UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
REQION '
J.F. KENNEDY FEDERAL BUILDING, BOSTON, MASSACHUSETTS 02203-221 1
AN OUTREACH PROGRAM of the
PLANNING AND MANAGEMENT DIVISION of the
U.S. ENVIRONMENTAL PROTECTION AGENCY, REGION I
A Perspective on the
Prevention, Prediction and Response
Aspects of Major Chemical Accidents
January 7, 1990
This document provides basic information for use by the
public, emergency planners, fire chiefs, plant managers and
process operators, and state and local government
employees. Additional copies, and a companion four-hour,
audio-visual module for presentation to interested public
groups are available from Region 1 on request
-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
REGION I
J.F. KENNEDY FEDERAL BUILDING, BOSTON, MASSACHUSETTS 02203-2211
January 1, 1990
Dear Reader:
Attached is a guidance document on the three key points of major chemical
accident concerns - Prevention, Prediction, and Response.
The information which is presented is believed by the author to be consistent
with the teachings of the agencies and organizations which have jurisdiction or
special competency in the subject area. It is intended to be of help to people in
enhancing public safety. However, it is not presented as a statement of
>rtandatory safety engineering. And no assurance is made that a particular
action or control if implemented, wtil prevent a future chemical accident.
The U.S. Environmental Protection Agency, and the U.S. department of Labor -
OSHA have primary jurisdiction respectively for community and occupational
safety. The U.S. Coast Guard has jurisdiction in matters involving navigable
waters. And , it provides support services to federal state and local authorities.
If you have questions, members of these agencies will be pleased to be of service
to you. Key EPA and OSHA personnel in Region I (New England States) whom
you can contact directly for particular information are:
The U.S. Environmental Protection Agency (EPA)
SARA Title 111: Reporting. Inventories, and Technical Program Information
Thomas D' Avanzo (617) 565-4502
Chemical Safetu Auditing - Ray Dinardo (617) 860-4385
The U.S. D.O.L - OSHA
Technical and Compliance - Occupational Health and Safetu Standards -
Dr. Ronald Ratney (617) 565-7164. Fred Mallaby, CIH (617) 565-7164
The U.S. Coast Guard Strike Team, Atlantic Area, Commanding Officer:
LGDR. G. A. Wiltshire has a 24-hour emergency service: (205) 694-6601.
If you need additional information, or have questions about this document, please
contact Norman Beddows, Regional Industrial Hygienist and Safety Manager,
EPA-Region 1, Planning and Management Division (617) 565-3388.
-------
ACKNOWLEDGMENT
Some of the presented Information is drawn from The 1987 Proceedings of the International
Symposium on Preventing Major Chemical Accidents (Editor, J.L. Woodward). This symposium
was jointly sponsored by the American Institute of Chemical Engineers. The U.S. Environmental
Protection Agency. The World Bank, and The Center for Chemical Process Safety. Other
information is drawn from publications and guidance documents issued by the National
Response Team (Chairman: J.L. Makris, U.S. EPA, Washington. D.C. (202) 475-8600)
The permission of the American Institute Of Chemical Engineers to use information and
physical data relating to preventing major chemical accidents, obtained from the referenced
1987 proceedings, is acknowledged with gratitude.
I am indebted to Mr. Steven Homann, Homann Associates. Fremont, California for his critique
of the parts on industrial hygiene, and area exposure modeling using the Gaussian model
EPICODE - which is used herein to illustrate the principles of vapor dispersion modeling.
Reference to this user-friendly product, however, is not an official Agency endorsement.
I gratefully acknowledge the review and comments on the chemical safety engineering and
methodology parts, by Mr. William Early. Corporate Safety Manager. Chemical Engineering
Division, Stone and Webster Company. Houston. Texas.
The perspective which is presented Is believed to be consistent with the teachings of the
relevant regulatory authorities. However, in the final analysis, it is a personal one. It does not
necessarily reflect the views or rules of any of the organizations mentioned.
Norm Beddows
ii
-------
A Perspective on the
Prevention, Prediction and Response
Aspects of Major Chemical Accidents
Norman A. Beddows CIH, CSP.
Abstract
This document is presented in support of an outreach program of the U.S. Environmental
Protection Agency. Region 1. under the 1986 Right To Know Act (EPRA).
It provides basic information for use by local emergency planners, fire chiefs, chemical plant
managers and personnel, chemical safety auditors, state and local government employees and
the public. This information will serve as a basis for discussion between the public and
chemical facility managers to promote harmony in potentially contentious situations. And, it
will serve as a basis for developing protocols for chemical safety auditing of many of the
operations which comprise the highly variable chemical industry.
A background is provided In standards, regulations, motivation and policies. This complements
information provided by the federal National Response Team, chaired by the U.S. Environmental
Protection Agency. Chemical hazards are discussed. Aspects of prevention, prediction and
response for major chemical accidents are presented.
For prevention: hazard analysis techniques are described, and matters of experience and
guidance are discussed, especially in context with information provided in the 1989 U.S.
Environmental Protection Agency's publication "CHEMICAL ACCIDENT PREVENTION
BULLETIN." Also, certain engineering and administrative controls for safety are identified and
described.
For prediction: hazard identification is described, and an explanation is given of how potential
exposures and health and safety risks can be evaluated. Also, explanations and examples of
the use of computer software for developing emergency prediction information are provided.
For emergency response: acute exposure risks are identified. Means of personal protection are
discussed. Also, certain suppression and containment techniques are explained.
ill
-------
INTRODUCTION
Concern over the safety of manufacturing, transporting and using extremely
hazardous chemicals is worldwide. Bhopal1, Seveso2, the Rhine River Spill3, and
other environmental catastrophes have made this so. Nationally, there is an
increased awareness and concern. A great many people in the United States
think that a major chemical accident will happen domestically in the next fifty
years4. At the local level, many communities in which explosive or toxic
chemicals are made or handled are fearful. Large residential areas and
institutions have been established in some communities around chemical plants
and tanks, which preceded them.
The U.S. Environmental Protection Agency (EPA) has been one of the principle
agencies to date in developing policies and programs for preventing and
mitigating major chemical accidents (involving either (i) extremely hazardous
substances or (ii) hazardous sustances, as defined at Parts 101 (14) and 355
of Title 40, and section 1910.1200(c) of Title 29, of the Code of Federal
Regulations). Other agencies who have primary responsibilities are the
Department of Transportation, the Department of Labor - OSHA, and the U.S.
Coastguard. In 1985, the U.S. Environmental Protection Agency introduced
comprehensive accident prevention and emergency preparedness programs for
use in the private and public sectors to protect the public. And the Superfund
Amendment Reauthorization Act (SARA) of 1986 provided for community
involvement in accident prevention, and prescribed programs for emergency
-------
2
planning and notification. The relevant SARA programs are rather technical.
However, dialogue between all the parties which EPA and OSHA promotes will
off-set this.
The American Institute of Chemical Engineers, the Center for Chemical Process
Safety, The World Bank, the chemical industry itself, and numerous technical
societies5 also support the private and public sectors in their efforts for
chemical safety. Even so, some of the public believe that not enough is being
done to protect them against potentially catastrophic effects from major
chemical accidents. Evidently some of the public believe that some involuntary
risks are substantially greater than levels reported by the governments' or the
industrys' experts. Most people understand that there are inherent hazards in
producing, using or transporting chemicals. Most people agree that the public's
safety must be fully maintained. Few would agree, however, on a level of
balance needed to achieve both optimal safety and economic viability in a
chemical industry. Also, some people want the government to regulate the
design and operation of chemical plants, in the same way that the Nuclear
Regulatory Commission regulates design, construction, quality assurance and
operation in the nuclear power generation industry6. The chemical industries
resist this viewpoint. The U.S. Environmental Protection Agency evidently is
not intent on regulating the design or operation of chemical plants and
processes7. Rather, it seeks to have industries comply voluntarily with the
highest standards for safety.
-------
3
Federal and state agencies promote the use of the best practical technology,
compliance with stringent standards and recommendations8, and mutual
cooperation of plant managers, emergency planners and the public. They
ensure that local officials, fire fighters, and citizens have access to detailed
information on chemical hazards. They have provided the risk-bearers and the
local officials a real role in emergency prevention. Specifically, the U.S.
Environmental Protection Agency requires facilities to undertake emergency
planning, and be involved with state and local officials in emergency planning
when an extremely hazardous substance equal to or in excess of its
threshold planning quantity is present [40 CPR 355.30(a)]. The agency itself
has broad police powers aimed at preventing and mitigating accidents.
The U.S. DOL - OSHA exerts an influence on chemical plant design and
operation by enforcing specific standards and regulations, and, in the final
analysis, by requiring the employer to provide work and workplaces for the
employees which are free of recognizable hazards.
Complete regulation of the design of chemical processes would be very difficult.
The industry is highly diversified in the chemicals which it uses and
manufactures, and in the kinds of processes and equipment which it employs.
No one set of safety criteria applies to even a single operation, and no sets of
criteria apply as a basis for identifying all of the chemicals and processes which
could be of concern. There are literally hundreds of relevant, mostly
specification-oriented safety standards, codes and guidelines for the industry.
-------
4
Performance-oriented standards also exist. The latter type has special value
for highly variable process operations. Several national technical societies
provide research support for safety. Some standards and groups are shown in
Table 1.
STANDARDS, CODES. GUIDELINES & ORGANIZATIONS
National Fire Protection Association (NFPA)
NFPA 30 - Flammable & Combustible Liquids
NFPA 58/59/59A - Liquid petroleum: new designs
American Petroleum Institute (API)
API 650 - tanks welded steel
API 520/521 - design, construction, systems
API 526 - flanges, safety/relief valves
API Guidelines publication # 7580: Lessons learnt
API Recommended Practice # 1112: DOT response; emergencies.
API 2000 - venting low pressure storage tanks
American National Standards Institute (ANSI)
ANSI-B 31.3 - piping, chemical plant
ANSI.B 16.9 - overpressure design/piping
American Society Mechanical Engineers - Guidelines and Standards
American Institute of Chemical Engineers - Guidelines and Standards.
The Occupational Safety and Health Administration (OSHA) - The General Duty
Clause: employers to provide safe workplaces, at 29 CFR1910.5(a)(l).
The Emergency response rule, at 29 CFR Part 1910.120.
Table 1. Some Standards, Codes, Guidelines And Organizations
Motivation and Policies
Most managers in the domestic chemical industries are very committed to
providing the highest achievable level of safety. They are morally motivated.
The industries themselves are strongly motivated to provide maximal safety.
They are so persuaded by the potential for criminal citation, the possible
imposition of jail sentences on executives, and the great financial liability which
-------
5
exists with a major chemical accident. However, to some extent, some plants
are de-motivated by the low economic viability of some processes, and by
frequent turn-over in executive management. In some plants, an emphasis on
minimizing costs of investment and operations without due regard to the
required level of engineered safety is evident.
Optimal safety in the chemical process industry may not be achieved through
regulation alone. The highest level of chemical safety is likely to be attained
only by industry, government and the public working openly together. Much
can be achieved. Government could provide consultative services to the
industry. Chemical safety audits, separate from enforcement actions, could be
offered without plant managers fearing a threat of a first-instance sanction.
The public could become more informed on chemical safety matters and more
generally realize that great economic loss can arise by unwarranted pressure
on chemical manufacturers, users or transporters. The industries might more
openly advocate their programs for public safety, and ensure that their
management systems are appropriate. Companies must make sure that efforts
to minimize costs of investment and operations are not translated into
implementing only minimal safety programs. Requiring only minimal
safeguards, and minimal investment in equipment, real estate, and labor,
without regard to the potential for a catastrophic accident, because a process
or plant is mature or has a poor profitability, is quite unacceptable. The total
resources of a company - not merely the short-term cash flow picture of a profit
and loss center - must be available when first needed to achieve safety.
-------
6
The managers of chemical industry and the heads of the agencies which are
primarily involved should ensure that their senior staffs include experts in plant
layout for safety; process and unit operations safety; and safety engineering.
And, persons will be needed who will deal authentically with the concerns of
the public.
Chemical Hazards
Airborne concentration and exposure duration are the key factors of potential
acute health hazard with most chemical exposures. The most common concern
of route of exposure is inhalation. Dermal exposure is another important
concern - about a quarter of the known extremely hazardous substances show
dermal toxicity. Airborne concentration is the primary factor of fire or explosion
hazard with a flammable gas, vapor or mist. Pressure and temperature, of
course, greatly affect both the potential for detonation with any given system,
and the destructive energy of a gaseous release in an accident.
For toxicity, the relationship of concentration and duration of exposure, and the
potential for toxic lethality are not the same for all extremely hazardous
chemicals. As an example, the impact of methyl isocyanate (MIC) increases
rapidly as the exposure time increases, even when the initial, short-term
exposure is without apparent effect; whereas the toxicity of chlorine or
ammonia does not disproportionately increase with increasing duration of
exposure. For these two chemicals, the initial dose is the significant
determinant of severity of effect. The influence of duration of (inhalation)
-------
7
exposure on response, regarding a serious hazard with a gas or vapor, may be
evaluated using the ratio of the 10 minute and the 30 minute median lethal
concentrations (LCSOs) from animal studies, when these data are known. As
an example. MIC exhibits a 10 minute. LC50. and a 30 minute LC50,
respectively, of approximately 600 and 100 parts per million (ppm) - a 6:1
ratio. However, chlorine exhibits a 10 minute LC50. and 30 minute LC50.
respectively, of approximately 450 ppm, and 250 ppm - a 2:1 ratio.
Comparisons can be made in other ways. Table 2 provides data.
CHEMICAL IDLH LC50/10' LC50/30* BPt Ht.VAP"
[Extreme Hazard] [ppm] Ippm] [ppm] *C KJ/KG
PHOSGENE 2 72 24 8 253
BROMINE 10 651 376 59 194
HYDROGEN FLUORIDE 20 992 331 19 1562
CHLORINE 25 433 250 -34 288
HYDROGEN CYANIDE 60 597 277 26 935
HYDROGEN SULPHIDE 300 550 441 -62 550
SULPHUR DIOXIDE 100 1882 627 -10 1882
HYDROGEN CHLORIDE IQO 5555 1850 -84 443
AMMONIA 500 20,000 11540 10 1374
LC50/10' = Median Lethal Concentration. 10 minutes, animal studies.
Source: PROCEEDINGS: 1987 SYMPOSIUM ON PREVENTING MAJOR CHEMICAL ACCIDENTS.
American Institute of Chemical Engineers.
Table 2. Some Toxicologies! and Physical Property Data.
-------
8
ASPECTS OF PREVENTION
Hazard Analysis and Chemical Safety Auditing
The diversity and complexity of the chemical industry and its processes are so
great that even the use of the most comprehensive line-by-line check lists (such
as the thousands-of-line sized lists used in the petroleum industry in
conjunction with other analytical schemes) is not fully adequate for hazard
analysis. Systematic evaluations involving consideration of potential inter-
related, contributing events are also needed. These types of evaluations should
be conducted by a team of specialists, for the maximum benefit. People with
experience in the particular chemical plant or process in case should be part
of every team. A systems-approach coupled with specific expertise is the
preferred basis for making a chemical safety audit. In California and New
Jersey, this is mandatory and analytical methods are prescribed. At times,
chemical safety auditing calls for the skills of a safety consultant or the prime
contractor who has special knowledge of the particular process. They will work
with the in-house engineers and specialists.
Formal analytical techniques are now used throughout the chemical and
petroleum industries to prevent losses and solve problems. No one technique
is the universal method of choice. A hazard analysis technique which is very
beneficial when used at the conceptual stage of a project, might not provide the
information necessary to identify and correct an existing problem. The
technique to use in a particular situation needs to be carefully selected.
-------
9
Safety engineering techniques - Hazard Inventory, Risk Analysis, Fault Tree
Analysis, Event Tree Analysis, Hazard and Operability Studies (HAZOPS), and
Failure Modes And Effects Analysis (FMEA) are described briefly here.
Hazard Inventory. This technique8 is applicable to both the design and
operation of a chemical plant. It involves identifying and classifying risks in
terms of (a) the types and qualities of toxic and hazardous chemicals which are
stored or used, (b) the storage and handling conditions or practices employed,
and (c) the engineering and management systems involved. The recording of
physical spacing is important. Distances should be set aside for safety
assurance. Typically, a 200 foot spacing around hazardous operations is used
to enhance safety and make mitigation of liquid releases easier. Dikes are used
to contain liquid spills and subsequent dispersion when either flammable
materials are stored in any way in the plant, or potentially interactive factors
of hazard exist -such as a spill of flammable liquid spreading under a storage
tank of hydrogen cyanide.
No special format for record-keeping is required or specified for hazard
inventory. The technique is useful for making improvements in plant lay-out,
process control, and risk management. It is a requirement for conducting a
comprehensive safety audit. Lastly, an inventory of extremely hazardous
substances in reportable quantities (RQ) is mandatory under SARA Title 111.
-------
10
Risk Analysis. This is a technique9 for characterizing risks which is especially
useful in designing plants; siting plants; and changing processes. It helps
coordinators to plan for emergencies. It is used throughout the chemical and
petroleum industries. Risk analysis involves three basic steps: (a) identifying
failure cases and modes; (b) assessing the respective consequences of the
identified failures (in the case of a detonation risk with a chemical
accident, the destructive energy and impact effects at distances may be
expressed as an equivalent amount of TNT explosive); and (c) estimating the
respective probabilities of the failures. These factors are considered together for
each event in assessing impact. Identifying failure cases involves knowing the
inventories of toxic or hazardous chemicals, and carefully considering process
flows, piping, control instrumentation, and modes of operation. Check-lists and
"What If evaluations are used for this purpose. After characterizing events, a
grid of risk classes (low, medium, high) is made, as a record of the analysis.
Assessing the consequences of a failure in the above scheme involves classifying
the possible outcome of an accident in terms of human health and safety (and
ecology and community welfare). For this, modeling releases for toxic or
fire/explosive impacts is very useful. In modeling, assessment is based on
plausible worst-case scenarios. Also, potential exposures are assumed, and the
issue is whether or not the concentrations and the durations of exposure at
various locations would be sufficient to cause serious, acute (or chronic) health
hazards. Also, fire risks are assessed. In making a risk analysis for a
chemical plant, information on frequency of failure is needed. Histories of
-------
11
physical plant equipment, system and operator failures are useful for this
purpose. In many chemical plants, a data base already exists in the
maintenance department, which may be used for this purpose. The technique
is limited in usefulness when data of failure or accident rates are scant or
incomplete, or when the models used for evaluating exposures are inaccurate
or otherwise limited. Risk analysis can be of great value in designing and
siting new plants, and in operating existing ones. As a yardstick of risk, one
"standard" for acceptable (major accident) risk is one in a million/year - -
10'Vyear. Systems reliability studies of complex processes are especially
important to designers. Several techniques exist for use in design work and
safety management, and may have preferred applications. These include Fault
Tree analysis, and Event Tree Analysis. These techniques are used extensively
in the chemical industry, and are briefly described here.
Fault Tree Analysis. This technique10, involves identifying and defining modes
of failure called "top events." Two examples of top events are the release of
a toxic gas from a rupture in a pressure vessel; and the thermal runaway of a
chemical reaction in a vessel.
For each top event, precedent events and combinations of precedents which
lead directly to the failure are identified. A "tree" diagram of causes and effect
is developed. The diagram shows (a) causation, and (b) estimates of the
associated frequencies of occurrences. In this way, the contributory causes and
the direct cause of a failure or accident are found, and required preventative
-------
12
actions are identified. A feature of fault tree analysis is the use of AND and
OR gates to express logical cause and effect relationships. Rules for
construction exist. A safety analyst and individuals who have knowledge and
experience of the type of plant and process involved are needed to perform the
analysis.
Event Tree Analysis. This is another systems reliability technique11. The "event
tree" is similar in format to the "fault tree", except that "bottom events" are
first identified. Thereafter, the possible outcomes from these bottom events are
stated, and a series of "gate" questions, with YES and NO strings (with assigned
probabilities) are employed. This technique allows human error and other
factors to be shown in relationship to consequences.
Figures la and Ib illustrate typical branches of the "Fault Tree", and the "Event
Tree", respectively (without the estimates).
-------
13
CATASTROPHIC
FAILURE
JL
COOLANT FLOW
STOPPED
1
START
EXOTHERN
r
COOLANT
LINE BREAK
1
1
ASSUMED OK.
NO COOLANT
FLOW INDICATOR
INOPERATIVE
MH
Vf
REOO. VISUAL
CHECK- NONE
»
COOLANT STRAINER
BLOCKED
TOXIC GAS
RELEASE
Figure la: Fault Tree Form Figure Ib: Event Tree Form
Hazard and Operability Studies - HAZOPS. This is a technique12 which
involves the systematic identification and evaluation of possible routes to failure
in a system. It provides a basis for conducting a thorough safety evaluation
of a new plant design, making recommendations for major improvements to
proposed or existing processes, and developing reliability and risk analyses. It
is used extensively in the chemical and petroleum industries at the design stage
for risk identification and problem resolution. HAZOPS uses a study-team
approach to address sets of potential problems and produce alternative
-------
14
solutions. The technique is labor-intensive. Typically, several hundreds of
man-days will be expended in studying piping and instrumentation for a new
plant, before anything is ordered.
The basic procedure in a HAZOPS is to ask certain guide-words during the
course of scrutinizing many possible operating conditions and deviations. This
identifies possible causes of potential accidents. What if questions using guide-
words are asked. For example, "what if more temperature occurred"; "what if
reverse flow occurred"; "what if more pressure arose"; "what if more time
elapsed in a self-heat situation." The words more, reverse and similar
descriptors are used in this way to explore potential upsets whose
consequences are to be evaluated.
Failure Modes and Effects Analysis (FMEA). This is a simple, widely-used
technique13, similar to HAZOPS. It is used to systematically identify possible
failure modes and inter-related factors. It involves the use of first-principles
and engineering experience in looking at components separately, and identifying
possible ways of failure.
Information on Experience and Guidance
Personal experience in chemical processing, knowledge of the proximate and
contributory causes of past accidents and near-misses, and knowledge of design
and the principles of hazard analysis are indispensable for managing an
accident prevention program. A historical perspective is also indispensable.
-------
15
Some points on these matters are discussed here. And findings are reported
from a 1989 study by the U.S. Environmental Protection Agency-of why
chemical accidents happen.
Chemical Accident and Release Information
The U.S. Environmental Protection Agency's Chemical Accident Prevention
Bulletin (July 1989, OSWER-89-008-1) provides information on why chemical
accidents occur. The bulletin focuses on reports of accidents, and a database,
developed under Title III requirements. This information is intended to provide
local emergency planning committees with the means of holding useful dialogs
with local facilities on accident prevention and investigation. The Accidental
Release Information Program (ARIP) findings are:
• "The most frequently released chemicals in the ARIP database have been
chlorine, methyl chloride, ammonia, sulfuric acid, and sodium hydroxide—all
large-volume industrial chemicals.
• Most of the releases occurred at facilities that manufacture chemicals or other
products.
• Although accidents commonly have more than one cause, the most commonly
cited causes are equipment failure and operator error.
• About a quarter of the releases were from storage vessels, and a similar
number from piping and process vessels. Valves and other equipment
contributed to a smaller fraction of releases.
• Most releases occurred during routine processing of chemicals; loading,
unloading, and maintenance played a lesser, but significant role."
-------
16
Remarks On Storage Tank Accidents
Storage vessel accidents feature in about a quarter of the (SARA) reported
accidental releases; releases of one hundred to one thousand or more gallons
are most often involved. Some of the more common causes of failure involved
are mechanical impact; embrittlement; delamination; and internal development
of a vacumm - "sucking in." Incorrect selection or fabrication of construction
material can lead to failure. Plasticized polymers continuously exposed in use
to leaching agents, such as sodium hydroxide, are prime candidates for impact
or cyclical stress failure. A blockage of a vent at the time of emptying can
cause an internal vacumm, and lead to collapse.
Safety Design and Operation Criteria for Tanks and Storage re: Extremely
Hazardous Substances.
Criteria for evaluating storage tank and related activities include the following:
• a roof over a tank and bunded area (weather protection)
• impervious, sloping, non-reactive, low heat-tranfer base support
• vertical concrete (higher than flood plain height) walls for containment
• strong barriers to guard against impact from trucks
• a drainless, insulated sump tank (200 gallon ?) for lesser spill containment,
equipped with: a pump or air lift for rainwater; a non-return flap valve; and a
vent leading to an absorption or a destruction unit
• tank pipework connections and pumps above the tank top
• remote-operated, Teflon seat-ball valves, and internal plug valves.
NOTE: IN SOME SAFETY DESIGNS, A BOTTOM VALVE IS PRECLUDED.
-------
17
• pressure and temperature, multiple sensors
• a piping flow control system to prevent the simultaneous feeding and
discharge of the tank
• no sharing of vent pipes for any system component
• no dead volume space in valve, loop, vent or pipe places
• mimimal inventory, balanced against risks involved in material loading and
transfer
• wind-indicators (windsock), strategically placed
• physical separation from potential harm (such as from a fire from a spill,
affecting another vessel), and from critical plant structures and boundaries
• dedicated fire fighting equipment, dedicated personal protective equipment,
and means of access for accident mitigation
• formal standard operating procedures covering such points as (i) material-
handling, (ii) trained personnel only allowed as operators, (iii) the correct
selection, use, and maintenance and storage of personal protective equipment,
and (iv) the proper handling and storage of transfer lines and equipment -
transfer lines must never be left on the ground, dirt will get on the connection
surfaces. A raised open-grid metal trough should should be used for storage.
Other general aspects of safeguarding tanks and associated equipment are
mentioned elsewhere. As a final comment here, the use of rail-cars as a
permanent in-process inventory storage facility for an extremely hazardous
substance without the safeguards mentioned is not prudent.
-------
18
Figure 2 shows some possible features of construction for storage tank safety.
"TOP-ELIMINATE INSOLATION/RAIN
PIPEWORK PIM» ABOVE TOP
INTERLOCK ON FILL / EMPTY TEFLON SEATED VALVE
REDUNDANT LEVEL M JT _ 4,
DETECTOR/CONTROLLERS
IMPACT RESISTANT HALL
LOW HEAT TRANSFER MATERIAL-
' ' rc:c' *
f f.l. f
• f .
TANK ANCHORED DOWN
IALL VALVES AUTO
VALVES ME WE
"HINDSOCK
6AS VENT—MABSORBER)
KALL ABOVE FLOOD PLAIN
LEVEL
NON RETURN FLAP YAH
* ' " - :"* «?••»"
DRAINLESS SUMP
RAIN1MTER PUMP
Figure 2. Safety Design features for Storage Tanks
Remarks On Pressure Vessel Accidents
Pressure vessels are extensively used in chemical processing; they are involved
in many major accidents. Over-pressurization and inadequate pressure relief
capability are causes. However, these are not the dominant ones. More
common causes involve failure of the non-pressurized parts of the system
because of corrosion, wear, impact or human error in the design or operational
stages. Other common causes include exotherms in stagnant pools of reactive
-------
19
material In dead spaces, and loss of coolant in a reactor self-heat failure (the
latter point is illustrated in Figure la). Some general aspects of safeguarding
reactor vessels and associated equipment are mentioned later.
Controls For Process Safety
Potential areas of future accidents in existing plants are aging facilities, reduced
investments in equipment and maintenance, a reduction in the availability of
skilled operators and maintenance personnel, and a thin-spreading of the
available cadre of skilled process operators and chemical safety engineers. At
the time of start-up of a new plant or process, experienced or skilled personnel
may be in short supply, limitations can be severe. This is a vulnerable time
when the value of incorporated engineered control is often demonstrated.
Safety depends on the use of engineered controls as least as much as on
operator-skill.
To ensure that plants operate at the lowest risk, comprehensive engineering
plans, together with safety programs, are needed. Both types of control must
be considered in the design phase and the plant operation phase. At the
conceptual engineering and design time, major efforts in process hazard
analysis must be made. This includes studying any alternative chemistries and
processes to make sure that the least hazardous reactants and conditions are
used. On this point, the toxicity of a chemical may be greatly changed by a
minor change to the molecule. Also, the vapor hazard with a process may be
decreased by increasing reactant molecular weight. As an example, in a series
-------
20
of (moderately) exothermic Friedel Craft/Schotten-Baumann reactions, the
substitution of extremely hazardous phosgene (boiling point:8°C) by benzoyl
chloride (boiling point: 140°C) is sometimes possible, while still making the same
desired product:
[PHOSGENE] COCL, + C.H. ~[AlCLJ-> CJH.COC1 + C.HJfH, - [NaOH] -,
[BENZOYL CHLORIDE] C^COCl + CANH, —[NaOH]—>C6HaCONHC.H5<--i
Other examples of risk reduction with chemistry-process changes are:
• mercury free dyemaking (replacing mercury catalysed AQ sulphonation, CIBA-
GEIGY process)
• continuous polymerization of styrene in a closed system (rather than batch-
processing in a vented pressure vessel, MONSANTO process)
• the use of a condenser on a vent on a pressure vessel charged with toxic
reactants.
It must be said, however, that the oportunity to use alternative chemistries and
processes is generally quite limited. Nevertheless, the point is worth reiterating
that a formal procedure should be established to ensure that the senior
managers are given information on options, so that they can properly manage
the risks.
To minimize risks of fire and explosion, the design of new or modified chemical
plants should require certain critical processes and facilities to be remote and
-------
21
physically isolated from both each other and the plant boundary. Guidance on
such safeguarding is provided in various API and NFPA codes. Also, local and
state codes are useful (and applicable). Providing safety by distance is an
effective way to control explosion risk. And physical isolation can be very
effective in limiting the potential damage from spills of flammable or corrosive
liquids. Invariably, using distance as a safety control entails greater first-costs
for real estate, compared to using a close-packed (less safe) layout. Safety and
net economy may have to be strongly argued during the cost-benefit reviews.
The point which may need making is that the cost of a major accident, however
infrequent, is always very great. The Bhopal settlement cost a reported $470
millions!
Passive (Intrinsic) and Active (Extrinsic) Safeguards
To incorporate safety in new and existing facilities, one needs to employ both
passive and active principles.
Passive principles are policies and plans, essentially. These include such
matters as:
• requiring each plant to have Standard Review Plans, and Standard Safety
Operating Plans. These plans would cover evaluation of potential accidents;
dispersion prediction information; groundwater protection; safety assurance in
new or changed processes, facilities or operations; mandatory periodic meetings
-------
22
with local planners, interested citizens and media personnel who may be
involved in public safety; safe working practices, including the "buddy" system
with high hazard activities; and other points.
• requiring critical facilities to be located in remote locations and safeguarded
by distance and diking, when appropriate.
• requiring design for mitigation of accidents.
• requiring experts to participate in the selection and sizing of pressure relief
equipment and flame arresters; in vessel and piping construction and material
selection; and in decision-making on process automation-versus-manual control
• requiring a human factors engineer to participate in the concept and design
stages of planned new construction
• requiring pre-processing system leak checks, and periodic, non-destructive
testing of vessels and parts involved in any high hazard process
• requiring regular formal inspections of all process piping, flanges and gaskets,
and instrumentation when they are part of, or service any high hazard process
• requiring the use of hard wired back-up for critical interlocks, and alarms on
hazardous processes
• requiring multiple, and different types of, controls on hazardous processes
(control redundancy)
• requiring electrical, coolant and other critical services, and tanks and
equipment for extremely hazardous chemicals, to be physically protected against
accidental impact or abrasion, and "backed - up" by emergency services.
-------
23
• emphasizing that flash point and auto-ignition point are not constants, and
that the dynamics (e.g., agitation) of the process can create risks
• requiring studies of potential rates of reaction and self-heat rates (in some
studies of upsets, 1000°C/minute plus, instantaneous rates have been reported)
• requiring pilot plant scale-up studies for safety in new processes, and safety
rules for each pilot plant
• requiring the preferential selection of reactants, processes and conditions
which pose the least impact on the community in an accidental release.
• requiring feasible pressure relief systems to match plausible worst-case
overpressurization/self-heat conditions
• requiring reactor vessels to be operated at the lowest feasible pressures and
temperatures (a cubic foot of gas at 2000 psi and 20°C has about as much
potential energy to do some harm as has a pound of TNT, even if the release
modes are different!)
• having a firm policy of physically protecting tanks, gas lines, and critical
valves and lines against impact by fork-lift and other types of trucks
• prohibiting any physical change or procedural change to any process and
procedure, regardless of any percieved inutility, without the express permission
of both the Manager of Engineering and the Manager of Safety. This
prohibition would be conspicuously posted on the equipment.
-------
24
Active principles are related to operating or using engineering and
administrative controls. Such active safeguarding includes using:
• pressure relief devices. Most importantly, such devices need to be sized to
match the pressure generated in a maximal self-heat case, when this is
physically feasible
• rupture discs. The associated pipes and support-structure must be strong
enough to absorb the potential rupture thrust force
• automated detector systems for critical process parameters
• back-up storage/liquid spill containment capacity (flexible tanks are available
with capacities up to 100,000 gallons)
• a separator and a containment vessel. These would be installed in-line, after
a rupture disc or relief valve
• inerting and explosion-venting of low pressure tanks used for storing
flammable liquids at or above their respective flash points
• periodic acoustical-testing of critical fiberglass and metal tanks, vessels and
parts
• dedicated fire-fighting, and personal protection equipment
• a multi-channel automated monitor/alarm system for leak detection, with all
extremely hazardous chemical processes
• a back-up containment pressure vessel (properly-sized, larger than the
primary reactor) for highly poisonous chemicals, such as phosgene or hydrogen
cyanide
• positive-pressurization of (i) an on-site command center, and (ii) electrical
controllers and devices in hazardous (DIVISIONS I and 2) locations
-------
25
« a TFE-fluorocarbon valve seat with a valve in a high hazard system, to assure
full closure of the valve
• a public communication procedure and system for emergency action,
including public evacuation (on which the public must be well-informed before
any accident occurs).
In using active safeguards, the design and equipment employed should be in
accordance with the most recent and stringent regulations and standards.
They should also meet the standards of the relevant guidance from competent
authorities, such as insurers. It is noted that some consensual safety standards
do not address or meet ail of the needs for safety in some situations. And
design should accommodate the plausible worst-case regarding self-heat,
corrosion and wear, not the average cases. On the point of effective codes,
safety standardization has made considerable progress in recent years. This
has come from newer engineering design guidelines and process simulation with
computerization. The American Institute of Chemical Engineers, the chemical
safety design institutes, the American Society of Mechanical Engineers and the
larger engineering companies have made major contributions in these areas.
Controlling Contributory Human Error
Many major chemical accident reports point to human error - error in operation
or maintenance as the proximate cause. Accidents are often attributed to an
operator's error, without due regard to the existence of other contributors, such
as inadequate design or poor administration.
-------
26
Controlling all contributory human error is important for safety. This involves
such matters as:
• removing repetitive tasks from the operator's direct control. This involves
automation using reliable appropriate sensors and controllers
• making a process tolerant of an operator error. For example, use maximum
or minimum liquid level controllers; maximum temperature shut-offs; flow rate
controllers, and (high-high/low-low) limit controllers
• simplifying vessel construction, piping, and operating features
o using valves and equipment with the better rating for use in severe chemical
environments, whenever extremely hazardous substances are involved
• color-coding and labelling pipes, and labelling valves
• operating vent pipes to scrubbers under a slight negative pressure, with
appropriate sensing and interlocking of critical functions, to control accidental
releases (as might occur in starting up a process with an open vent valve)
o automating infrequent process-termination steps
• holding safety talks which include stressing the point that automation does
not reduce the need for safety training. If anything, it makes the training of
operators and maintenance personnel even more critical to safe operations.
a providing specific instruction and training to operators and maintenance
personnel
• providing refresher training at least annually to operators and maintenance
personnel, and first-responders - to whom standard 29 CFR 1910.120 applies
o not assuming that a trained and instructed operator will perform a task
consistently and will not deviate from a standard operating procedure.
-------
27
• involving operators and workers in chemical safety audits
• giving the operator control of a critical service. For example, the operator
would have lock-out control of a (normally open) water-line on a process chiller.
• conducting mock exercises to assure a satisfactory response to an accidental
spill, and test the (mandatory) spill prevention and counter measure plan.
Management, and Management Systems
Most managers throughout the chemical process industry are highly committed
to the cause of safety and environmental protection. Many of them undergo
continuing education, and participate in relevant technical meetings. However,
some of the systems and practices that some managers employ do not indicate
or reflect a high level of commitment.
Safety management systems, methods for assessing plans, and procedures for
evaluating risks and auditing practices are an integral part of every successful
management program for accident prevention. The importance that the
management places on safety must be seen in the actions of the managers and
staff. The general manager, the senior managers and their staffs need to be
involved personally in meetings with employees, local officials, interested
citizens, and local media personnel at appropriate times. The safety committee
must meet at least monthly. Also, all process operations should be observed
regularly to make sure that "short-cuts" have not been introduced. And
managers must guard against accident risks from a decline in an operator's
ability or fitness. Operators and shop stewards must appreciate this need.
-------
28
ASPECTS OF PREDICTION
Hazard identification and modeling of atmospheric dispersion of extremely
hazardous chemical releases underlie developing emergency prediction
information. The acute health risk is determined from the acute exposure data,
the kinds of end-points resulting from the exposures, and the probabilities of
the exposures occurring.
Hazard Identification, and Hazard Determinants
Toxicity and physical properties are major determinants of acute health hazard.
And boiling point, density and latent heat of vaporization underlie the vapor
hazard from a release. Terrain and meteorology influence dispersion. Also,
dispersion depends on the type of release, and the nature of the chemical itself.
As an example of how a chemical property can influence dispersion, look at a
denser-than-air gas release. Chlorine gas, which is about twice as dense as air,
tends to follow the line of least resistance to travel, when it is undiluted. In
reported cases of a major chlorine release, one frequently reads about chlorine
moving down a valley.
Another example of the effect of a physical property on dispersion, is that of a
liquid which has a specific heat lower that another liquid with a similar boiling
point vaporizing relatively faster, with a similar heat input, On the preceding
point, compare chlorine and ammonia:
CHLORINE: B.Pt: -34°C. Ht.Vapn.: 288 kJ/kg.
AMMONIA: B.Pt: -33°C. Ht.Vap".: 1374 kJ/kg.
-------
29
With other factors being equal, in some spill situations, ammonia will evaporate
relatively slower than chlorine because of its greater heat of vaporization.
Regarding terrain and meteorology, examples of relevant effects are:
• the sun immediately heating the ground-level air, causing turbulence and
enhanced dispersion
• nighttime cooling and stratification of ground-level air, causing reduced
turbulence and dispersion (nighttime releases frequently pose potentially serious
impacts)
• structures and obstacles, such as tall buildings in city centers and trees in
urban areas, creating a degree of meteorological ground roughness which
provides enhanced air turbulence and relatively greater dispersion.
Methodology Underlying Prediction Information Software
Software products are commercially available14 for modeling air releases for
acute health risk analysis. At this time, there are about 40 models available
for evaluating vapor cloud dispersions (the Center for Chemical Process Safety
of the American Institute of Chemical Engineers published a guideline review
of such models in 1987).
Underlying the methodology used with many such models is classification and
quantification of:
t the release - as a continuous release; term release; area-term release, or area-
continuous release
-------
30
• the atmospheric stability - in terms of wind-speed, daytime sunlight, and
nighttime clouds
• the terrain: city-terrain or standard-terrain.
Deposition rates and other factors also apply.
Commercial software products are usually based on the Gaussian Plume
model15. This model is widely accepted and it is the work-horse for emergency
prediction purposes. In some instances, sophisticated versions of the model are
used which can factor into the dispersion estimate the effects of complex
terrain, buoyancy, and the thermodynamic factors with the chemical release.
In other cases, different dispersion models which are quite complex are used.
Examples of such models are those used for modeling dispersion of isotopes,
prescribed in the NRC Regulatory Guide #1.111.
Figure 3 shows typical (minimal) input for a simple and very useful model for
predicting emergency information, with a generally acceptable level of precision,
bearing in mind the limited accuracy existing for the dose-response picture for
most of the chemicals of concern.
-------
31
CONTINUOUS
RELEASE
RATE » ?
TERM RELEASE
DURATION * ?
j
AREA CONTINUOUS
EFF. AREA » ?
J
QUANTITY » ?
<
1 EVAP. RATE * ? 1
TOTAL
JEFF. REL. HEIGHT • ?|
I
• ?
AREA
EFF.
,1
RELEASE
TERM
AREA * ?
DURATION * ?]
TOTAL « ? |
J .
METEOROLOGICAL
CONDITIONS
(STANDARD TERRAIN | | CITY TERRAIN
+ , ., ,
*
STABILITY
CLASS
OUTPUT/OPTIONS
Figure 3. Input for Emergency Prediction Information
Typical Output of A Simple Model
The typical output of a simple emergency prediction information includes:
• optional monochrome or color screen display
• print-outs of concentrations at down-wind and cross-wind locations and
distances (in units of miles or kilometers)
• receptor-height concentrations (in units of part per million-ppm, or milligram
per cubic meter-mg/m3)
• arrival times, in minutes or hours, of airborne concentrations distributions
(plumes), downwind and cross-wind of the release.
-------
32
• a summary of the program input; and
• sometimes, airborne concentrations expressed in terms of the "immediately
dangerous to life or health" (IDLH) value, and/or the DOL. OSHA Permissible
Exposure Limit(s) (PEL) or the ACGIH Threshold Limit Value(s) (TLV) for the
chemical.
Figures 4 and 5 show the output obtained with one product16 for a hypothetical
release - a nighttime, ground-level, 5-minute release of 1000 pounds of
phosgene from a ruptured tank. The wind speed is 1 mile per hour. The
terrain is open level country (standard terrain). In this example, relevant
concentrations are expressed in terms of: parts per million; the IDLH-value
(phosgene: 2 parts per million); and the 8-hour, time weighted average,
threshold limit value (0.1 part per million).
1.5
1.4
1.2
l.i
0.9
0.8
0.6
0.5
0.3
0.2
o.o
-0.2
a -0.3
0 -0.5
* -0.6
3 -0-8
g -0.9
S-i.i
-1.2
-1.4
-1.5
u,
u
3
GREATER THAN TWA'
GREATER THAN IDLH
GREATER THAN 0.1 TWA
I PHOSGENE I
• i • i 1 i i
.3 .6 1 3 6 10
DOWNWIND DISTANCE MILES
30 60 100
Figure 4. Down-Wind and Cross-Wind Concentrations
-------
33
PHOSGENE CAS Number: [75-44-5]
TWA : 0.10 ppm TWA : 0.40 mg/m"3
IDLH : 2 ppm
DOWNWIND MAXIMUM CONCENTRATION ARRIVAL TIME
Distance-Mi mg/mA3 ppm hours:minutes
0.10 120000 30000 : 6
0.20 30000 7300 :12
0.30 13000 3200 :18
0.40 7100 1700 :24
0.50 4400 1100 :30
0.60 3000 740 :36
0.70 2200 630 :42
0.80 1600 400 :48
0.90 1300 310 :54
1.00 1000 250 1:0
2.00 170 42 2: 0
4.00 16 3.9 4: 0
6.00 6.6 1.6 6: 0
8.00 3.4 0.63 8: 0
10.0 2.0 0.60 10: 0
20.0 0.42 0.10 20: 0
Figure 5. Arrival Times, Distances, and Concentrations
Precision of Predictive data
The predictive information obtained from current models is only approximate,
but it is usually good enough, to be very useful in decision-making for
emergencies. With simple models, when dense gases are involved, over-
prediction of airborne levels may occur because of the non-neutral buoyancy
conditions. However, reportedly, for low levels below about five percent, the
effect is usually minor and it conservatively influences the output. Comparative
test data for establishing precision are not plentiful. A sufficient number of
tests have been conducted by the federal government (in particular, the U.S.
Department of Energy, in the mid-80's) and private organizations whose
-------
34
reported results can be used to evaluate a simple model (which actually can be
more useful in a real emergency than a less user-friendly, more sophisticated
one because of a stop occurring with the use of the latter type model when
data are unknown). As a general comment on precision, software vendors claim
that agreement between actual and predicted data for releases of extremely
hazardous chemicals is often about x3 - x5, either way. Reportedly, agreement
is optimal when the region of concern is (i) outside of the immediate zone of the
release, that is the area of concern is more than 250 feet away from the site
of release, and (ii) lies in level, open terrain.
Specific performance and comparative test data for the commercially available
products are available from the suppliers.
Using Predictive Information, and Exposure Guidelines
When emergency data and prediction information on a release have been
obtained, the next step is to compare them to the known or assessed, relevant
immediately dangerous to life or health (IDLH) level17. This is done to establish
the zone of vulnerability.
In practice, the zone will be set-up using either a fractional value of one-fifth
or one-tenth of the IDLH, depending of the judgment of the responsible
coordinator. When an IDLH value is unknown, ten times (or somewhat greater)
the threshold limit value18 (TLV) for the chemical, if it is known, may be useful
(and conservative) as an approximation of the IDLH level (others have proposed
-------
35
using a x500 factor, this could be too great in some cases, in the view of the
writer). The selection of such a factor requires informed judgment.
ASPECTS OP RESPONSE TO RELEASES
Despite the best of preventative planning, major chemical accidents happen,
and mitigation plans must be developed beforehand, in the plan must be
requirements for well-trained response personnel and appropriate equipment
being immediately available, and procedures for in-plant and community
communications being in place. Specific federal (OSHA and EPA) regulations
apply to each one of these points.
In planning for mitigation, one needs to identify potential hazards, and evaluate
potential exposures and durations of exposures. A plausible worst-case
scenario is to be used when accurate information is missing. With regard to
hazards, when a flammable liquid or gas is released, a fire may result within
a matter of minutes when the vapor or mist concentration is above the relevant
lower flammable limit (LFL) [the more familiar concern in this regard is a major
accidental release of light hydrocarbons or LPG, which is to be dreaded]. Static
electricity and other sources for initiating a fire must be presumed to exist in
all such releases. The primary safeguard in such a case is rapid evacuation.
Apart from the risk of fire, exposures involving inhalation of toxic substances
and dermal uptake of such substances must be presumed to arise, unless
-------
36
information to the contrary is known. Initially, in responding to a release of a
toxic chemical, maximal risk is to be presumed to exist, and maximal personal
protection is presumed to be needed. Thus, a self contained breathing
apparatus, in the pressure demand mode, together with a fully encapsulating
suit, will be used by each responder. Only after hazards have been properly
assessed can any lower level of protection be employed.
Large-scale releases of many chemicals can present serious health hazards
through inhalation at distances which are several miles downwind of the site
of the release, even though there is no accompanying fire hazard. This could
require either rapid evacuation or the public staying indoors with the windows
closed, depending on the risk.
When a ground-level release of a volatile, toxic chemical occurs, the responders
who are close to the release are the ones who first face imminent danger,
regardless of their compass location. In the case of a ground-level release of
a denser-than-air liquid, the spill can move initially against the wind direction.
First-responders must be thoroughly trained and instructed in handling
releases. People at the work site can be exposed within minutes of the start
of the release. And the local community - people who are down-wind by several
miles may become seriously exposed within the hour or thereabouts, depending
on the wind speed, the magnitude of the release, and other factors.
Communities farther away may be exposed to serious or non-serious conditions
within a few hours. The point is that dangerous exposures can confront
-------
37
employees, workers and people In the nearby communities within minutes of
the start of a major chemical accident. Everyone must be Instantly alerted and
told what to do. They must be informed in advance what the public alarm is,
and what they must do when the alarm is given (that is, evacuate, stay indoors,
listen to a radio station, obey officials, et cetera). It must be realized that in
some grave accidents, people who are more than ten miles from the release may
experience a serious harm or a major nuisance within a few hours of the start
of the release.
To safeguard people who might be affected in a major chemical accident, a
contingency plan must be in place. The plan must be thoroughly understood
and practiced by those who are required to take corrective action, and by the
people who will be affected. It must cover or require, amongst other things:
• a company-fire department-citizens plan for emergency alert, evacuation, and
other safety needs
• engineered containment, and provision of needed equipment, such as a pump
and a flexible (instant) storage tank
• assurance of the immediate availability of trained personnel
• assurance of the immediate availability of personal protection. At least six
sets of either Level A or Level B protection will be required, depending on the
hazards involved
• administrative procedures to inform the public, to be in place.
-------
38
Personal Protection
Personal protection for first-responders and those Involved in cleanup efforts
must be selected on the basis of the route of entry, and the toxicity of the
chemical of concern. Protection against a chemical which poses potentially
serious inhalation and dermal (including eye) hazards, such as liquid chlorine
(first degree hazard), would require the use of a self-contained breathing
apparatus (SCBA), and a fully encapsulating suit: Level A in U.S. EPA
terminology19. In the case of a serious inhalation hazard only, a self-contained
breathing apparatus, with suitable body covering (Level B protection) would be
required.
NOTE: A distinction may be made between going into a normally safe area
and undertaking a potentially hazardous activity, such as transfering
hydrogen cyanide from a rail car, and entering a site wherein a release of
an extremely hazardous substance has occurred, with respect to
respiratory protection prcedures and equipment for use. This topic, and
the requirements for a respiratory protection program are too extensive
to be discussed here. Specific regulations under OSHA and EPA must be
consulted, and the provisions applied, before a first response is
implemented. Detailed information on respiratory protection and related
matters is given in the Niosh Publication, #85.115; the OSHA standards
at 29 CPR. 1910.134, and 1910.120; and the EPA standard at 40 CFR 311
- which extends application of the OSHA standard to state and local
agencies.
-------
39
Containment, and Suppression of Vaporization
Physical containment and reduction of vaporization of liquid are needed to
mitigate a release. A concrete berm and catchments need to be constructed.
Other requirements include:
• reduction of the spill surface area (to control vaporization)
• reduction of heat transfer to any pool of a liquid of low specific heat (for
vaporization control). Use lightweight or thermally insulated concrete.
• provision of sunshade (for controlling temperature and pressure increases in
containers, and to reduce vaporization rate)
• assurance that the floor of the containment structure does not dangerously
absorb or react with the spilled material. Asphalt should not be used below a
tank containing a strong oxidant
• assurance that drainage is provided for collection (via a sump), and that
storm and sewer drains are not contaminated
• physical shielding of structures against wind, to reduce dispersion
• the use of reactive materials to absorb or neutralize a chemical, provided that
this can be done without excessive, rapid energy (heat) liberation. For
example, sand might be used under a hydrofluoric acid tank, for neutralization
of minor spills. The stoichiometry is favorable:
6HF + SiO3 — > HaSiFa + 2IL.O
-------
40
Foam For Vapor Containment and Fire Hazard Control
The vaporization rate of a pool of flammable and non-flammable liquid can be
reduced in some situations using foam. Fire risks from petroleum spills are
commonly controlled using foam. This basically involves keeping air away from
the liquid surface.
Foam application to an outdoor pool of a toxic chemical can be effective in
reducing the effects of insolation and air flow on the dispersion rate. Also,
foam can be useful in some cases in controlling the movement of the associated
air plume. However, the application of foam to a spill can also cause
dispersion, especially when the liquid has a low specific heat, relative to the
foam. Using foam to control exposures or contain a spill with an extremely
toxic, highly volatile liquid is of questionable value. Using a foam for an indoor
release of an extremely hazardous, very volatile liquid -as might occur in a
laboratory accident - is not correct. Blanketing the spill with foam would make
the problem worse. Foam application, collapse and reapplication would add
heat to the pool, and increase the pool area. This would increase the
vaporization rate and cause the indoor concentration to increase.
When foam is planned to be used in a response to a major chemical accident,
consideration must be given to:
• the compatibility of the foam with the chemical
• the foam expansion factor [EF] - the volume of foam divided by the volume
of water used to make the foam.
-------
41
[Note foam characteristics, by EF, are:
EF=10, heavy and wet; EF=100, firm; and EF=200, light and mobile].
• the drainage of the foam (the amount of water from the collapse of a volume
of foam). More water can add heat to the pool.
Most importantly, the advantages of using a foam - suppression of the
concentration immediately above the pool of the spill, and reduction in the
effects of insolation and wind dispersion - must be weighed against providing
a heat gain to the pool being covered, thus increasing the vaporization rate.
Water Used For Dispersion or Containment
Reducing acute hazards from a release of a water-soluble, toxic liquid or a toxic
chemical which readily hydrolyses, such as titanium tetrachloride, can be
achieved with water. A water spray can be effective in dispersing a release of
a combustible or flammable liquid, and in holding concentrations below the
lower flammable limit [for most flammable liquids, this limit lies in the range
of about 0.7 (7000 ppm) to about 5 percent (50,000 parts per million)].
Spraying is usually done using a high flow/fine (fog) spray nozzle. Application
is made from downstream, when this can be achieved without risk. When
envelopment in a cloud of a flammable vapor or a toxic chemical is likely,
application is made from upstream.
-------
42
Containment of a plume of a low solubility, denser-than-air vapor or gas, such
as chlorine, can be effectively achieved using a water spray. Also, the
movement of a toxic plume can be controlled in this way.
A water spray should not be applied to any large mass of an alkaline earth
carbide or an alkali metal. In the latter cases, acetylene and hydrogen,
respectively, would evolve and create a fire hazard. However, water can be
sprayed on a reactive, toxic, inorganic halide, such as boron trifluoride,
phosphurous trichloride, tin tetrachloride, and titanium tetrachloride, to reduce
dispersion; acid vapors which are themselves toxic will of course be created.
A pool of immiscible, non-reactive liquid which is denser than water can be
contained using a water blanket. This effectively controls vaporization and
facilitates recovery or neutralization. Spills of carbon disulfide and liquid
bromine can be handled in this manner.
Other Containment, and Control Measures
Sand, sulphate powder, granular powder, and certain polymeric powders can
be used to contain spills. The underlying principle of using a solid sorbent is
to reduce the liquid surface area, and, consequently, the rate of vaporization.
The density of the bulk of the solid material which is to be used should be less
than the density of the spilled liquid. The powder must not react violently
with the liquid. It must be fine enough to provide a thick cover.
-------
43
Chemical neutralization, physical barriers, the use of fans, the use of plugs and
patches and ignition are other containment and control measures. These are
mentioned briefly here:
• neutralization of an acid spill can be achieved using soda ash
• neutralization and solidification of some acid or caustic spills can be achieved
using commercially available products
• an impervious cover placed over a volatile liquid spill can effectively reduce
vaporization
• fans can be used to disperse vapors from a flammable liquid spill so that the
lower flammable level is not reached. Use totally enclosed, fan cooled (TEFC)
motors with the proper NFPA 30 class-division-group rating
• a plug or a patch can be used to stop a leak from a vessel (these remedies
have been pioneered by the Chlorine Institute)
• a quick-setting adhesive, or magnetic damps, with a gasket and cover
arrangement can be used to contain some leaks
• ignition may be used to minimize the escape of a release of a flammable
vapor or toxic gas, such as hydrogen cyanide or hydrogen sulphide. However,
ignition (as distinct from high temperature incineration) is not useful for
controlling a toxic gas release when its concentration is lower than its lower
flammability limit, at which time the concentrations could still be potentially
lethal. Also, the use of ignition is counter-indicated for chemicals whose
oxidation products are toxic. For example, chlorine-containing hydrocarbons
produce phosgene when they are burned in the open.
-------
44
Administrative Efforts For Safety and Public Assurance
An ounce of prevention is worth a pound of cure. This is especially true in
safety management. Managers need to make sure that new plant or projects
involving major changes are bid to exacting safety specifications. The bidder
will offer generally sound safety engineering, but some bidders do not always
have all of the expertise needed for safety assurance. Also, they will offer
whatever is deemed competitive.
Training and instruction of personnel needs to be ongoing. Refresher safety
training in specific operations and standard safety operation procedures (SSOPs)
are essential for safety. Automation is not a substitute for trained workers;
equipment is only as good as the people who use it.
Responses to emergencies must usually be made within minutes to avert a
catastrophe. In some situations, it is unrealistic to expect a timely response
from a local organization; the distances might be too great, for example. In
these situations, the only practical thing to do is to use specially trained plant
personnel as first-responders. If this is undertaken, the management must
assure the safety of the responders. They must comply with the relevant
provisions of the OSHA Emergency Response rule, at 29 CFR Part 1910.120.
An important but uncommon aspect of risk management is the (radical?) policy
of assuming certain reactors, vessels and components to be potentially unsafe,
rather than safe, at a certain point (3/4 ?) in their currently expected maximal
-------
45
useful life, and requiring reliability assurance from a designated manager. As
an example, in the case of a reflux condenser which has operated in a
chemically and physically hostile environment for, say, 12 years, one would
assume it to be potentially unsafe, because of internal corrosion and stress
cracks, and require it to be thoroughly examined and tested, regardless of any
code test done a few years earlier.
A comprehensive (but easily read) plan for alerting the community and starting
an evacuation, when necessary, must be in place and well-understood by the
employees, the fire department officers, and the public. Such a plan should be
developed with input from local safety officials, and neighbors.
As a parting comment, for a facility or chemical plant to be, and be seen as,
a good neighbor, the plant administrators must make sure that they promptly
and authentically respond to all of the concerns of the community.
N.A.B
January 7, 1990.
* * *
-------
46
References and End Notes
1. Bhopal, India. 1984 methyl isocyanate released, due to water ingress, uncontrolled self-heat, and tank
rupture. More than 2000 deaths Initially reported.
2. Seveso, Italy. 1976 toxic gas release forced major evacuation. Long term effect of major dioxin release,
major concern.
3. 1987 release of many chemicals from Sandoz company. Major contamination of the Rhine with
mercury and organics. No fatalities: chronic health effects major concern.
4. A poll taken in 1986 by Roper Associates.
5. The American Institute of Chemical Engineers.the American Society of Mechanical Engineers are
dominant in this area.
6. Regulations at Title 10, the Code of Federal Regulations.
7. Statement of Mr. Lee Thomas, former EPA Administrator. February 3, 1987. Washington, Int.
Symposium on Preventing Major Chemical Accidents.
8. Standards and recommendations from the National Consensus standards groups and technical societies
listed (5).
9. Risk analysis, for more description see ISGRA. Risk Analysis in the Process Industries, 1985 Report.
Institution of Chemical Engineers, London.
10/11/13 Techniques. There is extensive descriptive material on these topics. For literature and
reprints, consult the National Safety Council, Chicago, Illinois 93120, 527.4800.
12. Hazops key words: see The (1977) Guide, same topic, of the Chemical Industries Association.
London, Eng.
13. The Center of Chemical Process Safety Is particularly active in this area. It is group within the
American Institute of Chemical Engineers.
14. Many products are offered. A review of (40) vapor cloud dispersion models is available from the Center
for Chemical Process Safety -(212-705-7657). The EpiCode software from Homann Associates, Fremont
CA, and the Cameo 2 Software from the National safety Council are two easy-to-use products for Public
Hygiene work.
15. The model is described in EPA Guide, OAQPS Guideline on Air Quality MODELS, EPA REPORT 450-
78-028.
16. Eplcode and (extensive) library. Homann Associates, 39831 San Moreno, CT. Fremont, CA 94539 (415)
490-6379.
17. IDLH is not consistently defined in the regulations of the relevant agencies. Herein, it means the
concentration at which a serious harm is likely to arise within a matter of minutes with a continuing
exposure. The official definition given in the Mine Safety and Health Administration Standard at 30 CFR
Part 11.3 is preferred by the writer for the purpose of response, discribed herein.
18. TLV trademark term for threshold limit values established by the American Conference of
Governmental Industrial Hygienists.
19. See "EPA OCCUPATIONAL HEALTH AND SAFETY1 MANUAL. #1440."
-------
A-l
APPENDIX
EPIcode™ ALGORITHMS
COORDINATE SYSTEM
In the EPIcode system, we have placed the coordinate
origin (x = 0, y = 0, z = 0) at ground level, beneath the point
at which the chemical substance is released. The x axis is
the downwind axis, extending horizontally with the ground
in the average wind direction. The y axis is the crosswind
axis, perpendicular to the downwind axis, also extending
horizontally. The altitude axis (z axis) extends vertically. A
plume travels along, or parallel to, the downwind axis. The
figure below illustrates the EPIcode coordinate system.
-------
A-2
BASIC EQUATION
The origin of the Gaussian model is found in work by
Sutton (1932). PasquiU (1961, 1974). and Gifford (1961,
1968). Additional background and supplemental informa-
tion on the Gaussian model can be found in Turner (1969)
and Hanna et al. (1982).
We use the following Gaussian model equations to deter-
mine the concentration for a gas or an aerosol (particles
less than approximately 20 urn in diameter).
Continuous Phase:
C(x,y,z,H) =
2icayazu
.-
exp
exp
exp
If z-H
1 f z+H
Puff Phase:
C(x,y,z,H) =
(27c)3/2axqyaz
exp
exp
1 f z + H
-------
A-3
The "pufF equation is used for an instantaneous term
release, and the "continuous" equation is used for a con-
tinuous release. For a non-instantaneous term release
(e.g., 0.5 min., 120 min.. etc.) EPIcode automatically
selects the appropriate equation. This selection process Is
based upon the plume length (release duration x wind
speed) relative to the a at the specific downwind location
being considered. We assume that GX = o . For a term
release when the plume length is less than ax, the plume
diffusion process is more accurately characterized by the
Puff equation. The Continuous equation is used whenever
the plume length is greater than or equal to 2o~x. For
plume lengths between GX and 2ax, a combination of both
equations is used.
If the Inversion Layer option is in effect, and GZ exceeds the
inversion height L. the following equations are used.
Continuous Phase, crj > L:
C(x,y,z,H) = -—§• exp
Puff Phase, Q > L:
X
C(x,y.z,H) =
-------
A-4
where C = atmospheric concentration (ppm, mg/m3)
Q = source tenn (g/s, m3/s, etc.),
or for a term release
9 = ^/release duration (g/s, etc.)
QT = total release (g, m3, etc.)
H = effective height of chemical substance release
x = downwind distance (m)
y = crosswind distance (m)
z = vertical axis distance (m)
ax = standard deviation of the concentration
distribution in the downwind axis direction
(x axis, meters) cx = ay.
ay = standard deviation of the concentration
distribution in the crosswind direction
(y axis, meters)
az = standard deviation of the concentration
distribution in the vertical direction
(z axis, meters)
u = average wind speed at the effective release
height (m/s, mph)
L = inversion layer height (m).
An upwind virtual point source, which results in an initial
CT equal to the effective radius of the area source, is used to
model an area release.
-------
A-5
The values of ay and ar are representative of a sampling
time often minutes. Concentrations directly downwind
from a source decrease with sampling time primarily
because of a larger aydue to increased meander of wind
direction. For sampling times greater than ten minutes,
and less than the total release time for term releases, the
following equation can be used to predict the sampling
results (Turner. 1969):
02
where C. = the concentration averaged over t. minutes.
For example, you run an air sampler for one hour (60 min)
at a particular downwind location. The EPIcode estimate
at this location is 25 mg/m3. However, the one-hour aver-
age concentration expected from the previous equation is:
/ ,„ , 3
C9 = 25mg/m = 17mg/m3
EFFECTIVE RELEASE HEIGHT
The actual plume height may not be the physical release
height, e.g.. the stack height. Plume rise can occur be-
cause of the velocity of a stack emission, and the tempera-
ture differential between the stack effluent and the sur-
rounding air. The rise of the plume results in an increase
in the release height, as shown in the figure at the top of
the next page.
This effective increase in release height leads to lower
concentrations at the ground level. If you are not able to
visually estimate or calculate the effective release height,
we recommend you use the actual physical release height
(i.e., the height of the stack)—or use zero height for a
ground-level release. This will always yield conservative
estimates.
-------
A-6
H
If the release is from a stack, and you know additional
information on the stack discharge velocity, temperature,
and stack diameter (i.e., if you are designing a new stack
for a building), EPIcode can automatically calculate the
effective release height. This can also be applied to an area
release if the effective release radius is less than fifty
meters.
Select calculate PLUME RISE by typing PR from the
release height prompt. EPIcode calculates both the
momentum plume rise (Briggs, 1969) and the buoyant
plume rise (Briggs, 1975) and chooses the greater of the
two results. The recommended methodologies in the above
two references are strictly followed.
STABILITY CLASSIFICATION
Meteorologists distinguish several states of the atmospheric
surface layer: unstable, neutral, and stable. These catego-
ries refer to how a parcel of air would react when it is
displaced adiabatically in the vertical direction. The
EPIcode model offers two ways to select the atmospheric
stability category.
-------
A-7
For users who are not familiar with the different stability
classifications commonly used in meteorology, EPIcode will
select the appropriate stability classification with informa-
tion you provide from direct observations. Or, a user can
directly select and force a particular stability classification.
The simplified method requires selection of the solar insola-
tion factor and ground wind speed (at a 2 meter height).
EPIcode then automatically determines the atmospheric
stability category from the matrix given in Table 1. This
table contains criteria for the six stability classes, which
are based on five categories of surface wind speeds and
four categories of solar insolation. This scheme is widely
used in meteorology and is accepted for stability class
estimation.
Table 1. Meteorological conditions used to define the
Atmospheric Stability Categories, A-F, used in EPIcode.
Sun conditions
Ground wind
speed (m/a)
<2
2-3
3-4
4-6
>6
High in
sky
A
A
B
C
C
Low in
sky or
cloudy
B
C
C
D
D
Nighttime
F
E
D
D
D
Pasquill Stability Types:
A: Extremely Unstable
B: Moderately Unstable
C: Slightly Unstable
D: Neutral
EiSlightty Stable
F: Moderately Stable
The user may also select the stability class, A-F, directly
from the table. In addition to these six stability classes,
EPIcode also allows you to enter w for the worst-case
scenario. If w is selected, EPIcode uses all stability classes
to determine the downwind concentration, then chooses
only the class resulting in the highest contaminant concen-
tration for the particular ground-level location. For
-------
A-8
documentation purposes the displayed output indicates
which stability class gave rise to the worst case at each
downwind location.
DETERMINATION OF Gy AND Gz
The standard deviations of the crosswind and vertical
concentrations from the basic equation are ay and a2,
respectively.
Once the atmospheric stability category has been deter-
mined, EPIcode uses the equations given in Table 2 to es-
timate ay and az for two terrain types—Standard and City.
The City terrain factor accounts for the increased plume
dispersion from crowded structures and the heat retention
characteristics of urban surfaces, such as asphalt and con-
crete. The City terrain factor will estimate lower concentra-
tions than the Standard factor, due to the increased disper-
sion from large urban structures and materials. Choosing
Standard terrain will give the most conservative estimates.
Table 2. Equations used to determine ay and ac. This
methodology is derived from Briggs, 1973.
Pasquill Gy
-------
A-9
For brief (puff) releases of less than ten minutes, the ex-
perimental data indicate that that ay and at are smaller by
about a factor of two (Slade. 1968). y EPIcode automatically
uses the following algorithms to determine the short-term
standard deviations, oy and o2'. These values replace the
ay and az in the basic Gaussian equation.
The new ay* and az* are a factor of two smaller than ay and
ax for release durations less than or equal to one minute.
For durations between one and ten minutes, the factor is
linearly interpolated, as shown below.
Release Duration, t
(min) o/ a.'
t > 10 ar a.
l
-------
A-10
Table 3. Exponential factor used by EPIcode for calcu-
lating wind speed variation with height (from Irwin
(1979).
Stability Class
City
Standard
terrain
B
0.15 0.15 0.20 0.25 0.40 0.60
0.07 0.07 0.10 0.15 0.35 0.55
PLUME DEPLETION
Very small particles and gases or vapors are deposited on
surfaces as a result of turbulent diffusion and Brownian
motion. Chemical reactions, impaction, and other bio-
logical, chemical, and physical processes combine to keep
the released substance at ground level. As this material
deposits on the ground, the plume above becomes depleted.
EPIcode uses a source-depletion algorithm to adjust the air
concentration in the plume to account for this removal of
material.
The source term in EPIcode is allowed to decrease with
downwind distance. The code accomplishes this by multi-
plying the original source term by a source-depletion factor,
DF(x). The evaluation of this depletion factor has been
described by Van der Hoven (in Slade, 1968).
The equation used in EPIcode is:
x
DF (x) =
exp
f
o az(x)expUr
-*M
az(x)J
21
dx
' r*
u
-------
A-ll
where:
DF(x) = Depletion factor.
x = Downwind distance.
v = Deposition velocity. The deposition velocity
is empirically defined as the ratio of the ob-
served deposition rate (e.g., mg/m2 • s) and
the observed air concentration near the
ground surface (e.g., mg/m3).
u = Average ground level (2 m) wind speed.
H = Effective release height of chemical.
az (x) = Standard deviation of the air concentration
distribution in the vertical direction (z axis)
for either Standard or City terrain, as
applicable.
The default values for the deposition velocities used in
EPIcode are:
Physical form
of substance v (cm/s)
Solid 1
Gas/vapor 0.1
Unknown 0.1
These default values can be changed by the user if more
applicable information is available (e.g., increased deposi-
tion due to chemical reactivity, etc.).
-------
A-12
ACCURACY
The many uncertainties associated with the variables in the
Gaussian model, such as fluctuations in the meteorological
conditions, or type of terrain, result in a degree of impreci-
sion in the calculated ground level concentrations. If
inappropriate meteorological data, source term assump-
tions, effective stack height, etc.. are input into the pro-
gram, large errors are possible in the EPIcode estimates.
Given accurate input assumptions, the standard deviation
of the ground concentration as calculated by EPIcode is
thought to be approximately a factor of five. In other
words. 68% of the time (i.e.. the percentage of observations
within ±1 standard deviation, assuming a Gaussian distri-
bution) the calculated ground-level concentration will be
within a factor of 5.
Other percentages can be inferred from the Gaussian
distribution. If C is the calculated ground-level concen-
tration, this means that 50% of the time the true concen-
tration should lie between C/3 and 3C; and 80% of the
time between C/8 and 8C. For example, if the calculated
value were 300 ppm, at least half of the time you would
expect the true value to lie between 100 ppm and 900 ppm.
------- |