system can tolerate.

     •    During installation or  repair,  do not force piping  ends
          into alignment.  This creates extra stress not planned for
          in the original piping design.

     •    Use a  heavier  grade of flange  than  required by typical
          practice.

     A discussion of  the applicability  and design of each valve type for use
where hazardous materials are involved is  presented below.

     For reasons  discussed previously,  it may  be preferable to  avoid  gate
valves when using hazardous materials.

     Although globe valves have  several  drawbacks,  they  are usually the only
alternative when automatic  flow  control is  required.  When globe valves are
used, they should be  designed with  built-in precautions  to prevent misalign-
ment of the disk with the  seat.  Such precautions could include  guides  above
and below  the  disk  or using a spherical  seat.   Large globe valves  must  be
installed with the stems vertical.
                                      197

-------
Valves should be installed with the high-pressure side connected to the top of
the disk.  This would result in the valve closing if the disk were to separate
from the stem.

     Plug valves and ball  valves probably provide the most reliable form of
off/on flow control.  However, care must be taken to  select  a valve with the
appropriate overpressure protection where materials with high coefficients of
expansion could be  trapped and heated or  frozen in the valve  when it  is
closed.  To ensure adequate sealing, ball valves should be  of the fixed ball
variety with spring-loaded seats.

     Diaphram valves are well-suited  for applications where a high level of
solids are present in the process fluid.   If solids  are not a concern, it may
be advisable  to avoid  using diaphragm valves.   If the diaphragm fails,  then
the valve  will leak with  little or  no  constriction.  These valves  are
generally limited to low pressure applications  and probably should not be used
anywhere near their rated maximum pressure.  If  they  are used they should be
equipped with packing around the stem.

     If there is any potential for corrosion, erosion  or fouling,  and  if the
system operates  at anything  other  than  moderate pressure,  then  butterfly
valves should be avoided.

     Whenever possible, hoses should not  be used where hazardous materials are
involved, although in some operations it  may be impossible to eliminate  them.
Each hose should be designed  to  withstand  the  conditions  to which it will be
subjected.  They should  be joined to end connections  that  can  be  securely
fastened to form joints with  other piping.  Where more than one type of hose
is in use, each variety of hose should use a different type of end  connector.
The corresponding connectors should only be installed at the process equipment
locations where each hose  may be used.  This will  help  prevent the use  of
hoses in applications for which they were not intended.
                                      198

-------
     The above discussion has focused on the  individual  elements  in  a piping
system.  The following discussion lists  some design considerations for overall
piping systems handling hazardous materials.

     •    Avoid dead  ends  or unnecessary and  rarely  used piping
          branches.   Minimizing piping will reduce the potential for
          operating  errors.  Rarely used piping  tends to be  neg-
          lected.  Process  materials can become trapped in dead ends
          and result in corrosion, plugging, or unwanted mixing with
          future incompatible process material.

     •    Take precautions  against  liquid  holdup.  All  pipe  runs
          should be  pitched to allow liquid to drain.   Drains  should
          be at the  lowest  point  in the system.   Often this is not
          the case when piping is installed or when future  changes
          are made.   Provisions  should be made to prevent a liquid-
          full condition in  a blocked section of line.  A liquid-
          full condition can result  in a pipe rupture  if the liquid
          expands  as it warms or cools to ambient temperatures.

     •    Minimize locations in  main arteries  outside  high-integrity
          block valves.  This decreases  the likelihood  of a  main
          artery leak where rapid isolation could be more difficult.

     •    Bottom drain lines on  vessels  handling large volumes of
          hazardous  materials should be  limited  in  diameter.   This
          will limit the rate of material release in the event of a
          failure  in drain  line  valves.   A  flow limiter valve which
          automatically closes  if flowrate  exceeds a prescribed rate
          can also be used.  Drain lines should  always be equipped
                                      199

-------
          with two valves in series.  A remotely operated emergency
          isolation valve may be appropriate.

     •    The line and valve sizes  into and  out  of a vessel should
          be of the same  capacity.   If  the  inlet  line has a higher
          capacity than the outlet,  then an  overflow is inevitable
          once control is lost.

     •    Piping systems  should never  be  designed  so  that the
          failure of a single valve will result in a significant
          accidental release.

Control Effectiveness—
     The control effectiveness  of various piping  design considerations  is
measured in terms of the  reliability of piping system components.  Some reli-
ability data are summarized in Table 3-8.  The overall  reliability of multi-
component control  measures  depends  on  the  reliability  of  the individual
components and on the specific system design or procedure.

Costs—
     The costs for each control measure applicable  to piping are summarized in
Table 3-9,  which  lists piping hazards, corresponding control  measures,  and
both typical  capital  and total annual  costs associated with  each control
measure.  Table 3-10 presents  the  design bases for  these costs.

Case Examples (1)—
     Dead-ends in pipes can be the  source of pipe  failure when water  collects
in the  dead-end and  freezes,  breaking the pipe,  or when corrosive  matter
dissolves in the water and corrodes  the line.  In  one case, water and impur-
ities collected in  and corroded a  dead-end  branch of  a  12-inch  diameter
natural gas pipeline  operating at  a gauge  pressure of 550 psi.   When the
dead-end failed, the escaping gas ignited immediately,  killing three  men  who
were looking for a leak.
                                     200

-------
            TABLE 3-8.  TYPICAL FAILURE RATES FOR PIPING COMPONENTS
Component
 Failure Rate
(Failures/Year)
Pipe wall, under 3 inches diameter rupture
           over 3 inch diameter, rupture
Flanged joint, leak or rupture

Gasket leak

Welded joint, leak

Valve casing

Valve stem seal

Manual valve
   - failure to operate
   - failure to remain open  (plug)
   - leak or rupture

Solenoid valve - failure to operate

Automated valves
   - failure to operate
   - failure to remain open  (plug)
   - leak or rupture

Check valves
   - failure to open
   - reverse flow leak
   - rupture
   8.8 x 10
   8.8 x 10
   0.0026
        -6
        -7
           ,-5
0.026

2.63 x 10

N/A

N/A
   0.365
   0.0365
   8.8 x  10~5

   0.365
   0.1095
   0.0365
   3.65  x  10~6
   0.0026
   1.10 x  10~4
   8.8 x 10~5
Source:  References 23, 24 and 28.
                                     201

-------
                       TABLE 3-9.   EXAMPLES OF  PIPING HAZARDS,  CONTROL TECHNOLOGIES.  AND COSTS
           Basis;   Costs represent incremental  costs  over the baseline system presented in Table 3-10.
                                                                                     (1986 Dollars)
           Hazard
   Control Technology
Capital Cost ($)
Total Annual
Cost ($/Yr)
        General Failure
Ni
o
N>
        Flanged Joint Failure
        Welded Joint Failure


        Pipe Wall Rupture


        Valve Failure
Corrosion resistant materials.                 16,000
Higher pressure rating.                         2,500
Greater corrosion/erosion allowance.           23,000
Monitoring/extra supports.                        630
Vibration control.                                630
Thermal expansion allowance.                      750
Heat tracing per 100 ft. of line for            1.000
  freeze protection.
Fire protection.                                  200
Increased inspection frequency.                   —
Additional piping supports.                       630
Avoidance of long unsupported piping runs.        —
Pressure/temperature cycling control.           9,500
Valve selection.                                  —
Control of "hammer blow."  (Valve                 500
  closure rate control)
Protection from external physical damage.          60

Correct flange/gasket combination for             —
  intended service.
Full diameter, correctly torqued, and             —
  full circle bolting.
Installation/maintenance supervision.             —
Leak monitoring.                                  —

Correct weld type and materials.                  —
Correct weld procedure.                           —

Double-walled pipe.                             7,500
Wall thickness testing.                           —

Installation/maintenance supervision.             —
Correctly sized and torqued body holding.         —
                       2,800
                         430
                       4,000
                       1.000
                          55
                          65
                         200

                          30
                         800
                          15

                       1,400

                          90

                           5

                         320

                         320

                         320
                       1,000

                         320
                         320

                       1,300
                       1.200

                         320
                         320
        Source:   Adapted from References  25,  26  and  27.

-------
              TABLE  3-10.   DESIGN BASES  FOR  EXAMPLE  PIPING  CONTROLS


 Piping baseline - 100  ft.  of  4  inch.  Schedule  40, carbon steel  piping with
 average number of fittings.

 Increased  corrosion resistance  - Same as  piping baseline except 316  stainless
 steel.

 Higher pressure rating - Substitute Schedule 80 for  Schedule  40.

 Greater corrosion/erosion  allowance - Substitute Schedule  80, 316 stainless
 steel for  Schedule  40, carbon steel.

 Vibration  control - Assume an increase  in piping supports  from  one per 14 ft.
 to one every  7 ft.  for 100 ft.  of pipeline.

 Thermal expansion allowance - Assume  addition  of an  extra  loop  of 10 ft. of
 piping to  the baseline.

 Heat tracing - Assume electrical wrap heat  tracing added per  100 ft. of
 baseline piping.

 Fire protection - Assume fireproofing added to baseline piping.

 Increased  inspection frequency  - Assume an  increase  of 40  hours per year at an
 hourly total labor  cost of $20/hour.

 Pressure/temperature cycling control  - Assume  the installation of a better
 control loop somewhere in the process unit of which  the piping is a part.

 Valve selection and  control of  "hammer blow" - Assume substitution of
 different valve type.

 Protection from external physical damage - Assume 10 ft. of curbing placed
 around pipe bridge supports.

 Correct flange/gasket combination - Assume increased supervisory labor at 8
 hours per year and $40 per hour.

 Full diameter, correctly torqued bolts,  and full circle bolting.  Assume
 increased supervisory labor at 8 hours per year and $40 per hour.

Leak monitoring - Assume monitoring costs as primarily labor at an extra 40
hours per year at $25 per hour.

Correct weld type,  material,  and procedure - Assume increased supervisory
labor at 8 hours per year and $40 per hour.
                                                                 (Continued)


                                      203

-------
                            TABLE 3-10 (Continued)
Double walled pipe - Same basic specification as baseline piping except with
double wall allowing for space between inner and outer wall.

Wall thickness testing - Assume inspection labor requirement  at  40 hours per
year and $30 per hour.

Installation/maintenance supervision - Assume increased supervisory labor at 8
hours per year and $40 per hour.

Correctly sized and torqued body  bolting - Assume increased supervisory labor
at 8 hours per year and $40 per hour.
                                    204

-------
     In another incident, at a pumping station on a liquid propane pipeline a
sudden increase  in throughput indicated  a  major line break.  The pipeline
failure occurred on high ground and the gas flowed  down a sparsely inhabited
valley, which was evacuated.  The cloud ignited in a sudden flash, creating an
overpressure and a fire storm which rolled up the hillside to a highway.  The
pipeline pressure was believed to  have been about 942 psig,  and the amount of
liquid propane estimated  to have escaped in  the first  24 minutes was  750
barrels.

3.3.5  Process Machinery

     Process machinery is process  equipment that contains moving  parts and is
used to physically treat, handle, or modify process streams.   Examples include
pumps, compressors, agitators and refrigeration units.  The discussion in this
section focuses  on  features common to most  types of  process machinery  and
highlights  some  design  considerations for  pumps and  compressors.  Process
machinery failures may contribute to accidental releases by directly  releasing
a toxic chemical  contained  therein,  or by  causing  a  process upset .that  in-
directly leads to a release elsewhere in the process system.

     Direct releases from process machinery may  occur at  the following  loca-
tions:

     •    Rotating shaft seals;

     •    Machinery casing;  and

     •    Machinery attachments.

     Causes of releases at  these locations  are discussed  below.   Erosion and
corrosion are not  discussed in  any detail  since these  conditions have been
discussed in the previous sections of this manual.
                                      205

-------
Rotating Shaft Seals—
     Process machinery comprises both rotating and reciprocating equipment.   A
seal is required wherever  a  rotating or reciprocating  device  contacts the
process fluid.  Seals include ring seals on pistons in reciprocating compres-
sors and rotating shaft seals.  Rotating shaft seals  are  far more common in
the process plant,  and only these are discussed further.  Two methods used to
make this type of seal  are a "packing" or "stuffing" box,  or a mechanical
seal.

     The seal is made  in  a stuffing box by wrapping  the  shaft in a  woven
material and  enclosing the wrapped  section in a box to hold the packing  in
place.   The advantage of a stuffing  box is  that the packing is  inexpensive and
may be easily replaced.  The disadvantage is  that a packing  box does not  form
a complete seal.  At high speeds a packing  box must leak to allow for lubrica-
tion between the shaft and the packing.  These devices are not usually appro-
priate for use with toxic  materials.

     A mechanical seal is a prefabricated assembly  that forms  a running seal
between flat, precision-finished surfaces.  A  mechanical seal can leak because
of wear, incorrect  installation, erosion, or  system overpressure.  A mechani-
cal seal depends  on a precise contact of the  two sealing surfaces.  A scored,
corroded or  in  any  way deformed  shaft  can result in a seal failure.   The
presence of solids  in the pumping fluid can destroy the integrity  of  a seal,
which is more of a  problem when pumping gases with solids than liquids with
solids.

     A seal  that is  not  properly installed can fail; all  components  of the
seal must be precisely aligned.  Most older pumps were  designed for  stuffing
and the stuffing box may not be big  enough to accommodate the seal.   A seal
installed with too  small a clearance could fail because of overheating (29).
Even a  properly  installed seal will  fail  eventually as  a result of wear
between the sealing surfaces.
                                      206

-------
Machinery Casings—
     A release from a machinery casing may be caused by  stress,  corrosion,  or
erosion.

     There are both  internal  and external sources of  stress  on a machinery
casing.  An  internal  source of stress would  be  overpressure  of the process
fluid.  External sources  of stress  include vibration, unsupported weight  of
attached piping, or  improperly torqued,  especially overtorqued. bolting that
holds casing parts together.  These stresses can cause deformation or cracking
of the casing.

     Corrosion and erosion may be caused by  many  of the factors listed  in
previous sections.   A pump  or compressor casing is particularly susceptible to
corrosion and erosion  because of the  high velocity and  turbulence  of the
fluid.  The  presence  of solids can result in significant wear  on the  casing
and the internals of the pump or compressor.  The combined action of corrosion
and erosion can significantly reduce the life of a casing.

     The casing  on  positive  displacement  pumps and  compressors can  fail
because of flow  blockage  at the discharge (deadheading) or flow blockage at
the inlet  (resulting  in cavitation).   Deadheading will  result  in an  over-
pressure,  and if not relieved, can cause a ruptured casing.

     The casing on  centrifugal pumps and compressors can also fail because  of
flow blockage at  the discharge. The  liquid  or gas trapped in  the  pump or
compressor will be heated  if  the  device  is left  running after  the discharge
has been blocked.  This heating can cause thermal decomposition of the process
fluid or thermal expansion if both the inlet and discharge are  blocked.  Both
may result in an overpressure and failure of the casing.

     Cavitation can result  in  vibration,  erosion,  and overheating resulting
from the  formation  and collapse  of vapor cavities  in the liquid at  the
metal-liquid interface.  Impellers are most frequently affected by cavitation;

                                    207

-------
however, damage to an impeller can cause excess  vibration,  which can result  in
a failure of the casing.

     The forces that can  cause the failure of a machine casing  can  cause the
failure of a machinery attachment.  Process machinery is often  the  source of
most of the vibrations in a process.   This vibration is  often amplified as it
is transmitted to piping  and supports  and can  be very destructive.

     Some machinery attachments may fail because of  neglect,  abuse or improper
design.  A pump  case  drain line will usually require a  long nipple before
mounting the drain valve.  An excessive  force  (operator  standing on  the drain)
may break the  line.  Sometimes the machine attachments provided by the manu-
facturer will be improperly designed for  the  specific  application for which
the machine is being  purchased.   A compressor,  pressure relief  device that
comes attached to a compressor should  be carefully evaluated.  Unless.specif-
ically communicated, the assumptions  under which  the manufacturer sized the
pressure relief may not  be compatible with the requirements  of the actual
process.

Process Machinery Failure Prevention Controls—
     Stuffing or  packing boxes may not be appropriate  for toxic chemicals
because these devices do not  form  a tight  seal  and  small  amounts of liquid,
vapors, or gases are released  during normal operation.  Enclosing the  pump in
a ventilated enclosure connected to a  control  device (such as a scrubber) may
be possible but may not be an acceptable alternative in  many  situations.

     A properly installed single mechanical seal  will  typically operate for
about a year without any  detectable release of material  (29).   A seal can fail
prematurely for any number of  reasons,  and for  toxic chemicals, any failure
may be considered unacceptable.  A number of levels  of control can be achieved
by altering the seal design.   Seal performance  might be  improved by using a
larger seal, which will  result in  a longer wear life.  A cartridge seal  comes
preassembled and may be  used to avoid  some  of  the  potential installation
                                     208

-------
errors of standard seals.  A bellows seal  is  a mechanical seal designed in a
way that  reduces the potential  for  seal plugging over conventional  spring
designs.

     The most effective method  for controlling accidental releases  from mech-
anical seals is to use two seals.  Further protection may be added by using  a
sealing fluid between the  two  seals.   Where hazardous materials  are  involved,
the sealing  fluid must  be compatible with the process  fluid and it may be
necessary to monitor the sealing fluid for the presence of the process fluid.

     In addition to seals, there are many other specific design considerations
for pumps  and compressors which are  discussed in the remainder  of this
subsection.

     Some kinds of pumps do not require  mechanical seals  and are less suscep-
tible to failures that  might directly result  in an accidental  release.  A
canned-motor pump is  designed  so that the motor  rotor  and pump  casings are
interconnected;  the motor bearings run in the process liquid and all seals are
eliminated.  Eliminating  the  seal reduces the potential  for an accidental
release from these pumps.  Because the motor is exposed to the process  fluid,
their use  is restricted to nonabrasive  and relatively  noncorrosive fluids.
Repairing these pumps may require employee exposure  to  the pumping fluid and
thus they may not be suitable where toxic materials are involved.

     A diaphragm pump is another type that does not employ a mechanical seal.
This pump uses the  reciprocating action  of a flexible diaphragm to move the
process fluid.  A diaphragm pump can be mechanically or pneumatically driven.
The advantage of  this  type of pump is that only  the diaphragm contacts the
liquid.  The disadvantage is that  eventually  the diaphragm will break  as  a
result of wear or overpressure.  If these  pumps are used  for toxic materials,
precautions must be  taken  to  avoid an accidental release when a diaphragm
fails, which can be  accomplished by totally enclosing the  pump  in a ventilated
enclosure;  the vent  gas  going  to a control device.   An  alternative  is  to
connect just the nonprocess side of the  diaphragm to a controlled  vent.  The
                                      209

-------
pumping system design must account  for the potential  of  explosive mixture
formation when a diaphragm ruptures  on a pneumatically  actuated pump.

     A final variety of  sealless  pump is one where the  impeller and motor are
linked magnetically.  The impeller is totally  enclosed  and leakage is  possible
only by failure of the impeller casing.  These pumps are  generally used only
for very small, low pressure  pumping operations.

     Overpressure protection is  important  for pumps and  compressors.  The
potential for deadheading a positive displacement pump  can be reduced  by using
a pump return loop which  connects the discharge  directly to the  intake and
allows liquid to continue to circulate when flow  is stopped downstream  of the
pump loop.  The  loop  should  be sized  to accommodate the minimum flowrate
required by the pump.  The danger of using  a pump return loop is that  the loop
creates a  route  for potential backflow  when  the  system  is shut-off.   A
system's design must provide sufficient backflow  protection  in  such a situa-
tion.

     Where hazardous materials are  involved,  pressure  relief from pumps and
compressors must be piped to a total containment  system.   The  backpressure
created by the containment system must be accounted for in sizing the  pressure
relief device.

     It may  often  be  appropriate to  install  remotely  controlled  emergency
isolation valves at the  intake and discharge of a  pump  or compressor  that is
handling a  hazardous  material.  This combined with a  remote pump shutoff
switch allows flow to be  stopped  in  the event  of an accidental release from
the  pump  or compressor.   Where two  pumps  are parallel,  an  alternative or
addition to the above  recommendations would be to add the ability  to  remotely
switch from one pump to  the other.

     Care must be taken whenever  encasing  a pump or compressor  in a  vented
enclosure.   While   providing some  accidental release  protection,  such
                                     210

-------
 enclosures  can be a  trap for flammable  mixtures.   To avoid  this,  vented
 enclosures  should  be  purged with an inert gas, or with sufficient quantities
 of  air to keep the level of flammable vapors  below  the flammable limit.  In
 either case,  the contents should be monitored for the presence of flammable
 mixtures.

     A number  of pump parameters can be continuously monitored to help detect
 potential failures before they occur.  The following  pump  or compressor para-
 meters can be  monitored: overspeed, low oil  pressure, high jacket-water
 temperature, high gas discharge, high oil temperature,  high  level on knockout
 drums,  overload relays,  vibration monitors,  bearing  load cells,  and tempera-
 ture indicators imbedded in bearings.  Incipient failure  detection  is dis-
 cussed in  more detail in Section 4 under maintenance and  modification prac-
 tices.

 Control Effectiveness—
     The control effectiveness of various process machinery  design considera-
 tions  depends  on the  reliability of system components.   Some reliability  data
 are summarized in  Table  3-11.   The overall  reliability of  multicomponent
 control measures involving machinery depends on the  reliability of the indi-
vidual components and on  the specific system design or procedure.

Costs—
     Table 3-12 summarizes costs for some example control measures applicable
 to process  machinery.   This table lists  process machinery hazards,  corres-
ponding control measures, and  both typical capital  and total annual  costs
associated with each  control measure.   Design bases  for the costs are pre-
sented in Table 3-13.

Case Examples  (31) —
     In a polyethylene plant, fatigue failure  of a vent  connection on a com-
pressor suction line allowed ethylene to escape.  A gas cloud formed  and later
ignited.  Highly directional pressure waves  caused widespread  damage.   Six
people were killed  and thirteen injured.
                                      211

-------
      TABLE 3-11.   TYPICAL FAILURE RATES FOR PROCESS MACHINERY COMPONENTS

                                                        Failure Rate
  Component                                            (Failures/Year)
Pumps
  - Failure to start                                      0.365
  - Failure to run                                        0.011
  - Shaft seal,  major leak                                 5 x 10

Compressors                                               N/A
Source:  Adapted from References 23 and 24.
                                    212

-------
                   TABLE  3-12.  EXAMPLE PROCESS MACHINERY HAZARDS. CONTROL TECHNOLOGIES. AND COSTS
           Basis;   Costs  represent incremental costs over the baseline system presented in Table 3-13.
                                    ~~(1986 Dollars)
        Hazard
       Control Technology
                  Total Annual
Capital Cost ($)   Cost ($/Yr)
        General  Failure
to
        Shaft Seal Failure
        Bearing Failure
Corrosion resistant materials.
Higher pressure rating.
Greater corrosion/erosion allowance.
Vibration monitoring and control.
Freeze protection.
Increased inspection frequency.
Installation/maintenance supervision.
Full bolting with correctly torqued
  bolts.
Pressure/temperature cycling control.
Control of hammer blow.
Adequate overpressure protection.
Protection from external physical
  damage.

Proper seal type for service.
Proper seal materials and construction.
Adequate seal flushing, lubrication, and
  cooling.
Adequate overpressure protection.
Vibration monitoring and control.
Increased inspection frequency.

Specialized acoustic monitoring.
Preventive maintenance.
     2,500
     3.000
     3,000

       250
     9.500
       500
       	a

       120
     l.OOg
  430
  520
  520
  800
   50
  800
  320
  320

1.400
   90

   10
   90
  320
  320
                         800
                         800

                         800
                         160
        Source:  Adapted from references  25,  26  and 27.

        aCosts depend on specific systems used which are not directly related to the process machinery
         itself.
         Proper seal material depends  on  specific service.

-------
           TABLE 3-13.  DESIGN BASES FOR PROCESS MACHINERY CONTROLS

Baseline equipment - Centrifugal pump, carbon steel, 250 gpm,  150 psig rating,
stuffing box seal.

Corrosion resistant materials - Same as equipment baseline except 316
stainless steel.

Higher pressure rating, greater corrosion/erosion allowance -  Same as
equipment baseline except heavier casing.

Vibration monitoring - Assume equivalent cost of 40 hours additional operating
labor per year at $20 per hour.

Vibration control - Assume heavier foundations and supports.

Freeze protection - Assume 25 ft. of heat tracing.

Increased inspection frequency - Assume an increase of 40 hours per year at an
hourly total labor cost of $20/hour.

Full bolting with correctly torqued bolts - Assume increased supervisory labor
at 8 hours per year and $40 per hour.

Pressure/temperature cycling control - Assume the installation of a better
control loop somewhere in the process unit of which the pump is a part.

Control of "hammer blow" - Assume substitution of different type of valve or
valve closure mechanism in liner connected to pump for a 4-inch pipeline.

Adequate overpressure protection - No general estimate possible.  Costs depend
on specific systems used which are not directly related to the process
machinery itself.

Protection from external physical damage - Assume curbing around pump area for
perimeter of 20 ft.

Proper seal for type of service - Double mechanical seal substituted for
stuffing box seal on baseline centrifugal pump.

Proper seal materials of construction - Assume increased supervisory labor at
8 hours per year and $40 per hour.  Actual seal materials depend on specific
service.

Adequate seal flushing, lubrication, and cooling - Assume increased
supervisory labor at 8 hours per year and $40 per hour.  Actual seal flush
system depend on specific service.

Specialized acoustic monitoring for bearings - Assume equivalent cost of 40
hours additional operating labor per year at $20 per hour.

Preventive maintenance - Assume bearing replacement once a year.


                                      214

-------
     Failure of a pump  in  a butadiene processing unit  spilled  an estimated
27,000 Ib of butadiene  that resulted in a vapor cloud release which drifted
600 feet before igniting 10 minutes  later.   One  person  was killed, six were
injured, and the plant suffered major damage.

3.3.6  Instrumentation and Control System Hardware

     Mechanical failure of  the components of a facility's  instrumentation and
control system can cause a  loss  of process  control  which could result in an
accidental release.  The relationship between process control  and the poten-
tial for an  accidental  release was discussed in  Section 2 of this report.
This section focuses on potential mechanical failures for the various compo-
nents of a control system.  It does not  address  the problems  that may result
from poor control system logic, which was also  addressed in Section 2.

     Instrumentation equipment may fail  as  a result of  the following condi-
tions:

     •    Corrosion.

     •    Erosion,

     •    Mechanical deterioration,  and

     •    Fouling.

     The relative  importance  of these potential  causes of instrumentation
failure depend on the kind  of  instrumentation involved.   For  example,  corro-
sion may be a significant  consideration  for temperature measurement devices,
while fouling is  a  well-known problem with pH control systems.   The various
listed conditions are discussed below.
                                      215

-------
Corrosion—
     Both  internal  and external corrosion  can damage instrumentation  and
control system components.  Any components that contact a process  stream can
be subject to internal corrosion.  The nature and concentration of the corro-
sive agents in the stream and the materials of construction  of  the component
determine the potential for internal corrosion.  Corrosion damaging to system
operation  is most  often  encountered  in  such control  components  as
control-valves,  orifice plates, analyzers, chambers of certain  level  instru-
ments, gage  glasses, probes,  or any other device in  direct  contact  with a
corrosive process stream.   Internal.corrosion  can  cause moving parts  to seize,
and membranes or sensing elements can be destroyed.   Such  failures can make
sensing and other functions impossible  and  cause a loss of  control.  Corrosion
can also cause leaks through instrument connections  and housings.

     External corrosion can be  caused by moisture,  salt air,  fungi or corro-
sive vapors  in the atmosphere.  The American  Petroleum Institute  states  that
"in hot,  humid  climates,  these factors are the major causes of instrument
component failure" (29).   Electrical components are susceptible to failure by
external  corrosion.  The  formation  of  oxides, and the growth of  fungus  are
examples  of  external  corrosion that can alter electrical  properties and
prevent some portion of a  system's  electronics from functioning properly.  In
more severe  cases, external corrosion can  destroy  the physical  integrity of
casings,  conduit,  or  other structural portions of  a  control system.  Such
deterioration could result in a failure of the control system by exposing the
internal  portions  of  the system to the same  corrosion that  destroyed the
external portions.

Erosion—
     The portions of a control  system exposed to  flowing process  streams are
susceptible  to erosion, especially  streams  containing significant  amounts of
suspended  solids.  The high pressure drop  and rapid fluid  motion  through an
orifice plate make  it  susceptible  to erosion.  Erosion of the orifice would
result in an altered pressure-to-velocity relationship and  hence in failure of
the  device.   Any sensor  the  protrudes into  a  flowing  stream,  such  as  a

                                     216

-------
thermowell, can be subject to failure by erosion.  Failure occurs when erosion
has  physically  destroyed the sensing  element.   The operation of a  control
valve and its ability to accurately regulate flow can be impaired by erosion.

Mechanical Deterioration—
     Several kinds of mechanical  deterioration  can affect a control  system.
Examples of cases  of mechanical deterioration include:  fatigue failure  and
wear, mechanical abuse, exceeding instrument limits, and overheating or freez-
ing.

     Any instrument with moving parts is subject to fatigue failure and wear.
Instruments that oscillate  over a narrow portion of the operating range  are
most susceptible to wear.  This type of wear  can result  in cracked,  bent, or
broken moving parts.   Seals  and bearings will eventually wear out.   Fatigue
failure can also be  caused by  external vibration or by the weight of unsup-
ported attached equipment.  Such forces can result in cracked,  bent,  or broken
casings or internals.

     Mechanical abuse  is damage that  results  frpm careless maintenance  or
operation.   Examples of  mechanical  abuse damage  are  broken glass,  damaged
housings, and bent valve  stems.  Damage  can occur when personnel use instru-
ments attached  to  equipment  as steps to climb  on equipment.   Control-valve
stems can be  distorted  from excessive  torque if valve wrenches on the hand-
wheel are used to free binding valves.   Equipment may be damaged by collision
with moving maintenance equipment.

     Each instrument has a specific acceptable  operating  range  and  exceeding
this range may  result  in permanent  damage  to the  instrument.   Acceptable
operating limits are usually placed  on the variable being monitored  by  the
instrument, on  some  of  the  chemical and physical  properties of  the  process
stream and on the  electrical  power  supply.   For  example,  a stainless steel
bourdon tube pressure gauge  may be equipped to monitor pressures from 0 to 500
psi.  Such a gauge  may fail  if subjected to greater than 750 psi pressures, to
temperatures over  500°F, or to acidic process  streams,  depending  on the
materials of construction.
                                      217

-------
     Exposure of instrumentation to external sources of  heat  or to freezing
temperatures can  cause  instrument malfunctions.  External  sources  of heat
could include fires, adjacent hot equipment or  even  direct  sunlight in some
cases.  Heat can alter or impair  the performance  of  or damage the electronic
components of the  system, such  as heat-sensitive sensing devices.   Extreme
heat  (such  as  fire) can  cause  total  destruction of the instrument.  Low
ambient temperatures can also have adverse effects.   For example,  freezing may
impair free movement of  parts.

Fouling—
     Portions of a  control  system exposed to  process streams  are subject to
fouling from direct deposition of contaminants  or by or  reaction  by products
in  the  streams.   Fouling  may block a sensing element  from  exposure to the
stream it is intended to monitor,  thus  preventing the system from controlling
the condition of the stream.

Design Considerations—
     In designing control system hardware, proper initial instrument selection
may be the most  effective method  for  reducing  the potential  for  subsequent
failures.  For almost every process variable  at least two  kinds  of sensing
devices  are  available,  each  kind  functioning  on  a  different  principle.
Different ranges  are usually available  for each device.   For each range
several different materials  of construction are  likely  to be available, which
means that for  every specific application there are opportunities  to select
combinations of specifications suitable for any  particular service.

     Selecting an  appropriate sensor may not  be a simple matter.   The  more
information available about  the operating conditions, the easier the selection
will be.  Since  vendors  will be quick to point out  the  advantages  of  their
device, it will often be up  to the designer to explore  all of  the alternatives
available and use  engineering judgement  to make  a  selection.  Guidance  is
available from the  technical literature that describe  how  various sensing
devices work and that aids  in selection  (29).   From  a  practical perspective.
                                      218

-------
it is not always possible to  pick  a sensing device clearly superior  to  the
alternatives.  For  critical applications  it  may be  necessary  to install
redundant sensors that  operate on  different  principles.  Such  redundancy
should be considered  wherever the  failure of a sensor would significantly
contribute to the potential for an accidental  release.

     Devices that protect a sensing element from severe process  conditions are
also available.  Such special protection should be considered whenever  the
process involves a hazardous material.  These  devices  are designed to  lengthen
the life and therefore improve the  reliability  of  the instrumentation.   Many
of these protective devices can reduce  the accuracy or increase  the response
time of the sensor they  are protecting,  which  must  be  taken into  consideration
when incorporating  such  a device into  a  control system.  Examples of some
protective devices are discussed below.

     Pressure sensors are almost always  protected from direct  contact  with the
process stream by various types  of diaphragms.   They may  also be protected
from damage  by sudden shock  pressure or  rapidly  fluctuating pressure by
pulsation dampeners.  Temperature sensors are  often protected  from the process
stream by a thermowell.   Other probes can be protected from physical damage by
perforated casings.   Where solids are present, a sensor may be installed in a
filtered slip stream.  Where  fouling  is  likely  to  occur,  automatic or manual
cleaning devices are  available to  periodically  remove solid  buildup on  a
sensing surface.

     Extra support,  shielding and vibration suppression  equipment may be in
order for various components in a control  system.  Where possible, sensitive
electronic portions of the  system  should be protected.  Often,  the sensor,
transducers  and control  valves are  the  only parts  of  the control system  that
need to be out in the process  itself.   The rest of the system can often  be
placed in the protected  environment of the control  room.
                                      219

-------
     Operator training will help prevent failures  caused  by abuse.  Regular
inspection will help reduce the potential  for an accidental  release by  correct-
ing instrument problems before  they  occur.   The operation  of  most control
equipment can be tested on line without  shutting down the process.  Control
systems that oscillate around the  set  point  should be returned before such
oscillation results in a  failure.   Control  systems should be protected from
damage during shutdown or  repair.   Sensors  may need to be  isolated before
pressure or  leak testing  is  performed,  or  before equipment  is  cleaned.
Control systems may also  need protection  during sandblasting or painting.
                                     220

-------
3.4  REFERENCES

1.   Lees, F.P.  Loss Prevention in the Chemical Process Industries.
     Butterworth's. London. 1980.

2.   Hazard and Survey of the Chemical and Allied Industries.  American
     Insurance Association. New York. NY, 1979.

3.   Green, D.W. (ed.).  Perry's Chemical Engineers Handbook, 6th Edition.
     McGraw-Hill Book Company, New York, NY. 198A.

4.   Piping Component Standards for Refinery Service, Std. 593-609.   American
     Petroleum Institute, Washington, D.C.

5.   NFPA 30, Flammable and Combustible Liquids Code. 1984.  National Fire
     Protection Association, Quincy, MA, 1984.

6.   Battelle Columbus Division.  Guidelines for Hazard Evaluation Procedures.
     American Institute of Chemical Engineers.  The Center for Chemical Plant
     Safety, New York. NY. 1985.

7.   Kletz, T.A.  Plant Layout and Location:  Methods for Taking Hazardous
     Occurrences into Account.  Loss Prevention.  American Institute  of
     Chemical Engineers.  Volume 13, 1980.

8.   Lewis, D.J.  The Mond Fire, Explosion and Toxicity Index Applied to Plant
     Layout and Spacing.  Loss Prevention.  American Institute of Chemical
     Engineers.  Volume 13, 1980.

9.   Munson, R.E.  Safety Considerations for Layout and Design of Processes
     Housed Indoors.  Loss Prevention.  American Institute of Chemical
     Engineers.  Volume 13. 1980.

10.  National Electric Code.  National Fire Protection. 1984.

11.  McNaughton, K.J.  Selecting Materials for Process Equipment.  Materials
     Engineering I.  McGraw-Hill Publications Company, NY, 1980.

12.  Guidelines to the Selection and Use of Corrosion Resistant Metals and
     Alloys.  CS79-10.  Pfaudler Company. Rochester, NY, 1979.

13.  Failure Analysis and Prevention.  Metals Handbook, 8th Edition.   Volume
     10. American Society for Metals, 1975.

14.  Kletz, T.A.  What Went Wrong.  Gulf Publishing Company, Houston, TX,
     1985.

15.  Guide for Inspection of Refinery Equipment.  Chapter VI, American
     Petroleum Institute.  Washington, D.C.  December 1982.
                                      221

-------
16.  Fontana, M.G., and N.D. Greene.  Corrosion Engineering.   McGraw-Hill.
     Incorporated, 1978.

17.  Vhlig, I.H.  Corrosion Handbook.  John Wiley and Sons,  Incorporated, New
     York, New York.  1948.

18.  Proceedings of the International Corrosion Forum.   4 volumes.   National
     Association of Engineers, Boston, MA, March 1985.

19.  Spec 12D, Specification for Field Welded Tanks for Storage of  Production
     Liquids, 9th Edition.  American Petroleum Institute, January 1982.

20.  Spec 12f, Specification for Shop Welded Tanks for Storage of Production
     Liquids. 8th Edition.  American Petroleum Institute. January 1982.

21.  Std 620, Recommended Rules for Design and Construction  of Large, Welded,
     Low Pressure Storage Tanks, 7th Edition.  American Petroleum Institute,
     1982.

22.  Guide for Inspection of Refinery Equipment.  American Petroleum
     Institute, 1973.  Chapter II.

23.  Reactor Safety Study.  U.S. Nuclear Regulatory Commission, WASH-1400
     (NUREG-75/014).  October 1985.  Appendices III and IV.

24.  Anyakora, S.N.,  G.F.M. Engel, and F.P. Lees.  Some Data on the Re-
     liability of Instruments in the Chemical Plant Environment.  The Chemical
     Engineer.  Number 255, 1971.

25.  Peters, Max, and Klaus Timmerhaus.  Plant Design and Economics for
     Chemical Engineers.  McGraw-Hill Book Company, New York,  NY, 1980.

26.  The Richardson Rapid Construction Cost Estimating System, Richardson
     Engineering Services, Inc., San Marcos, California,

27.  Radian Corporation, internal cost files, 1986.

28.  Tomfohode, J.H.   Design for Process Safety.  Hydrocarbon Processing.
     December 1985.

29.  Guide for Inspection of Refinery Equipment.  American Petroleum
     Institute, 1981.  Chapter 15.

30.  Liptak, B.C.  Instrument Engineers' Handbook.  Chilton  Book co.  Radnor
     PA. 1982.

31.  Davenport, J.A.   A Survey of Vapor Cloud Incidents.  Loss Prevention.
     American Institute of Chemical Engineers.  Volume 11.  September 1977.
                                      222

-------
                                   SECTION 4
                           PROCEDURES AND PRACTICES

     A well-designed and operated process, quality hardware and mechanical
equipment, and protective devices all increase plant safety; however, they
must be supported by the safety policies of management and by clear specifica-
tions on their operation and maintenance.  This section describes how manage-
ment policy and training, operation, and maintenance procedures relate to the
prevention of accidental chemical releases.  Within the chemical industry,
these procedures and practices vary widely because of differences in the size
and nature of the processes and because any determination of their adequacy is
inherently subjective.  For this reason, the following subsections focus
primarily on fundamental principles and do not attempt to define specific
policies and procedures.

4.1  MANAGEMENT POLICY

     Management is a key factor in controlling industrial hazards and prevent-
ing accidental releases.  Management establishes the broad policies and
procedures that influence the implementation and execution of specific hazard
control measures.  It is important that these management policies and pro-
cedures be designed to match the level of risk in the facilities where they
will be used.  Most organizations have a formal safety policy.  Many make
policy statements to the effect that safety must rank equally with other
company functions, such as production and sales.  The effectiveness of any
safety program, however, is determined by a company's commitment to it, as
demonstrated throughout the management structure.  Specific goals must be
derived from the safety policy and supported by all levels of management.
Safety and loss prevention should be an explicit management objective.
Ideally, management should establish the specific safety performance measures,
                                      223

-------
provide incentives for attaining safety goals, and commit company resources to
safety and hazard control.   The advantages of an explicit policy are that it
sets the standard by which existing programs can be judged, and it gives
evidence that safety is viewed as a significant factor in company operations.

     In the context of accident prevention, management is responsible for (1,
2. 3):

     •    Ensuring worker competency;

     •    Developing and enforcing standard operating procedures;

     •    Adequate documentation of policy and procedures;

     •    Communicating and promoting feedback regarding safety
          issues;

     •    Identification, assessment, and control of hazards;  and

     •    Regular plant audits and provisions for independent
          checks.

     Because human error is a common cause of accidental chemical releases,
personnel selection and maintenance of a qualified,  experienced workforce is a
significant part of release prevention.  Managers are responsible for ensuring
that personnel selection procedures adequately assess worker competency and
match vorker skills to job responsibilities.  One author identified such
abilities as signal detection, signal filtering,  probability estimation,
manual control,  and fault diagnosis as important  process operator skills (1).
In addition, however,  personal characteristics, practical training and recent
relevant experience should be considered in the selection process.  The ideal
process operator should be responsible, conscientious, reliable, and
                                      224

-------
trustworthy  (1).  Temperament is important since it affects a previous re-
sponse to monotony and stress.  Motivation and communication skills are other
personality traits that could be assessed during personnel selection.  Partic-
ular care should be taken when selecting operators for facilities handling
hazardous materials.  The qualifications and capabilities of personnel in high
hazard facilities should be higher than for those in other process facilities.

     Many accidental release incidents' and/or major industrial disasters have
been caused in part by a failure to properly assign responsibilities (1, 2).
It is just as important to avoid a situation where positions critical to
safety maintenance are left unoccupied; accidents have been attributed to
situations in which key safety responsibilities were vacated and left unas-
signed.  An effective management policy sees that the responsibilities of such
positions are carried out even in the event of resignations and absences.

     The responsibility for safety issues such as release prevention should be
shared by all management and workforce staff.  The staff must be supported by
procedures for staff training in operating and maintenance practices, handling
upset and emergency conditions, using safety equipment, and performing facil-
ity audits.  Establishing standard practices for these activities is necessary
to ensure uniformity, avoid confusion, and make enforcement possible.  The
enforcement of standard procedures is one of management's most fundamental
responsibilities in the area of facility safety and accident prevention.

     Management is also responsible for ensuring that an adequate description
of safety policy and standard procedures is available.  In the chemical indus-
try, a great deal of documentation is produced covering areas from design and
layout, operation, maintenance, and inspection, hazard identification and
assessment, and emergency planning.  So that procedure and policy statements
will not be overly cumbersome and monotonous, these documents should:

     •    Be easy to use;
                                      225

-------
     •    Be complete;

     •    Establish the importance and benefits of the procedures;

     •    Be clear and concise.

     The document should be written to a specific audience.   In other words,
the users of the policy and procedures document must feel it addresses them.
These documents should explain not only how release prevention activities are
conducted, but also why it is important that they be conducted in the speci-
fied manner, so that the benefits of proper safety practices will be clear.
Finally, attention to readability and style should be an important priority in
document preparation, since if personnel find the documents  cumbersome and
wordy, they won't read them and they will not be easy to use as references.

     Publicizing safety material is not enough, since personnel often think
these bulletins are dull (1, 2, 3).  Encouraging communication, promoting
feedback, and emphasizing facility safety as a matter of professionalism are
examples of ways of countering "safety boredom."  Active communication stres-
sing the priority of accident prevention should come from all levels of
management, so that personnel will feel that discussion of the effectiveness
of current safety standards and ideas for improvement is an  important part of
their job.  When management demonstrates a willingness to respond to initia-
tives from below and participates directly with workers in improving safety,
worker morale increases, increasing the degree to which standard procedures
are followed.  Assigning safety and loss prevention responsibility to compe-
tent people and giving them specific, meaningful objectives  and adequate
resources also encourages a professional attitude about the  importance of
safety.
                                      226

-------
     Hazard identification, assessment, and control is another area that
should be addressed by management to minimize the potential for accidental
chemical release incidents.  In the past, these activities have been handled
relatively informally; however, many companies now use a more systematic
approach (3).  In most instances, safety hazards are identified by the experi-
enced staff.  Safety review committees that evaluate processes by a "what if"
approach are an example of using staff experience to identify hazards.  The
objective of hazard assessment techniques is to gather information on how
frequently accidents could occur, how severe the consequences could be, and
what changes could be made in processes, equipment and procedures to reduce
the accidents and their consequences.  Management must have a mechanism for
obtaining this type of information so that they can rank potential problems
and decide how to allocate hazard control resources.  Various analytical
techniques, both qualitative and quantitative, are available for performing
hazard assessments (1, 2, 3).  Managers are responsible for hazard control
decisions during the design, construction, startup, operation, maintenance,
and shutdown of chemical process facilities.  Hazard control has typically
been aimed at minimizing the potential for incidents such as fires and explo-
sions; however, prevention of accidental chemical releases should also be a
fundamental consideration.

     A facility safety audit is a frequently used activity associated with
hazard identification, assessment, and control.  A total facility safety audit
involves a thorough evaluation of a facility's design, layout, equipment and
procedures, and is aimed specifically at identifying and correcting poten-
tially unsafe conditions.  Audits are often conducted during facility startup
and repeated a year after startup.  Thereafter, the frequency of safety audits
varies, typically ranging from every two to five years.  Specific objectives
of these audits include alerting operating personnel to process hazards,
determining whether or not safety procedures need to be changed, screening for
equipment or process changes that may have introduced new hazards, assessing
the feasibility of applying new hazard control measures, identifying addi-
tional hazards, and reviewing inspection and maintenance programs (4).
                                      227

-------
     In-house safety audits are generally the responsibility of senior manage-
ment and are conducted by teams selected by these managers.  One review of
audit procedures recommended that audit committees include the plant manager.
a safety department representative, a project or design engineer, a mainte-
nance engineer, a process engineer, and an instrumentation/control engineer
(5).  Another system is the independent safety audit, which is conducted by
qualified consultants or insurers.  One of the primary advantages of hiring
independent entities to perform safety audits is that in addition to
evaluating facility safety, they check management organization, policies, and
attitudes.

4.2  OPERATOR TRAINING

     The performance of operating personnel is a significant factor in pre-
venting  accidental chemical releases.  Many case studies documenting indus-
trial incidents note the contribution of human error to accidental releases
(1,2).  Causes of release incidents include improper routine operating proce-
dures, insufficient knowledge of process variables and equipment, insufficient
knowledge of emergency or upset procedures, failure to recognize critical
situations, and, in some cases, a direct physical mistake (e.g., turning the
wrong valve).  A comprehensive operator training program can decrease the
potential for accidents resulting from such causes.

     Operator training can include a wide range of activities and a broad
spectrum of information.  Training, however, is distinguished from education
in that it is specific to particular tasks.  While general education is
important and beneficial, it is not a substitute for specific training.  The
content of a specific training program depends on the type of industry, the
nature of the processes used, the operational skills required, the character-
istics of the facility management system, and tradition.

     Some general characteristics of quality industrial training programs
include:
                                      228

-------
     •    Establishment of good working relations between management
          and personnel;

     •    Definition of trainer responsibilities and training
          program goals;

     •    Use of documentation, classroom instruction, and field
          training (in some cases supplemented with simulator
          training);

     •    Inclusion of procedures for normal startup and shutdown,
          routine operations, and upsets, emergencies, and acci-
          dental releases; and

     •    Frequent supplemental training and the use of up-to-date
          training materials.

     In many instances, training is carried out jointly by facility managers
and by a training staff selected by management.  In others, management is
solely responsible for maintaining training programs.  In either case, respon-
sibilities should be explicitly designated to ensure that the quality and
quantity of training provided is adequate and that there is accountability for
the training.  Training requirements and practices can be expected to differ
between small and large companies, partly because of resource needs and
availability, and partly because of differences in employee turnover.

     The job of the trainer is essentially to ensure that the right type and
amount of information is supplied at the right time.  To do this the trainer
must not only understand the technical content of a job, but also those
aspects of the job where operators may have difficulty.  It is therefore
advantageous for trainers to spend time observing and analyzing the tasks and
skills they will be teaching.  This is referred to by Lees as prior-task
analysis, and is important for finding out which factors affect the learning
                                      229

-------
of skills and how training programs can be organized to best address difficult
areas (1).

     Factors such as pace, motivation, and feedback are standard considera-
tions in educational and training applications (1).  Training programs should
be conducted at a pace that allows operators to become thoroughly familiar
with the material.  Maintaining motivation is essential; interest in the
material can be fostered by focusing not only on how tasks are conducted but
on why they are performed the way they are (e.g., pointing out the hazards
associated with improper procedures can motivate workers to do the job
properly and safely).  Finally, performance feedback and reinforcement during
training is needed to correct poor technique, resolve misunderstandings,
reward good technique, and encourage further skill development.

     Training programs may use a combination of classroom training, where
lectures can and should be supplemented with written material (e.g., specific
training documents as well as copies of standard operating procedures),
simulator training, and training within the facility itself.  In-facility
training is particularly effective because it allows the operator to become
familiar with the actual process layout and to learn directly how to operate
equipment and instrumentation.  During facility startup, valuable in-facility
training exercises can be conducted in hazardous areas using safe fluids
instead of actual process chemicals (2).  Digital simulators are extremely
useful training devices, particularly for training in high-hazard areas.
Using these devices to closely simulate process operation allows training to
be conducted without endangering either a process or an inexperienced oper-
ator.  Although simulators are useful in routine operator training, they are
perhaps even more important for upset and emergency training.  Simulated
emergencies are an effective way to allow operators to witness a variety of
situations and make judgements in a non-stressful environment (6).

     The objectives of normal operator training are to familiarize operators
with the nature of processes, equipment, chemicals, and standard operating
                                      230

-------
procedures.  A list of the aspects typically involved in the training of
process operators is presented in Table 4-1.

     Upset and emergency training typically augments the information presented
during routine training.  Ideally, emergency training should be integrated
with routine operation training (2).  This kind of presentation allows opera-
tors to become familiar with processes as a whole and illustrates how both
process characteristics and operator responses evolve from normal operation to
upset and on to emergency conditions.  Emergency training includes topics such
as:

     •    Recognition of alarm signals;

     •    Performance of specific functions (e.g., shutdown
          switches);

     •    Use of specific equipment;

     •    Actions to be taken on instruction to evacuate;

     •    Fire fighting; and

     •    Rehearsal of emergency situations.

     Safety training includes responses to emergency situations,  but is also
concerned with preventive measures.  Safety courses are typically required of
new operators at chemical process facilities,  and frequently these courses are
later supplemented by more thorough safety training.  Aspects specifically
addressed in safety training include (1,  3):

     •    Hazard recognition and communication;

     •    Actions to be taken in particular situations;
                                      231

-------
    TABLE  4-1.   ASPECTS  OF  TRAINING  PROGRAMS  FOR ROUTINE PROCESS OPERATIONS
          Process  goals,  economics,  constraints,  and  priorities
          Process  flow  diagrams
          Unit  operations
          Process  reactions,  thermal effects
          Control  systems
          Process  materials quality, yields
          Process  effluents and wastes
          Plant equipment and instrumentation
          Equipment  identification
          Equipment  manipulation
          Operating  procedures
          Equipment  maintenance and  cleaning
          Use of tools
          Permit systems
          Equipment  failure,  services failure
          Fault administration
               Alarm monitoring
               Fault diagnosis
               Malfunction detection
          Communications, recordkeeping,  reporting
Source:   Reference 1.
                                      232

-------
     •    Available safety equipment and locations;

     •    When and how to use safety equipment;

     •    Use and familiarity with documentation such as:
          - plant design and operating manuals,
          - company safety rules and procedures.
          - procedures relevant to fire, explosion, accident, and
            health hazards,
          - chemical property and handling information; and

     •    First aid and CPR.

     Although emergency and safety programs traditionally focus on incidents
such as fires, explosions, and personnel safety, the prevention of accidental
chemical releases and release responses should also be addressed.  Release
incidents are often overlooked because, except for infrequent catastrophes,
their impact can be less dramatic than that of fires or explosions.  Combined
training with responding agencies is also a good practice because it allows
personnel from both sides to learn how to adapt their procedures to increase
the benefits of a joint emergency response effort.

     The frequency of training and the frequency with which training materials
are updated (1-5) are also important in maintaining strong training programs.
One of the main problems associated with industrial training programs is that
the level of training provided during facility startup (or new employee
orientation) is often not followed up during the life of the facility (or in
the case of the employee, during his career) (2).  Additional training pro-
grams,  such as refresher courses, offer many advantages, particularly when
they cover procedures that may not be used very often (e.g., startup, shut-
down, upset, emergency).  In some instances, experienced operators may become
careless or complacent,  and additional training reminds them of the importance
of following proper procedures.   Chemical processes may be modified to the
                                      233

-------
extent that equipment changes require operational changes.  Supplemental
training ensures that operators are aware of the changes and of the safety
considerations that accompany them.  Another advantage of training experienced
operators is that these workers can often point out the weaknesses and in-
adequacies in documented procedures and suggest alternate techniques.   Differ-
ences in turnover in different companies also affect the experience profile of
the operating staff and influence the frequency of training.

     Maintaining updated training materials and updated process design and
operating manuals is the responsibility of managers and training personnel.
These materials should be reviewed regularly, especially when plant modifi-
cations are made, to ensure that workers have access to up-to-date descrip-
tions and procedures.

     Much of the type of training discussed above is also important for
management personnel.  Safety training gives management the perspective
necessary to formulate good policies and procedures, and to make changes that
will improve the quality of facility safety programs.  Lees suggests that
training programs applied to managers include or define (2):

     •    Overview of technical aspects of safety and loss preven-
          tion approach;

     •    Company systems and procedures;

     •    Division of labor between safety personnel and managers in
          with respect to training; and

     •    Familiarity with documented materials used by workers.

     The training programs in effect in industries using, manufacturing, and
storing toxic chemicals represent an effort to minimize the potential for
accidental release and. therefore, should be considered as important as
                                      234

-------
physical containment.  The training fundamentals presented here are only an
introduction to some features of the types and content of specific training
that can be provided, but they highlight the importance of a good training
program in fostering a staff genuinely concerned with safety and aware of how
their actions can affect safe operation of the facility.

A.3  MAINTENANCE AND MODIFICATION PRACTICES

     Maintenance practices include both general practices that involve overall
maintenance policy and procedures, and specific practices for specific
maintenance objectives.

4.3.1  General Practices

     Proper facility maintenance ensures the functional and structural integ-
rity of chemical processing equipment, ancillary equipment, and services.
Modifications are often necessary to allow more effective production, reduce
costs, or enhance safety.  However, since these activities can be a primary
source of accidental release incidents, proper maintenance and modification
practices are an important part of accidental release prevention.  Use of a
formal system of controls is perhaps the most effective way of ensuring that
maintenance and modification are conducted safely.  In many cases, formal
control systems have had a marked effect on the level of failures experienced
(2).

     Maintenance refers to a wide range of activities, including preventive
maintenance,  production assistance (e.g., adjustment of settings), servicing
(e.g., lubrication and replacement of consumables), running maintenance,
scheduled repairs during shutdown, and breakdown maintenance.  These activi-
ties in turn  require specific operations such as emptying, purging, and
cleaning vessels, breaking pipelines, tank repair or demolition, welding, hot
tapping (attaching a branch to an in-service line), and equipment removal (2).
                                      235

-------
     The potential for accidents during these types  of procedures is quite
high.  Two of the more common maintenance  problems have been identified as
equipment identification and equipment  isolation (2).   Accidents frequently
result from incorrect identification of the equipment  on which work is to be
done.  This can have disastrous effects, especially  if connections associated
with high temperature, high pressure,  or hazardous material  operations are
involved.  Failure to adequately isolate equipment is  another major source of
maintenance accidents.  To protect  process and maintenance personnel,  it is
essential to have positive isolation of both process materials and moving
parts during maintenance activities.  Other potential  sources of maintenance
accidents are improper venting to relieve  pressure,  insufficient draining, and
not cleaning or purging systems before maintenance activities begin.

     Permit systems and up-to-date  maintenance procedures minimize the poten-
tial for accidents during maintenance operations.  Permit-to-work systems
control maintenance activities by specifying the work  to be  done, defining
individual responsibilities, eliminating or protecting against hazards, and
ensuring that appropriate inspection and testing procedures  are followed.
Such permits generally include specific information  such as  (2):

     •    The type of maintenance operations to be conducted;

     •    Descriptions and identifying codes of the  equipment to be
          worked on;

     •    Classification of the area in which work will be con-
          ducted;

     •    Documentation of special  hazards and control measures;

     •    Listing of the maintenance equipment to be used; and

     •    The date and time when maintenance work will be performed.
                                      236

-------
     Maintenance permits originate with the operating staff.  In this way,
operators and operation* supervisors are aware of impending maintenance
activities and are instructed to make any required operating changes and
properly isolate the equipment to be serviced.  Permits may be issued in one
or two stages.  In one-stage systems, the operations supervisor issues permits
to the maintenance supervisor, who is then responsible for his staff.  Two-
stage systems involves a second permit issued by the maintenance supervisor to
his workforce (2).

     Permit-to-work systems offer many advantages.  They explain the work to
be done to both operating and maintenance workers.  In terms of equipment
identification and hazard identification, they provide a level of detail that
significantly reduces the potential for errors that could lead to accidents or
releases.  They also serve as historical records of maintenance activities.
To make sure that these systems give the desired protection, various authors
recommend that they be reviewed as part of facility audit procedures (2, 5).

     Another form of maintenance control is the maintenance information
system.  Such a system can generate information on facility incidents,  fail-
ures, and repairs (2).  Ideally, these systems should log the entire mainten-
ance history of equipment, including preventive maintenance, inspection and
testing, routine servicing, and breakdown or conditional maintenance.  This
type of system is also used to track incidents caused by factors such as human
error, leaks, and fires, including identification and quantification of
failures responsible for hazardous conditions, failures responsible for
downtime, and failures responsible for direct repair costs.  This information
is used to assess current maintenance practices and to develop maintenance
procedures and schedules that increase facility safety and reduce operating
costs.

     Maintenance of the integrity and safe operation of process equipment
depends on proper facility modification practices.  To avoid confusion with
maintenance activities, a modification is defined as an intentional change in
                                      237

-------
process materials, equipment, operating procedures,  or operating conditions
(2).  Industrial facilities frequently undergo modification; these activities
sometimes start during the design phase and nearly always take place during
commissioning and operation.  Modifications may be temporary or may involve
permanent changes to equipment or operation.

     Accidental releases frequently result from some aspect of facility
modification.  Accidents happen when equipment integrity and operation are not
properly assessed following modification, or when modifications are made
without updating corresponding operation and maintenance instructions.  In
many instances, equipment is changed under the stress of attempting to get a
facility operating as soon as possible.  In these situations, it is important
that careful assessment of the modification results  has a priority equal to
that of getting the facility on line.

     Frequently, hazards created by modifications do not appear in the exact
location of the change.  Equipment modifications can invalidate the arrange-
ments for system pressure relief and blowdown and can invalidate the function
of instrumentation systems.  Even relatively minor modification can introduce
hazards if proper precautions are not taken (e.g., improperly supported bypass
lines) (2).

     For effective modification control, there must  be established procedures
for authorization, work activities, inspection, and  assessment, complete
documentation of changes, including the updating of  manuals, and additional
training to familiarize operators with new equipment and procedures (2, 3) .
Several factors should be considered in reviewing modification plans before
authorizing work.  According to Lees, these include  (2):

     •    Sufficient number and size of relief valves;

     •    Appropriate electrical area classification;
                                      238

-------
     •    Elimination of effects which could reduce safety stand-
          ards;

     •    Use of appropriate engineering standards;

     •    Proper materials of construction and fabrication stand-
          ards;

     •    Existing equipment not stressed beyond design limits;

     •    Necessary changes in operating conditions; and

     •    Adequate instruction and training of operation and
          maintenance teams.

     Following authorization, established procedures should be used to ensure
that work is conducted according to appropriate codes and standards and that
systems are fully inspected before commissioning.   In many cases, it is
advantageous that the people involved with authorizing modifications be
involved with the pre-startup inspection.

     Formal procedures and checks on maintenance and modification practices
must be established to ensure that such practices enhance rather than adverse-
ly affect plant  safety.  As with other facility practices, procedure develop-
ment and complete documentation are necessary.  However, training, attitude.
and the degree to which the procedures are followed also significantly influ-
ence facility safety and release prevention.

4.3.2  Equipment Monitoring and Testing

     The potential for an accidental release may be reduced by repairing or
replacing equipment that appears to be headed for failure.  A number of
                                      239

-------
testing methods are available for examining the condition of equipment.   Some
of the most common types of tests are listed below:

     •  Metal thickness and integrity testing;

     •  Vibration testing and monitoring;  and

     •  Relief valve testing.

     All of the above testing procedures are nondestructive;  they do not
damage the material or equipment that they test. Only a few of the most  common
test methods are discussed here.  Additional methods and further detail  on the
methods mentioned here may be found in references on testing procedures
(1.2.3.4).

4.3.3  Metal Thickness and IntegrityTesting

     Metal thickness and integrity tests are used to determine the thickness
of metal in vessels and piping and the presence of general corrosion, cracks,
pitting, or other defects.  These methods are also used to inspect the integ-
rity of welds.  The two most common test methods are radiographic testing and
ultrasonic testing.

     Radiographic testing uses an X-ray type of photograph of the equipment of
interest.  A radiation sensitive film is attached to one side of a metal
surface.  A radiation source (usually gamma rays) is opened up on the other
side of the metal surface.  The radiation penetrates the metal and exposes the
film.  The end result is an image of the surface and interior of the metal.
If properly taken and interpreted, the presence of defects in the metal  as
well as the thickness of the metal can be determined.  This method is often
applied to welds, and small diameter pipes, valves and fittings may be
radiographed without opening the line or taking it out of service.  For larger
                                      240

-------
diameter equipment, the radiation source must be placed inside the equipment,
requiring that it be taken out of service.  Proper handling of the radiation
source and proper interpretation of the radiographic picture require special
training.  Most companies hire outside specialists to perform their
radiography, although some companies have trained in-house personnel.

     The advantages of radiography are that it provides a reliable and de-
tailed picture of the condition of the item of interest, and for small equip-
ment that does not have to be taken off line it is a fairly quick testing
method.  There are several disadvantages of radiography.  Many pieces of
equipment must be taken out of service and opened up to allow access for the
radiation source.  In these situations, more time will probably be required to
prepare the equipment for testing than will the actual test.  Additionally,
operating personnel must be cleared from an area of the process when the
radiation source is in use.  This could require additional process downtime.
The radiation from the testing may also interfere with certain types of
instrumentation.

     In ultrasonic testing, a probe that generates an ultrasonic pulse is held
against the bare metal.  The thickness of the metal is determined by the
instrument measuring the time required for the ultrasonic signal to travel
from the probe to the opposite side of the metal surface and back to the
probe.  Small pieces of metal of known thickness must be available as a
reference for each material to be tested.  The pulse and echo from the probe
are displayed on a cathode ray screen.  Special training is required to be
able to properly intarpret the output from this test.  A signal sent perpen-
dicular to the metal surface is used to measure the wall thickness at that
spot.  By placing the signal probe at various angles, and moving the probe to
various locations on the surface, a trained tester can determine the presence
of cracks, pits or other irregularities in metal equipment and welds.

     The advantages of ultrasonic testing are that it often requires less
preparation than radiography.  No radiation is involved so testing areas do
                                      241

-------
not have to be cleared of personnel.  Equipment does not have to be opened for
an ultrasonic test to be performed.  But there are several disadvantages to
ultrasonic testing.  Test results may not be easy to interpret,  and it is
difficult to generate a permanent copy of the results for future examination.
Most ultrasonic equipment is not explosion proof and flammable materials must
be eliminated from the testing area.  Since the ultrasonic probe cannot be
held directly against high temperature surfaces, an insulated material must be
used.  The insulation, however, reduces the sensitivity of the probe.

     Other test methods are available but less commonly used. These include;
magnetic-particle examination, liquid-penetrant examination,  eddy-current test
method, thermography and electrical-resistance test method.  The
magnetic-particle and liquid-penetrant examination methods are simple proced-
ures used for detecting the presence of surface cracks.  The  eddy-current test
method is often used to test the integrity of tubing.  The electrical-resis-
tance test method, which is used to locate flaws in metal structures, has been
used for years by railroads to locate transverse cracks in rails.  Additional
details of these and other testing methods may be found in the technical
literature (1,2).

4.3.4  Direct Corrosion Monitoring

     Direct corrosion monitoring is accomplished by visual inspection, using
corrosion coupons, or various instrumental methods that measure  corrosion
products in process streams.  The shortcomings of these methods, especially
the coupon method, is that special circumstances, such as corrosion in a
specific area of equipment caused by localized stress conditions, for example,
might not be detected.
                                      242

-------
4.3.5  Vibration Testing and Monitoring

     Vibration testing and monitoring is used to detect incipient equipment
failure and to diagnose what part of the equipment is failing.  The basic
premise of vibration testing and monitoring is that defects in piping, struc-
tural supports or machinery are characterized by corresponding abnormal
vibrations.

     Vibrations are measured using a variety of methods.  A common vibration
measuring probe is the accelerometer, which measures the motion of the probe
relative to a motionless reference mass.  A proximity probe is used to measure
the motion of one point relative to another.

     The science of interpreting vibration information is called vibration
signature analysis.  The method used in conventional vibration signature
analysis is as follows (5) :

     "Instantaneous mechanical motion (vibration)  is converted into an elec-
     tronic signal that is then analyzed, filtered, or otherwise manipulated.
     In mechanical vibration theory, this complex signal is the result of
     summing many discrete sources, each vibrating at a single frequency.
     Through a process called spectrum analysis, this summing effect is
     mathematically reversed so that the energy content at individual frequen-
     cies can be determined.  Therefore, spectrum analysis helps one to
     identify the specific components in a machine that are vibrating."

     Lower frequency testing is good for obtaining a detailed diagnostic
picture of different components in a. given piece of machinery, but it is not
usually a good method for detecting incipient failures.  Low frequency tests
are often run once a problem has been detected.  Higher frequency monitoring
is good for detecting incipient equipment failure but is not well-suited for
diagnosing what the specific problem might be.  A permanent high frequency
                                      243

-------
probe is often attached to a piece of machinery with an alarm to warn when
abnormal vibrations occur.

4.3.6  Relief Valve Testing

     Two types of tests are carried out on relief valves.   In one test,  the
valve open and reseat pressures are measured.   In another  test,  the capacity
of the relief valve is measured.  The test for determining .opening and
reseating pressures involves a very simple bench top apparatus that uses
hydraulic pressure.  The valve is pressurized  with water until it opens, at
which point a small amount of water is ejected and the valve closes.  The
opening and closing pressures are recorded. Most plant maintenance shops have
this type of capability.  Measuring valve capacity is a much more complicated
procedure and almost always must be done at one of a few labs that is equipped
for this type of test.

     The opening and reseating pressures of a  relief valve should be tested
periodically as a part of routine maintenance.  Testing a  valve's capacity
should be done whenever any corrosion, fouling or scaling  has occurred.

4.4  OPERATING AND MAINTENANCE MANUALS

     As discussed in Sections 2 and 3 of this  manual, accidental chemical
releases are often caused by either improper equipment or  equipment failure or
process operation.  Good operating and maintenance practices are the key to
preventing such releases.  In both cases,  clearly and correctly  defined
procedures in maintenance and operating manuals contributes to good practices.

     Well-written instructions give enough information about a process that
the worker with hands-on responsibility for operating or maintaining the
process can do so safely, effectively, and economically.  These  instructions
not only document day-to-day procedures, but also are the  basis  for most
                                      244

-------
industrial training programs (7, 8).  In the chemical industry, operating and
maintenance manuals vary in content and detail.  To some extent, this varia-
tion is a function of process type and complexity; however, in many cases it
is a function of management policy.  Because of their importance to the safe
operation of a chemical process, these manuals must be as clear, straight-
forward, and complete as possible.  In addition, standard procedures should be
developed and documented before plant startup, and appropriate revisions
should be made throughout plant operations.

     Documentation of operation and maintenance procedures may be combined or
documented separately. Procedures should include startup, shutdown, hazard
identification, upset conditions, emergency situations, inspection and test-
ing, and modifications (1. 2).  Several authors think operating manuals should
include (1. 3, 7, 8):

     •    Process descriptions;

     •    A comprehensive safety and occupational health section;

     •    Information regarding environmental controls;

     •    Detailed operating instructions;

     •    Sampling instructions;

     •    Operating documents (e.g.. logs, standard calculations);

     •    Procedures related to hazard identification;

     •    Information regarding safety equipment;

     •    Descriptions of job responsibilities; and
                                      245

-------
     •    Reference materials.

     Equipment sketches and process flow diagrams are a useful feature of the
process descriptions included in operating manuals.  Since safety and occupa-
tional health information is an integral component of operating manuals, this
section should include information on the properties and hazards of materials,
special precautions to prevent exposure, and spill and fume control measures
(8).

     Operating instructions must include those for normal operations, normal
startup and shutdown (including variations based on length of shutdown), and
abnormal or emergency shutdown (1).  Diagnostic guides and a listing of normal
(safe) operating limits specific to each type of pperation should also be
provided (3).  Sampling instructions can include the location and identifica-
tion of sampling points, sampling frequency, sampling methods, and safety
precautions.  Operating documents include operator's logs, manager's logs, and
standard calculations.  Safety equipment descriptions generally include a
guide to locations, the equipment inspection schedule, and manuals for their
use and maintenance.  Descriptions of job responsibilities should explicitly
define the operator actions expected in both routine and upset situations, and
should explain who has authority over specific functions (3, 7).

     Serious industrial accidents have occurred during startup and shutdown
periods (2).  Formal startup and shutdown procedures should be described in
the operating manual or in separate but readily available documentation.
Startup manuals, or manual sections, may include descriptions of the overall
startup strategy, pre-startup conditions, required utilities, and material.
process design, and equipment performance characteristics.  Frequently this
type of documentation will include checklists summarizing the sequence of
steps that must be taken during startup (7.9).  Hazard identification, acci-
dent prevention, and emergency actions specifically related to startup activi-
ties should also be addressed.  Shutdown procedures should define practices to
be used for both normal and emergency shutdown.  In many instances, process
                                      246

-------
facilities cannot be shut down rapidly, and tasks must be conducted in an
orderly progression to avoid creating hazardous conditions.  For this reason,
sequential checklists summarizing activities are often included in shutdown
procedures.  Some of the areas typically addressed by shutdown procedures are
(9):

     •    Cooling and depressurizing equipment;

     •    Pumping out vessels (particularly if vessel contain
          flammable, corrosive,  or toxic materials);

     •    Purging flammable vapors; and

     •    Inspections and testing before entering equipment.

     The potential for chemical  releases during startup and shutdown activi-
ties is significant.  Fittings and equipment placed on line (i.e.. placed in
contact with process fluids) during startup are potential leakage sources.
During shutdown, operations such as purging, depressurizing, and equipment
disassembly are potential chemical release sources.  The potential for.
prevention of. and proper response to accidental chemical releases should be
specifically addressed in startup and shutdown procedures.

     Upset and emergency procedures instruct workers on how to handle non-
routine operations.  Situations  may range from operation outside the bounds
defined as normal to serious situations involving fire, explosion, health
hazards, or pollution episodes.   Other examples of hazards for which pre-
scribed response actions should  be available include:

     •    Leaks of materials from equipment;

     •    Defective or damaged equipment;
                                      247

-------
     •    Detection of unusual odors or sounds;

     •    Abnormal conditions such as high or low temperature or
          pressure.

     •    Infractions of operating procedures or safety regulations,

     •    Unauthorized hazardous work, and

     •    Unauthorized personnel or vehicles in  hazardous areas.

     Maintenance manuals typically contain procedures not only for routine
maintenance,  hut also for inspection and testing, preventive maintenance, and
facility or process modifications.  These procedures include specific items
such as codes and supporting documentation for maintenance and modifications
(e.g., permits-to-work, clearance certificates), equipment identification and
location guides, inspection and lubrication schedules,  information on lubri-
cants, gaskets, valve packings and seals, maintenance stock requirements,
standard repair times, equipment turnaround schedules,  and specific inspection
codes (e.g.,  for vessels and pressure systems)  (2).   Full documentation of the
maintenance required for protective devices is a particularly important aspect
of formal maintenance systems.  These devices include:

     •    Pressure relief valves;

     •    Rupture discs;

     •    Tank vents and filters;

     •    Other pressure relief devices;

     •    Non-return valves (e.g., check valves);
                                      248

-------
     •    Mechanical trips and governors;

     •    Instrument trips; and

     »    Alarm, sprinkler, and fire water systems.

     Maintenance manuals should also describe the way to keep equipment
records.  Such records are usually maintained for individual equipment items,
and include identification, location, engineering descriptions, operating
conditions, inspection intervals and maintenance history (2).  In some in-
stances, equipment records are incorporated as part of the maintenance manual;
in others these types of records are maintained separately.  These records,
and the frequency with which they are reviewed, are important to release
prevention because they have the data needed to evaluate equipment integrity.

     The preparation of operating and maintenance manuals, their availability,
and the familiarity of workers with their contents are all important to safe
operations.  The objective, however, is to maintain this safe practice
throughout the life of the facility.  Therefore, as processes and conditions
are modified, documented procedures must also be modified.  The written
documentation used to control operating and maintenance activities on a
day-to-day basis must be up-to-date and include the latest process changes.
One way of ensuring that documentation is properly maintained is to institute
a regular procedure review process (1, 5).  This type of review is often
conducted as part of facility safety audits, but can also be performed inde-
pendently of total system checks.  Examples of the questions often asked
during procedure reviews are presented in Table 4-2.

     Documented operating and maintenance procedures form the backbone of
effective safety and loss prevention policy.  Adherence to these procedures  is
the primary standard against which management judges the worker's performance
in safe operations, and effort put into the preparation, maintenance, and
enforcement of these procedures is a measure of management's commitment to
                                      249

-------
     TABLE 4-2.  EXAMPLES  OF QUESTIONS ASKED DURING  PROCEDURE  REVIEWS









     Are  manuals written in a  clear and  concise manner?






     Are  they  available to all operators and maintenance personnel?






     Are  they  kept  up  to date  and  reviewed  at  regular  intervals?






     Are  the documented procedures obeyed?






     Are  the procedures reviewed regularly  with each employee?






     Are  emergency  plans included?






     Are  hazards and preventative  measures  spelled out?













Source:   Reference  1.
                                      250

-------
accident prevention.  In addition, these procedures are the building blocks of

training programs, of communications between operating staff and supervisors,

and finally, of improved procedures.


4.5  REFERENCES

1.   Lees, F.P.  Loss Prevention in the Chemical Industries - Hazard, Identi-
     fication, and Control.  Volume 1.  Butterworth and Company, 1983.

2.   Lees, F.P.  Loss Prevention in the Chemical Industries - Hazard, Identi-
     fication, and Control.  Volume 2.  Butterworth and Company, 1983.

3.   Process Safety Management (Control of Acute Hazards).  Chemical
     Manufacturers' Association.  Washington B.C., May, 1985.

A.   Kubias, F.O.  Technical Safety Audit.  Paper presented at the Chemical
     Manufacturers' Association Process Safety Management Workshop.
     Arlington, VA.  May 7-8, 1985.

5.   Conrad, J.  Total Plant Safety Audit.  Chemical Engineering.  May 14,
     1984.

6.   Training Plant Operators - New Digital Simulators Make It Easier and
     Cheaper.  Chemical Week.  September 21, 1983.

7.   Stus, T.F.  On Writing Operating Instructions.  Chemical Engineering.
     November 26, 1984.

8.   Burk, A.F.  Operating Procedures and Review.  Paper presented at the
     Chemical Manufacturers' Association Process Safety Management Workshop.
     Arlington. VA.  May 7-8, 1985.

9.   Hazard Survey of the Chemical and Allied Industries.  American Insurance
     Association, New York, NY, 1979.
                                      251

-------
                                   SECTION 5
                            PROTECTION TECHNOLOGIES

     This section discusses the various types of technologies that may protect
against the incipient accidental air release of a toxic chemical.  Protection
technologies, as  defined  in this manual, apply when  the  chemical is  still
contained; it has escaped from its primary containment but has not yet escaped
to the atmosphere.  An example  of an  incipient accidental  release  is  a relief
valve discharge still contained within its manifold piping.  The technology of
protection involves  equipment  and systems  that capture or destroy a  toxic
chemical before it is released  to the environment.  Protection technologies
include the following:

     •    Flares.

     •    Scrubbers,  and

     •    Enclosures.

     Each of  these technologies represents  an  add-on to  the basic process
system it protects.   Flares and scrubbers are technologies in common  use for
ordinary  pollution control with many well-developed  applications.  In  the
context of accidental toxic chemical releases, however,  there are special
design problems  and  considerations  that may differ from the  applications  of
these technologies to ordinary process or vent streams. An enclosure provides
temporary containment of a  released chemical until  it can be released to the
atmosphere at a  controlled, non-threathening rate or treated by  one  of the
other technologies discussed  above.  While the purpose  of the first  two
protection technologies  is to reduce the  quantity of chemical  ultimately
released, enclosures  control  the rate  of  release to  the  atmosphere  or to
treatment technology.
                                       252

-------
     The appropriate application and proper design of these  systems  for  toxic
chemicals must be  evaluated  on a case-by-case basis.   At  present,  a major
limitation of both  applicability  and design are that fundamental design and
performance data  under the  severe  and unstable  operating conditions en-
countered in an emergency are  not well  developed.  The  basic characteristics
of flares and scrubbers, including a brief process description  and  a discus-
sion of  the  applicability  of the technique,  performance, and typical costs,
are discussed below.

5.1  FLARES

     Flares are devices routinely used  in the  chemical  process  industries  to
burn intermittent or emergency emissions of flammable waste gases.  Sources of
such emissions are  generally process vessels.  Flares are distinguished  from
other process  combustion  devices such  as  incinerators  by their  design  to
handle extreme flow rate variations  and their  unenclosed combustion zone.   A
flare is basically a stack which burns a flammable gas at the discharge.

5.1.1  Process Description

     A total flare system consists of collection piping, a seal pot, a liquid
knock-out vessel, and  the flare  itself.  Figure 5-1  is  a conceptual  illustra-
tion of  a typical  flare system.   The flare is a section of  vertical piping
with a specially designed combustion  tip.  The tip  consists  of  a pilot light
to ignite flammable gases flowing out the end of the flare pipe.  Tip designs
vary according to  the specific application and are  an  important aspect of
flare design.  The system shown in the figure is for an elevated flare.

     Two basic types of flares are  elevated  flares  and  ground flares.  Figure
5-2 shows a typical ground  flare.   Elevated flares  are long vertical  pipes
which may range to  heights as  great  as  600 feet,  while ground flares usually
do not exceed 150 feet in height  (1). Ground  flares  are generally surrounded
by a refractory  enclosure.   Elevated flares are usually designed to handle
larger flows than ground flares,  and is more likely to be used for high volume
upset or emergency flaring situations. The ground  flare is more likely to be

                                       253

-------
ASSIST
STEAM1
                           ASSIST
                          STEAM JET
                              TIP
                             FLARE
                             STACK
                    COLLECTION
                      SYSTEM
                         MAIN LINE
                                      /

                                      V
                                         DRAIN
                                                        PILOT
                                                       BURNER

                                                      IGNITOR
                                                       TUBE
                                                            IGNITOR
                                                              r"lj     <> IGNITION
                                                                          GAS
                                                                      -? PILOT GAS
                                               WATER
                                                SEAL

                                                 KNOCK - OUT
                                               ~   POT
i
f.
s
Figure 5-1.   Conceptual  diagram of elevated  flare  system  (steam assisted).
                                        254

-------
fO
                    COLLECTION
                      SYSTEM
                          MAIN
                          LINE
                                                                                 GROUND - FLARE
                                                                                  ENCLOSURE
KNOCK - OUT
   POT
                                                                                                          IGNITION GAS

                                                                                                          PILOT GAS
                                     DRAIN
                                                                         BURNER
                                                                                                                 §
                                 Figure 5-2.  Conceptual diagram of ground  flare system.

-------
used for smaller volume,  routine process venting.   Elevated flares may be more
common, however.  A survey of 21 petroleum refineries in California indicated
that elevated flares made up 87 per cent of the total (1).

    Gases are collected through the collection piping and routed to the flare.
The collection  piping  consists  of  two basic parts:  the  main  flare line and
lateral lines to individual process units or vessels.  Proper operation of a
flare system depends on sizing  the  collection  system to  accommodate possible
simultaneous discharges of different processes at  different pressures  into the
flare system under widely varying flow rates.   Pressure drop considerations in
different parts of the collection system are.  therefore,  quite important.  The
maximum allowable line pressure is  limited by  the  lowest  pressure relief valve
discharging into the collection system.

    A seal pot is often installed between the  collection piping and the flare.
This water seal maintains some  positive  pressure  on  the  flare piping  collec-
tion system when there is no  discharge in order to prevent backflow from the
flare into the collection system.  Its primary purpose is to prevent air  from
getting into the collection piping.   Some systems  use mechanical  air restric-
tion seals.

    A knockout  drum is used between the  collection piping  and  the flare stack
to prevent liquid hydrocarbons entrained with  the  gas from entering the flare.
Entrained liquid or solid particles may  not totally  burn which would degrade
flare performance or even cause a "raining" fire.

     Other features of flares include air or steam injection at the flare type
to ensure smokeless operation,  and  the use  of a purge gas  flow  at low flow
rates to maintain gas velocity and ensure flame stability.

5.1.2  Applicability

     Flares may be applicable as protection  against  accidental releases of
toxic  chemicals when  the release  is  initially contained  within  piping or
ducting or  can be  routed to  the same,  for  example,  from a release within a
                                       256

-------
building, and when the toxic chemical is also combustible.  The  heating  value
of  the chemical must be sufficient to ensure its combustion  at  flare tempera-
ture conditions.

     Basic design requirements for flares burning toxic chemicals are:

     •    The ability to operate safely over a wide range of flow  rates
          and varying compositions.

     •    Have acceptable emissions of radiant heat and noise,  and

     •    Achieve  acceptable destruction  efficiency  for  the toxic
          chemical.

     Flow rates  for  flares  are  highly  variable because flare systems  are
designed for  intermittent  routine process or upset  and emergency venting.
Compositions vary because  gases  are  usually  controlled from multiple sources
within a process facility.  Elevated flares,  which are used for higher capaci-
ties than ground  flares,  are designed with  capacities as  high as  2 million
pounds per hour with turn-down  ratios of  as  much as a thousand.  There  are
estimates that over 95 per cent of the time,  these flares operate at less than
five per cent capacity (2).  The ability of flares to accommodate large varia-
tions in flow rate is an  important consideration  in using them for protection
against accidental chemical releases.  Depending on the size of  a flare  rela-
tive to a potential release, the accidental release flow rate may constitute a
large or small fraction of the total flare  flow  rate  and,  correspondingly,
could -have a significant or relatively minor  effect on the instantaneous  total
flow rate and flare performance.  For example,  in a  dedicated flare system,
where the accidental  release would constitute the entire  flow,  significant
variability and performance fluctuations could occur.   In a large shared  flare
system,  on the other hand,  the accidental release flow might not have a  large
effect  on variability and  performance if it  is a  small fraction  of  the  total
flow.
                                       257

-------
     Whether a  dedicated flare or  shared flare is  used depends  on site
specific  considerations.   A shared  flare may be advantageous  for several
reasons.  A dedicated flare system  for  infrequent  emergency use may be  dif-
ficult to safely maintain in full working condition.   A shared flare may allow
connection to an existing system.   With a shared flare,  however,  design  for
emergency conditions must  ensure  that a large release of toxic gas  does  not
overwhelm the flare and lead to flame blowout, or  that  the  pressure from the
toxic emergency release  does  not  cause a backflow into  other process units
tied into the flare collection piping.

     The primary compositional requirement of  flares  is  that  the vented  gases
are easily ignitable and have adequate heating value  to minimize supplementary
fuel requirements.

     A fundamental flare design variable is exit velocity.  Typical flare exit
velocities range from  0.2 to  400  ft/sec.  Excessive exit velocities cause
flame detachment from  the burner tip  or flare  quenching (flame-out).   A
typical limiting exit velocity is  AOO ft/sec or less, depending on  the  heat
content of the flare gas.  This criterion has  been recommended  by  the EPA to
ensure 98 percent  destruction  efficiency of flared chemicals using  a steam-
assisted flare  (3).  The  addition  of an accidental release discharge  to an
existing flare  must  not  cause  this  maximum flow to be exceeded.   The normal
maximum gas flow is determined by an inventory of all contributors to the gas
collection system  and  an  analysis  of  the probability  of various  streams
venting simultaneously.  From  this  total  flow  and  from the maximum  velocity
limitation the  flare diameter  can be  calculated.   The diameter  of  commercial
flares varies from several inches to about 3 feet.

     Empirical correlations have been developed for sizing the remaining flare
components.   Flame  length can be estimated  from the gas molecular weight
(which is related  to heat content), temperature, and  flow  rate.   The flame
length,  combined with limitations on allowable heat radiation to personnel and
equipment, is used to determine the height of the flare and the required clear
area around the base.  Numerous references present these calculations (4,5,6).
                                       258

-------
     Two other important design considerations for  flares  include  air  infil-
tration and flashback.  Water seals or mechanical seals are two means used to
prevent these conditions.  At low process  flows  a  purge gas may be used  to
maintain adequate flow  for  proper flare  operation.   In a dedicated flare it
might even be necessary to maintain a slight positive nitrogen pressure on the
system to preclude air infiltration.

     An existing  flare  system collects vent  gases  from process  units as
needed, as well as emissions  from pressure  relief valves and other emergency-
generated sources.  Some units may not be tied into  the  flare  system  for  an}'
of  several  reasons.   If a  process  unit  does not  require  periodic normal
venting or in an  old  facility relief  valves may  vent directly to the atmos-
phere.  Certain  precautions  should  be observed when connecting multiple
discharges to a flare system.  The  precautions are  avoidance  of  incompatible
chemicals, corrosive materials, and chemicals prone  to  fouling.   Concern  for
these chemical characteristics is significantly  greater in a chemical plant
than in a petroleum refinery where  much  traditional  experience on flaring is
based.

     For example,  some processes in chemical plants contain oxygen in  the  vent
stream.  Releasing hot gases containing oxygen into a fuel-rich mixture could
create a  flashback  or explosion.   Similar  results  could occur with  other
mutually reactive materials.

     Besides these incompatibilities between gases,  fouling caused by venting
a polymerization  reaction  or other viscous  substance into the  collection
network could occur.  Plugging could  eventually  cause a high back pressure in
the collection system,  preventing  relief valves  from  functioning  properly.
Organic liquids entering  the flare could  overload  the knockout drums  and
create rain fires.  Low vapor pressure liquids  could  flash,  condensing and
freezing water vapor in the line,  which would cause high back pressure.

     Another concern is corrosion of the pipe network, which is normally made
of mild steel.  Chlorides  and acids are  detrimental, although this is not a
critical concern in an emergency situation.
                                       259

-------
accidental release could damage the pipes or potentially affect the venting of
other process units.   Table 5-1 summarizes the factors that need to be consid-
ered to prevent accidental chemical releases when using a flare system.

5.1.3  Control Effectiveness

     Flaring protects against accidental toxic chemical  releases  by reducing
the quantity  of  toxic chemical released.   This  reduces the overall  conse-
quences of  the  release.   Ideally a  flare  would  destroy all  of the  toxic
chemical so none would be  released.  It  is  difficult  to  estimate  the  destruc-
tion and removal  efficiency  (DRE)  of flares because  of  the many variables
associated with  their operation.   Numerous studies  have been conducted to
determine the operational performance of flares.  EPA has  published a set  of
flare requirements that are meant to ensure 98 percent  or  greater destruction
of the gases (3).  These requirements include a gas  heating value of  at least
900 Btu/scf and  a maximum  gas  velocity  related to the heating value.  In an
emergency condition,  however,  these conditions might not be met.  For example.
a large release  of carbon  tetrachloride  could  significantly reduce  the lower
heating value of the  flare gas  since carbon tetrachloride  is nonflammable.  A
screening study  on some 25-30  compounds  performed on  1/16  and  1/8 inch diame-
ter test flares  generally  obtained over  99 percent destruction  efficiency
except for high  concentrations of carbon monoxide and  ammonia  (7).  A 100 ppm
hydrogen cyanide stream was only 85 percent controlled.

     It is difficult  to measure the  efficiency of an operating flare because
of the  intense  heat  and the instability of the flame.   Even pilot  scale
facilities encounter  these difficulties.  A properly  run elevated flare  uses
steam or forced air to increase turbulence and allow complete combustion.   The
gas flow can  vary instantaneously,  and  since the flame life is 2-3 seconds,
steady state conditions are reached very quickly.   As long as the accidental
released toxic  is combustible  and the volumetric rate does not  exceed the
capacity of the flare nozzle,  one would  expect a high DRE.

     In the case  of noncombustible vapors,  the use  of a flare would dramati-
cally increase the dispersion.  The  gas  velocity  in the flare  of up  to  400

                                      260

-------
  TABLE 5-1.  IMPORTANT CONSIDERATIONS FOR USING FLARES TO PREVENT
              ACCIDENTAL CHEMICAL RELEASES
•    Maximum flow rate - will it cause a flame blowout?

•    Possibility of air, oxygen, or other oxidant entering system?

•    Is gas combustible - will it smother the flare?

•    Will any reactions occur in collection system?

•    Can liquids enter the collection system?

•    Will liquids flash and  freeze,  overload knockout  drum  or  cause  rain
     fire?

•    Is the back pressure of the collection system dangerous to the
     releasing vessel?

•    Is releasing vessel gas pressure or temperature dangerous to collec-
     tion system?

•    Will acids or salts enter the collection system?

•    Will release go to an enclosed ground or to an elevated flare?

•    If toxic  is  not destroyed, what  are the effects  on surrounding
     community?
                                  261

-------
steam or forced air to increase turbulence and allow complete combustion.  The
gas flow can vary  instantaneously,  and since the flame life is 2-3 seconds,
steady state conditions are reached very quickly.  As  long  as  the accidental
released toxic  is  combustible and the volumetric  rate does not exceed  the
capacity of the flare nozzle,  one would expect a high DRE.

     In the case of noncombustible vapors, the  use  of  a flare  would dramati-
cally increase the dispersion.  The gas velocity  in the flare of  up  to 400
feet per second associated with the buoyancy  of the thermal  plume could easily
dilute ambient  concentrations  by several orders  of magnitude.   Some  non-
combustible compounds  could  possibly  undergo  a pyrolysis   reaction  in the
oxygen-lean portion of the flame,  especially  if hydrogen is  present.

     Because of the variable flow capacity,  high  temperature,  high gas  veloc-
ity, and usual remote locations,  using a flare to prevent accidental chemical
releases can be a highly effective technique.   Small or isolated vessels that
contain a process that does not require normal venting of a  flammable gas,  and
that employ relief valves  and  rupture disks  which may have  never been  used,
can be connected to a flare system to  prevent accidental releases.

     The number of potential  hazards associated with flaring include:

     •    Explosions  in the system;

     •    Obstruction in the  system;

     •    Low temperature embrittlement of the pipework;

     •    Heat radiation from the flame;

     •    Liquid carry over from the flare;  and

     •    Emission of toxic materials  from the flare.
                                       262

-------
     In designing and operating a  flare  system,  precautions  must  be taken to
prevent these hazards from occurring.  A rigorous examination of all probable
accident conditions  should be performed  with respect to  the hazards  listed
above to ensure  that using a  flare  system to prevent  accidental  chemical
releases does not create a greater environmental hazard.

5.1.4  Costs of Flare Systems

     As protection systems,  flares have  relatively low capital costs.  Ele-
vated flares, constructed mainly of pipe, are very inexpensive.   The flare tip
has  a  special  design for  efficient  steam, air  and  fuel  mixing.   Enclosed
ground flares are an order of magnitude more expensive because of the numerous
burner nozzles, refractory material, acoustical insulation,  etc.

     The operating costs of elevated flares, however, are high because of  the
need for a purge gas  and  steam injection.   Enclosed  flares  have  much smaller
pilot and purge gas  difference becomes a significant factor, which explains
the  use of  ground  flares  for normal process  flaring in conjunction with  an
elevated flare for emergencies.

     Table 5-2 compares the costs  (1986  dollars)  of  elevated  and ground level
flares (8).  The costs of two applications are presented, ethylene waste gas,
and  a low-Btu waste gas.  As  can be seen, initial costs for  the elevated  flare
are  significantly lower than  for the the ground flare.  Costs for connecting a
new  source to  an  existing flare system would depend  primarily on the piping
and  engineering costs for the modification.  The capital cost of  the elevated
system is  only moderately sensitive to flowrate.  The operating  costs, how-
ever, for the elevated flare  are proportional to the flowrate.  The operating
costs of the ground  fare  depend  little on size.  The costs  presented in the
table do not  include costs for the  collection system, which could easily
exceed the flare cost.  Also,  the  design basis  for the systems in this table
may not meet recently promulgated EPA requirements for a fuel gas  heat content
minimum of  300  Btu/scf.  This requirement  could raise the  operating costs
presented for the low-Btu waste gas example.
                                        263

-------
TABLE 5-2.   COST COMPARISON OF  ELEVATED  AND ENCLOSED GROUND FLARING SYSTEMS  (May  1986  Dollars)
Waste Gas
Flow Rate,
Ib/hr

I. Systems designed

25.000
250,000

II. Systems designed


2,500
25,000
250.000
Flare-Tip
Diameter, in.

for smokeless
3
8
24

for flaring of


3
8
24
Capital Total Annual
Cost* Cost
(S) ($/yr)

flaring of high-Btu (ethylene)
8.000
20.000
50.000 1.

low-Btu waste gases
pilots, purge

8.000
14,000
26.000
**
waste gases
16.000
150,000
450,000


and assist gas

6.500
52,000
480.000
Capital
Cost
($)


30.000
100,000
450.000




8,000
26.000
60.000
Total Annual
Cost
($/yr)


980
1.500
3.200


pilots and purge
(no assist gas)
980
1.500
3.200
     Complete elevated flaring system with stack of sufficient height to ensure mmritmn grade-level
                                2
     radiation of 1,500 Btu/hr/ft . ladders and platforms are all painted and ready for erection.


 jfjf
     Operating costs are based on 10 percent running time for flaring ethylene waste gases with continuous
                                                                      3
     natural  gas pilots and continuous natural gas purge at $2.00/1000 ft . steam at $0.02/lb.



     Operating costs are based on 10 percent running time for flaring low-Btu/ft  and molecular weight of
                                                                             3
     24-with  natural gas pilots,  continuous purge and assist gas at $2.00/1000 ft .
Source:  Adapted fron Reference 8.

-------
5.2  SCRUBBERS

     Absorption  is  the transfer of a  soluble  (or vapor)  into a  relatively
nonvolatile liquid.  Absorption of a gas or vapor by a liquid can be physical
only,  or  can result in a  chemical  reaction.   Regardless  of the  absorption
mechanism, intimate mixing of the gas  and  liquid  is  needed  to  achieve  a high
absorption efficiency.

     Scrubbers or gas  absorbers that remove both organic  and inorganic com-
pounds from gas  streams are  routinely  used in many process  facilities  for raw
material and/or  product recovery  and  as air pollution control  devices (9) .
There  are  several  standard types as well  as special designs  for specific
applications.  Scrubbers can be used in  some  situations to  control  emergency
releases of toxic chemicals if they are properly designed  and operated.

5.2.1  Process Description

     Mass transfer  equations  that  describe the absorption process have been
presented in numerous  other  works  and  are not  shown here  (10,11,12).   The
removal efficiency  of  a gas  is  a  complex function  of  equilibrium-related
factors (temperature, pressure, gas phase concentration,  liquid phase composi-
tion)  and kinetic factors  (gas-liquid  interfacial area, contact  time,  liquid
and gas rates,  etc.).   In general,  the  removal  effectiveness  of a  gas  by
absorption can be estimated from the vapor pressure  of the  gas at equilibrium
with the gas in the liquid.  If the gas equilibrium vapor  pressure of  the gas
is low, the gas can be readily absorbed in a properly designed  system.

     As protection devices for accidental chemical releases, scrubbers can be
used to control  toxic  gas releases  from emergency vents and pressure  relief
discharges from process equipment or vents from  secondary containment  enclo-
sures.   All scrubbers require a liquid  feed system and some  type of  contacting
mechanism to provide high  surface area  contact between the gas  and liquid.  A
schematic  of common absorber types is  shown in  Figure 5-3.   The internals of
column  or tower  absorbers  vary with with  application.  Formed  packings of
                                       265

-------
INLET OUTLET
7 t
MAKEUP Y_ ^^~/
LIQUID, ,, «~° g£&
i t



LIQUID Q
RECIRCULATION »
LOOP
VENTURI
GAS
OUTLET

,
MAKEUP


<§§§§§§§> INLET *~~*1

lNu£T ^"^^^i ..»'"- LIQUID
LOOP
J
PACKED BEDS
(COUNTERCURRENT)
GAS
OUTLET
t

K • i
/ \ > \ '
GAS ) 	 fc
INLET ^ m



^r- DEMISTER





_ XMAKEU
j *"f LIQUIC
'


IN KZ$ZZ%V \J_fc. QAS
X-VvySC^^ Is ^OUTLET
>^SoB22^L~ ^
[ .

C3 LIQUID
** RECIRCULATION
LOOP
(CROSSFLOW)
, MAKEUP
~^ LIQUID
LIQUID
RECIRCULATION 5
LOOP *
              SPRAY TOWER
Figure 5-3.  Three common types of scrubbers.
                     266

-------
plastic and other materials, perforated  trays,  valve  trays,  and open columns
with spray nozzles have all been used.  The types of absorbers most applicable
to accidental chemical releases  are  probably  spray  towers, packed  towers,  and
Venturis.  Spray towers  have the advantage of  low pressure  drop  and high
liquid-to-gas  (L/G)  ratios,  but the disadvantage of  low efficiencies.  The
open spray tower  is  used to reduce  plugging  problems for liquids that  may
contain  solids.   The other  tower internals  are  used with clean  liquids.
Venturis have the advantage of simplicity, but the  disadvantage of high  back-
pressure and  limited  removal efficiencies.  Packed towers have higher effi-
ciencies than spray towers but limited L/G ratios and a moderate backpressure.
Selection of  specific tower internals  is based on trade-offs  between the
surface  area  for  mass transfer  and  gas  side pressure  drop.   Vendors are
continually striving  to  develop high  area packings with low pressure drop
characteristics.

     The size of an absorber is determined by flow rate, the gas-liquid system
involved, and the removal efficiency required.  Flow rate determines diameter,
(or  cross-sectional  area) and  the  specific  system and  removal efficiency
determine the height  (or time in the contact zone) of an absorber.  In general
for packed beds or spray  towers,  the gas velocity is limited to a maximum of
about  10 feet per  second, which establishes  the  diameter for a given flow
rate.  The liquid  rate  is set based on  the L/G ratio required  to achieve a
specific removal rate for the particular  gas and solvent combination.

5.2.2  Applicability

     In general, absorbers are  appropriate for  protecting against accidental
releases of toxic chemicals  when the substance  released  is readily soluble in
some non-flammable absorbing medium,  and the  size  of  the  release  allows an
economically reasonable scrubber size.

     As discussed earlier, an absorber is sized to  handle certain  flow rates.
Significant variations in the flow can cause  severe operating problems.   High
gas rates cause flooding, weeping, and pressure surges in the column.  The
                                       267

-------
flow characteristics of the accidental release may be  steady  or  it  may be a
sudden surge load  on  the  absorber.   The  absorber must  be designed to accom-
modate these operational demands.   Absorbers for  emergency relief applications
typically operate under a slight positive pressure.   A  high pressure gas  surge
beyond the  absorber vessel design pressure  could  damage the vessel.  The
absorber must also be  designed  so that the pressure drop does not  create a
backpressure that would cause a destructive overpressure at  the source  of
release.  Such an  occurrence would cause a  greater release than  the one the
scrubber was trying to prevent.  Additionally, scrubbers must be designed to
accommodate hot gases, or  those that generate heat when  absorbed, to prevent
thermal damage to the  absorber,  vessel  liner, or  other  equipment.

     In the event of an accidental release,  the concentration  of  the gas  being
absorbed could be much higher than typically encountered in most industrial
applications.  Scrubbers designed specifically for emergency  discharges  will
have taken  this  into  account.   Ordinary  vent scrubbers may not  be  able  to
handle the  high  inlet  gas concentrations.   For  some  gases, absorption is an
exothermic  reaction.  At high concentrations and flow  rates,  the heat  gener-
ated may be sufficient to boil  all of the scrubbing liquid,  which could damage
the internals (if plastic), or  perhaps  cause a fire.

     Another consideration  is  the selection  of  scrubbing  solution.   Both
aqueous and organic  solutions  can be  used  as absorbents.   The  absorbent
selected depends on the absorption characteristics  of the toxic material  being
absorbed.  For example, while water may be satisfactory for hydrogen chloride,
an alkaline solution  is  required  for substantial removal of chlorine form a
gas stream.  It might  be possible to  use  organic  liquids  in some  situations  as
long as they are not flammable  or toxic.

     Compared with a flare system, which  may handle waste gases  from multiple
sources, absorbers are often dedicated to specific units.  Total plant capac-
ity absorbers are not  common because  of the diverse nature of  gas contaminants
and the poor turndown  ratio of  absorbers.   A typical turndown ratio is about
10:1.  Also, absorbers are not  readily adapted to handling flammable gases.
                                        268

-------
     Absorbers generate waste  material  in the form of blowdown  liquids and
solids.  Even  the regenerable systems  require  periodic  replacement of the
scrubbing solution as  it  degrades and  loses  activity.   The wastes  may be
hazardous, depending on the  contamination present  in  these streams,  which is
another disadvantage when absorber systems are  compared  to flares.   However,
for infrequent emergency use these disadvantages may not be critical.

5.2.3  Control Effectiveness

     The ability  of an absorber  to remove contaminants  from gas  streams is a
function of the parameters discussed previously.  Absorbers in process  appli-
cations or pollution control with steady  flow rates and  constant  compositions
are capable of very efficient  control.  The effectiveness  of a scrubber  for
protecting against accidental  releases  depends  on  whether  it  is  dedicated to
the emergency system or is  used  continuously with an emergency  tie-in.  In
general, unless the occurrence of an  accidental  release  significantly changes
the composition and flow  rate  of a gas  normally being scrubber,   the perfor-
mance of  the  non-dedicated  absorber  during a release incident would be ex-
pected to diminish only slightly.  As long as  the liquid phase chemistry  is
not disturbed, absorption should reduce the effects of an  accidental  release.
For critical  applications,  dedicated scrubbers are preferable  to  common
scrubber units.

     As an indicator of the  performance capabilities  of  scrubbers in typical
industrial applications. Table 5-3 shows  the removal efficiencies for various
organic compounds and solutions.  As  can  be seen,  most  of the compounds  are
effectively controlled.   These  types  of   efficiencies  are for commercial
scrubbers where economics may  be limiting  the  efficiency  feasible  for  long
term operation.   For  emergency  scrubbers, very high  efficiencies  may be
achievable that would not be  economical for sustained,   long-term operation.
Many other  compounds,  including H0S, HC1. SO,. Cl_, SO-,  NH,.  and other
                                  t+           J     £*     £t     
-------
         TABLE 5-3.  SUMMARY OF SELECTED TYPICAL COMMERCIAL ABSORPTION
                     EFFICIENCIES FOR VARIOUS INDUSTRIAL CHEMICALS
                                                                     % Control
Compound                             Scrubbing Liquid               Efficiency

Acetone/phenol                       water                              97
Acrylonitrile                        water                              99
Aniline                              dilute sulfuric acid              99.4
Chloroprene                          oil                                100
Chloroprene/neoprene                 oil                                97
Cyclohexanol/cyclohexanone           oil                                99
Formaldehyde                         water                              7 4
Methyl chloroform                    water                              90
Nitrobenzene                         water                              99+
Per/tri-chloroethylene               water                              90
Terephthalic acid                    water                             95.6
Dimethyl terephthalate               xylene                             97
Toluene diisocyante                  water                              60
Toluene diisocyante                  caustic solution                   98


Source:  Reference 13
                                      270

-------
operating cost  considerations  less important a very  high  efficiency may be
feasible.

     Table 5-4  provides an  example of the physical size and control capabil-
ities of  a  scrubber for a  hypothetical  50%  ammonia stream.  For  a highly
soluble gas like ammonia, relatively high efficiencies appear to be achievable
in a "reasonably" sized system.

5.2.A  Costs

     For a given application, the cost of a scrubber  system  depends  primarily
on  the  size,  as determined by  flow rate  and  removal efficiency required.
Materials of construction based  on corrosivity and pressure conditions  also
determine costs.   Specific  items included in the  system battery limits can
vary between  applications.   These  include ductwork,  fans  or  compressors,
scrubber  internals,  reagent feed systems, instrumentation requirements, and
degree of  redundancy.   Without  considering  a  specific  application,  it is
impossible to present a system cost.  Total capital costs (including installa-
tion, indirect costs, and other  fees) for absorber vessels have been presented
in the literature  in terms  of  column weight (14).  The weight is  related  to
the length  and  diameter of tie  absorber.  The  developed  correlation  was
presented on a log-log graph.  The data convert to the following equation:

          log (June 1981 $)  = 0.89 * log (column weight, Ibs) +0.62

     This corresponds to about $64,000  for a 5,000 pound  column and does not
include packing, platforms,  ladders,  ducting,  fans,  or other equipment.   It
does include face piping, some instrumentation, painting and insulation.

     Operating costs of absorbers  are highly variable.  They are affected  by
the type  of system  and  the reagents consumed.   Tail end absorbers  often
produce throwaway materials which  cause  high reagent  costs.   The regenerable
systems,  although  they  recycle  chemicals, incur costs  for  the  regeneration
step in the form of  steam,  reducing  gases,  or  other commodities.  Some costs
are also associated  with  pumping the liquid through  the  column  and fans or

                                        271

-------
           TABLE 5-4.  EXAMPLE OF PERFORMANCE CHARACTERISTICS FOR A
                       PACKED BED SCRUBBER
Basis:  Inlet stream of 50% NH, in 50% air.  Constant gas flow per unit
        cross-sectional area ox A55 scfm/ft .

Packing:  2 inch plastic Intaloz* saddles.

Pressure Drop:  0.5 inch water column

Removal Efficiency, %                     50              90
Liquid to Gas Ratio
  (gal/thousand scf)
    — at flooding                       160             160
    — operating                          80              80

Packed Height, ft.                       3.1             11.A


Column Diameter and Corresponding Gas Flow Rates for Both Removal Efficiencies


                       Column
                      Diameter             Flow Rate
                       (ft)                 (scfm)

                        0.5                   90
                        1.0                  360
                        2.0                1.400
                        6.3               14,000
                                       272

-------
compressors to move the gas.  Absorbers typically generate a gas side pressure
drop on  the  order of 0.1 to 0.3  psi.   Venturi absorbers can have pressure
drops as high as 3 psi. depending on Venturi throat size and L/G ratios.

     For emergency  scrubbers,  which are  used rarely  except for periodic
testing, operating  costs  other  than  maintenance  are not  particularly
important.   Selection of a specific system will be determined primarily by the
performance and capital cost.

5.3  ENCLOSURES

     Enclosing equipment and vessels that store or process toxic chemical are
another way of preventing or decreasing the  effects of an accidental chemical
release.  Enclosures are containment structures  that capture toxic  chemicals
spilled  or  vented from  storage or process  equipment, thereby preventing
immediate discharge to the  environment.   The enclosures contain the spilled
liquid or gas until it can  be  transferred to other  containment, discharged at
a controlled rate that would not be injurious to people or to the environment,
or transferred at a controlled  rate to  a  flare or scrubber.  While enclosures
may offer some  protection,  there may  also be disadvantages or secondary
hazards, which are discussed below.

5.3.1  Process Description

     Enclosures can be constructed around individual equipment items, .process
units, and entire plants, depending on  the nature of  the hazard being con-
trolled.  For example, many facilities  using solvents  might vent all of the
air in the manufacturing building through an  activated carbon  system.  In
laboratories and other small-scale facilities, small absorbers or filters may
be used on  the exhaust gases.  These type of systems are effective in control-
ling smaller emissions of toxic compounds in a normal  atmosphere.

     Reaction vessels may also  be enclosed in buildings.  However,  several
factors should be  considered in  the design  of such enclosures,  including
                                        273

-------
potential flanmability  and  explosive hazards.   Pressures  over 5  psi are
capable of destroying conventional buildings.

     Another enclosure scheme is to use underground  storage  tanks.   Although
it is  not  common practice to bury pressure vessels, many  tanks containing
volatile liquids are underground.   The overburden acts as an effective damper
on emissions  from such tanks.  The  use of underground  storage tanks for
preventing a  sudden  release of toxic  chemicals  is  an attractive  concept.
Regulations concerning  the  design and  operation of underground tanks  for
hazardous wastes are designed to prevent any  release to the environment  (15) .
Although regulations have not  been promulgated for  hazardous products,  the
same concern would be  expected.  These requirements are discussed further
below.

5.3.2  Applicability

     Enclosures are useful  for  preventing  the release of small amounts of &
toxic chemical because an enclosure can temporarily contain the  chemical  while
it is vented at a controlled rate to a control device  (see protection techno-
logies) suitable for removing the chemical  from the vented  stream.   A second-
ary hazard is explosion.  Enclosures must be used with caution, however.  For
example, a  small leak  of  a flammable  vapor  in  an enclosure  could be
concentrated to the LEL, causing an explosion if  a ventilation  system is not
properly designed.  Also,  the rupture of a  pressure vessel  within an enclosure
could overpressurize the enclosure, resulting in it  destruction.  When enclo-
sures are considered for  reducing  the potential of  an accidental   release,
safety aspects must be carefully reviewed to prevent greater hazards.  Enclo-
sures are more appropriate for non-flammable  toxic  chemicals  than  for toxic
ones.

     A modified form of enclosure is  the underground storage tank.   Hazardous
product and reactants  stored in underground tanks will  have  to conform to
regulations for these tanks.  Such tanks require approved  secondary contain-
ment which include external liners, vaults, and double wall  tanks  (15).   For
tanks of hazardous waste substances currently regulated, monitors  capable  of
detecting a leak within 24 hours must  be used,  and all underground  piping must
                                       274

-------
be  double walled.   Additional requirements  are  specified for  ignitable.
reactive,  and  incompatible wastes  in Fart  264.198  and 199.   Regulations
governing  release  detection,  prevention,  and correction are  expected  in  the
near future.  Congress has specified the following dates by which  EPA  regula-
tions must be promulgated for underground tanks (16):

     •    February 9, 1987 - regulations for existing and new
          petroleum tanks

     •    August 9, 1987 - regulations for new hazardous chemical
          product tanks

     •    August 9, 1988 - regulations for existing hazardous
          chemical product tanks

5.3.3  Control Effectiveness

     Enclosures may  be a  very effective means  of controlling  accidental
releases.  Depending on the type and design of the enclosure,  emissions could
be  almost  totally  controlled  since they could be confined until vented to a
destruction or capture device  such  as a flare or  scrubber.   These types  of
systems are used to control exothermic reactions that use pyrophoric reactants
(17).

     The  effectiveness  of enclosures  may be  compromised by  two  things:
flammable  materials  and  pressurized  vessels.  With  flammable  materials,
enclosures can create a secondary  hazard both without and with an accidental
release.  During routine  operations,  small leaks  of  a flammable substance in
an enclosed area can lead to the accumulation of a flammable vapor-air mixture
which, if  ignited, could  damage the enclosure  and process equipment, thus
causing the catastrophe it was  intended to prevent.   Proper ventilation could
reduce this hazard.  During a release, a properly designed enclosure should be
effective if the release  occurs at  a  low  to  moderate rate.  A sudden release
from a pressurized vessel, however, could overpressure the enclosure itself,
causing damage and releasing the chemical.   The enclosure would have served no

                                       275

-------
causing damage and releasing the chemical.  The enclosure would have served no
purpose.   Because the sudden catastrophic  failure  is less likely  than  a  large
uncontrolled leak, however,  an enclosure still might be  appropriate if  de-
signed with appropriate explosion relief venting.

5.3.4  Costs

     The variety of enclosures that can be used makes it difficult to  estimate
their costs.  Total containment systems can exceed the cost  of  the  controlled
vessel, since  they must  be larger than  the vessel and  still be designed to
meet the same criteria.  Costs for buildings with directed ventilation systems
can be estimated  easily;  however,  a total cost  can not be  assigned to  the
control system.  Small enclosures around process vessels or  equipment  can also
vary in  cost because of safety  considerations  (explosion risk, temperature
limitations, atmosphere requirements, etc.).  Additional  costs  are  associated
with the cleanup equipment needed when the enclosure becomes contaminated.

5.4  REFERENCES
1.   Product Line Reference  Catalog.   National Air Oil Burner  Company,  Inc.,
     Philadelphia, Pennsylvania,  1984.
2.   Joseph, D.,  et  al.   Evaluation of  the Efficiency  of Industrial  Flares:
     Background—Experimental   Design—Facility.    EPA-600/2-83-070   (NTIS
     P383-263723) August 1983.
3.   Federal Register.  Volume 50.  April  16,  1985.  pp.  14,941 - 14,945.
4.   Evans,  F. L., Jr.   Equipment Design Handbook for Refineries and  Chemical
     Plants.  Volume 2.  Gulf  Publishing,  Houston,  TX,  1974.
5^   Tan,  S. H.   Simplified Flare System Sizing.   Hydrocarbon Processing.
     October 1967.  p. 149.
6.   Kent,  G.  R.   Practical Design  of  Flare  Stacks.   Hydrocarbon Processing
     and Petroleum Refiner.  August  1964,  p.  121.
7.   Pohl,  J.  H.  and N.  R. Soelberg.  Evaluation  of the  Efficiency of Indus-
     trial  Flares:   Flare  Head Design and Gas  Composition.   EPA-60072-85-106
      (NTIS  PB86-100559) September  1985.
8.   Straitz, J. F. III.   Flaring with Maximum Energy Conservation.   Pollution
     Engineering.  Volume  12,  February 1980.   p.  47.
                                       276

-------
9.    Kohl. A.L. and  F.C.  Riesenfield.   Gas  Purification,  3rd Edition.  Gulf
     Publishing Corporation, September  1979.

10.  Perry, R.H.  Chemical Engineers' Handbook,  5th  Edition.   McGraw Hill,  New
     York, NY, 1973.

11.  Sherwood, T.K. and R.L.  Pigford,  Absorption and  Extraction,  2nd Edition.
     McGraw Hill,  New York. NY.  1952.

12.  Treyball. R.E.  Mass-Transfer Operations.  2nd Edition.   McGraw Hill,  New
     York, NY. 1968.

13.  Shareef. G.S. et al.  Hazardous/Toxic Air  Pollutant  Control Technology: A
     Literature Review.  EPA-600/2-84-194  (NTIS PB 85-137107) December 1984.

14.  Vatavuk. W.M.  and  R.B.  Neveril.   Costs of Gas Absorbers.   Part XIII.
     Chemical Engineering.  October  4,  1982,  pp.  135-136.

15.  Lees, F. P.  Loss Prevention in the Process  Industries.   Butterworth  and
     Company, Boston, MA,  1980.

16.  Federal Register.  July 14.  1986.  40 CFR  Parts 260,  261, 262,  264. 265.
     270.  and 271.

17.  Welding, T.V.  Operational  Experience with Total Containment  Systems  in
     Protection of Exothermic Reactors  and Pressurized Storage Vessels.   (EFCE
     Event 292).  Chester England, April 1984.
                                      277

-------
                                  APPENDIX A
                                   GLOSSARY

     This glossary defines selected terms  used in  the text  of this manual
which might be unfamiliar to some users or which might be used differently by
different authors.

Accidental release;   The unintentional spilling, leaking, pumping, purging,
emitting, emptying,  discharging,  escaping, dumping,  or disposing of a toxic
material into the environment in  a manner  that is  not in compliance with a
plant's federal,  state,  or local  environmental permits and  results in toxic
concentrations in the air that are a potential health threat  to the
surrounding community.

Alkane;  A chemical  compound consisting only of carbon and  hydrogen in which
the carbon atoms  are joined to each other  by single  bonds.

Assessment;  The  process whereby  the hazards which have been  identified are
evaluated in order to provide an  estimate  for the  level of  risk.

Autocatalytic: A chemical reaction which  is catalyzed by one of the products
of the reaction.

Carcinogen;  A cancer causing substance.

Containment/Control;  A system to which toxic emissions from  safety relief
discharges are routed to be controlled. A caustic scrubber and/or flare can
be containment/control devices.  These systems may serve the  dual function of
destructing continuous process exhaust gas emissions.
                                      278

-------
Contingency Plan;  A plan which describes the actions that facility personnel
will take to minimize the hazards to human health or the environment from
fires, explosions or accidental releases of hazardous materials.

Control System: A system designed to automatically maintain all controlled
process variables within a prescribed range.

Creative Checklist;  A list of major hazards and nuisances designed so that
when an individual item from the list is associated with a particular material
or a significant part of a unit, an image of a specific hazard or nuisance is
generated as a stimulus to the imagination of members of a tnultidisciplinary
team.

Creative Checklist Hazard and Operability Study;  A Hazard and Operability
Study which uses a Creative Checklist to stimulate a systematic, yet creative
search for hazards.

Emergency Response Plan;  A plan of action to be followed by source operators
after a toxic substance has been accidentally released to the atmosphere.  The
plan includes notification of authorities and impacted population zones,
minimizing the quantity of the discharge, etc.

Event Tree;  A logic diagram which depicts all pathways (success and failure)
originating from an initiating event.

Exothermic;  A term used to characterize the evolution of heat.  Specifically
refers to chemical reactions from which heat is evolved.

Facility;  A location at which a process or set of processes are used to
produce, refine or repackage chemicals, or a location where a large enough
inventory of chemicals are stored so that a significant accidental release of
a toxic chemical is possible.
                                      279

-------
Fault Tree;  A logic diagram which depicts the interrelationships of various
primary events and subevents to an undesired top event.

Fire Monitor:  A mechanical device holding a rotating nozzle,  which emits a
stream of water for use in firefighting.   Fire monitors  may be fixed in place
or may be portable.  A fire monitor allows one person to direct water on a
fire whereas a hose of the same flowrate  would require more than one person.

Guide Word Hazard and Operability Study;   A Hazard and Operability Study which
uses Guide Words to stimulate a systematic yet creative  search for hazards.

Hazard;  A source of danger.  The potential for death, injury  or other forms
of damage to life and property.

Hazard and Operability Study;  The application of a formal systematic critical
examination to the process and engineering intentions of the new facilities to
assess the hazard potential of maloperation of individual items of equipment
and the consequential effects on the facility as a whole.

Hygroscopic;  Readily taking up and retaining moisutre (water).

Identification;  The recognition of a situation, its causes and consequences
relating to a defined potential, e.g. Hazard Identification.

Lachrymator;  A substance which increases the flow of tears.

Mitigation;  Any measure taken to reduce  the severity of the adverse effects
associated with the accidental release of a hazardous chemical.

Mutagen;  An agent that causes biological mutation.

Plant;  A location at which a process or  set of processes are  used to produce,
refine, or repackage, chemicals.
                                      280

-------
Prevention;  Design and operating measures applied to a process to ensure that
primary containment of toxic chemicals is maintained.  Primary containment
means confinement of toxic chemicals within the equipment intended for normal
operating conditions.

Primary Containment; The containment provided by the piping, vessels and
machinery used in a facility for handling chemicals under normal operating
conditions.

Probability/potential!  A measure, either qualitative or quantitative, that an
event will occur within some unit of time.

Process;  The sequence of physical and chemical operations for the production,
refining, repackaging or storage of chemicals.

Process machinery;  Process equipment, such as pumps, compressors, heaters, or
agitators, that would not be categorized as piping and vessels.

Protection;  Measures taken to capture or destroy a toxic chemical that has
breached primary containment, but before an uncontrolled release to the
environment has occurred.

Pyrophoric;  A substance that spontaneously ignites in air at or below room
temperature without supply of heat, friction, or shock.

Qualitative Evaluation;  Assessing the risk of an accidental release at a
facility in relative terms; the end result of the assessment being a verbal
description of the risk.

Quantitative Evaluation;  Assessing the risk of an accidental release at a
facility in numerical terms; the end result of the assessment being some type
of number reflects risk, such as faults per year or mean time between failure.
                                      281

-------
Reactivity;  The ability of one chemical  to undergo a chemical  reaction with
another chemical.  Reactivity of one chemical  is  always  measured in reference
to the potential for reaction with itself or with another chemical. A chemical
is sometimes said to be "reactive",  or have high  "reactivity",  without
reference to another chemical.  Usually this means that  the chemical has the
ability to react with common materials such as water, or common materials of
construction such as carbon steel.

Redundancy;  For control systems,  redundancy is the presence of a second piece
of control equipment where only one would be required.  The second piece of
equipment is installed to act as a backup in the  event that the primary piece
of equipment fails.  Redundant equipment  can be installed to backup all or
selected portions of a control system.

Risk;  The probability that a hazard may  be realized at  any specified level in
a given span of time.

Secondary Containment;  Process equipment specifically designed to contain
material that has breached primary containment before the material is released
to the environment and becomes an accidental release.  A vent duct and
scrubber that are attached to the outlet  of a  pressure relief device are
examples of secondary containment.

Teratogenic;  Causing anomalies of formation or development.

Toxicity;  A measure of the adverse health effects of exposure to a chemical.
                                      282

-------
                      TABLE B-l.
         APPENDIX B
      METRIC (SI) CONVERSION FACTORS
   Quantity
To Convert From
To
Multiply  By
Length:

Area:


Volume:


Mass (weight) :


Pressure:



Temperature:

Caloric Value;
Enthalpy:

Specific-Heat
Capacity:
Density:

Concentration:

Flowrate:

Velocity:

Viscosity:
in
ft
in
ft2

in
ft3
gal
Ib
short ton (ton)
short ton (ton)
atm
mm Hg
psia
psig
°F
°C
Btu/lb
Btu/lbmol
kcal/gmol
Btu/lb-°F

Ib/ft
Ib/gal
oz/gal
quarts/gal
gal/min
gal/day
ft /min
ft/min
ft/sec
centipoise (CP)
cm
5
cm.
2
m,
3
cm.
3
m_
3
m
kg
Mg
metric ton (t)
kPa
kPa
kPa
kPa*
°c*
K*
kj/kg
kJ/kgmol
kJ/kgmol
kJ/kg-°C
3

kg/m3
kg/m
J / J
cm /m
m./min
m,/day
m /min
m/min
m/sec
Pa-s (kg/m-s)
2.54
0.3048
6.4516
0.0929

16.39
0.0283
0.0038
0.4536
0.9072
0.9072
101.3
0.133
6.895
(psig)+14.696)x(6.895)
(5/9)x(°F-32)
°C+273.15
2.326
2.326
4.184
4.1868

16.02
119.8

25,000
0.0038
0.0038
0.0283
0.3048
0.3048
0.001
  *Calculate as  indicated

  Source:  Adapted  from Reference 22.

-------