Transformers and process safety

Transformer fires can cause a process incident due to interruption of power to the unit. Give importance to the maintenance and fire detection and protection systems of your transformers. A good article by the US dept of interior mentions the following:
“The following devices should deenergize the transformer and trigger the transformer fire suppression system:
• Heat and/or fire sensors appropriately located near or on the transformer
• Manual discharge (control switch, pushbutton)
Depending on the type of sensors used and the details of the design, it may be desirable to require two sensors to operate before activating suppression to reduce false operation.
In addition, remote activation through the use of SCADA might be considered where operating practices permit and sufficient information is available to the remote operator.
Heat sensing fire detectors are the most reliable way of activating fire suppression for transformers. Techniques that should be considered include linear heat detectors (heat sensing cable) and infrared detectors. The appropriate method of detection is chosen when designing or re-designing the system.
Control system considerations include:
· Operation of the fire suppression system should deenergize the transformer to prevent water from discharging onto an energized transformer.
· Loss of power to fire suppression system pump motors, solenoids, and controls should be annunciated so the problem can be detected, diagnosed, and remedied.
· Activation of the suppression system should be annunciated and input to the SCADA system.
· Activation of the suppression system should block drains and pumping of oil-contaminated water from sumps into waterways.
· Activation of the suppression system should stop transformer fans and oil pumps that might feed the fire.
· Power the fire detection system from a reliable source, have continuous internal monitoring, and have sufficient output contacts for necessary alarm and control functions.
· Power the fire suppression system from a reliable source not affected by the loss of the transformer being protected.
· At unattended plants where high-volume deluge systems are retained, detection and control circuits should be designed to suppress the fire while reasonably minimizing the amount of water discharged. The purpose of this is to suppress the fire while limiting the risk of overtopping containment structures and contaminating waterways. It is reasonable to apply water for a limited time, temporarily shut down, and then reactivate water discharge to suppress any remaining fire. This might be accomplished through detectors that continue to sense fire, timers that cycle the system, or other means. In addition, high level detection in the containment structure is recommended to shut off fire suppression to prevent overflow. High level detection might be supplemented by video monitoring and remote deactivation through the use of SCADA.
Read the complete article in this link.

Identify chinks in your asset integrity program!

In 2004, a superheated steam pipeline in a nuclear plant in Japan ruptured, fatally killing 5 people. The rupture was 560 mm in size. The pipe wall at the rupture location had thinned from 10mm to 1.5mm. Apparently, the pipeline was never inspected since commissioning in 1976. Review your asset integrity program to ensure that there are no equipment or locations that have been skipped for inspection.In many companies having separate inspection departments, there will be a wealth of information, but soemone must be tracking the system to its logical conclusion. In today's scenario, with qualified and experienced inspection personnel in high demand, and turnover rates high in industries, it becomes imperative to have continuity in your asset integrity program. The chain is as strong only as the weakest link!
Read the article about the steam pipe rupture in this link.

Tank overflows and process safety

Many atmospheric storage tanks are provided with gravity overflows which lead to a sewer or drain. Gravity overflow sizing should be carefully done. An article written in 1983 by P D Hills is a good reference. Read it in this link.

Gaskets failures

Are you giving enough importance for training your maintenance personnel on the types of gaskets used at your facility and the method of fixing them? A good article by Jim Drago mentions that out of 100 gasket failures, 68 were due to insufficient load, 14 were due to wrong selection. Crushing, cavitation, erosion and other factors contributed to the rest. Insufficient load was attributed to improper installation, misapplication, poor flange design, and/or bolt selection and rotated flanges.
Read the article in this link

Pipeline integrity

Ever since the San Bruno pipeline incident, there has been lot of debate on pileline safety in the USA. A article mentions the following
"Pipelines are by their nature distributed and remote. Having sensors and analytics available to help identify pipes at risk would be a sensible strategy. Oil and gas companies are, in fact, investing in smart technologies for safety monitoring. As part of the 2011 Vertical IT & Communications Survey conducted by IDC in January, 2011, which included 90 North American oil and gas companies, 42% stated that they would be investing in smart technologies for safety monitoring in the next one to two years. This is not surprising given the importance of safety in the upstream side of the business. But in midstream, there are a number of questions still to be answered. The major risks to pipelines are corrosion, digging and failure of materials. Is sensing technology available that can identify these potential risks to pipeline integrity? Sensors in remote locations should not have significant power requirements and should be able to be powered by long-life batteries. Are these sensors now available? Then too, is the telecommunications infrastructure available to support bringing the data back for analysis? We welcome your comments"
Read the complete article in this link..

Process safety - what you don't see will get you!

A news article mentions that an unexploded German mine from World War Two was found near the BP Forties oil pipeline in the North Sea. The article also mentions that there is no immediate threat to the pipeline and the mine will be removed after a shutdown of the pipeline for a few days later in the year. The article reminded me of many chemical manufacturing companies taking over other organizations without doing a proper process safety due diligence. While financial due diligence is no doubt important,it becomes imperative that you also conduct a process safety due diligence to find out if you have any surprises in store!! The due diligence should cover the technical as well as the process safety cultural issues. Look before you leap and you can avoid an incident!

Fukushima and Bhopal

I have been reading with interest the interest in nuclear safety in Indian nuclear reactors after the Fukushima incident. I was wondering that if Bhopal had happened today, would the implementation of laws improve? While the West has learned from Bhopal and implemented stringent laws,we in India are yet to focus clearly on chemical process safety management. With the chemical industry set to boom in the next decade, should we wait for another Bhopal to occur before actions are taken? The current focus on process safety in India is still largely on a reactive basis. While large organisations have proactively and voluntarily taken up PSM, it is the medium and small scale organisations that are not prepared. Many of these units handle highly hazardous chemicals. It is time that the large players in the Chemical Industry start a mentoring program free of cost to enable the small and medium scale players to improve process safety. It is good for the whole industry.

Turbines and fires

According to a 1985 EPRI report, "Turbine Generator Fire Protection by Sprinkler System," by Black and Veatch, a survey of 175 generator related fires and 33 hydrogen explosions from the period 1930 to 1983 indicated that of the 119 fires involving lube oil, 39 fires occurred at the turbine bearings, 16 fires involved lube oil piping, 14 fires occurred below the turbine deck, and seven fires involved the lube oil reservoir. The exciter has also been identified as both a lube oil and an electrical hazard (seven electrical fires and two oil fires).My experience indicates that this statistic is valid even today.
Piping joint leaks, view glass leaks, piping cracks due to vibration etc all cause lube oil to leak, causing fires. These fires can stop production for quite a while as not only equipment but control and electrical cables will also get damaged. A leak of lube oil from a lube oil pump discharge line causes an atomised spray of lube oil and the source of ignition could be an uninsulated steam line. I have witnessed a major fire caused by a lube oil line leak and the damage was enormous. Train your operators to report unusual vibration, minor leaks and ensure your asset integrity program covers the lube oil system.

Bhopal disaster - Police Chief's account

I met Mr Swaraj Puri, the then Chief of Bhopal Police when the Bhopal gas disaster occured, at an international conference on Bhopal gas disaster at IIT Kanpur in 2004. He recounted the horrors of that night and the difficulty he and his men faced in the aftermath of the tragedy. I chanced upon his website where he mentions all the details of that fateful night in December 1984.He mentions the following:

"The Shortcoming and the Lessons for the future
One of the first thing that struck us when the gas leak took place was our total lack of preparedness and ignorance about how to deal with such a situation.
The medical fraternity and the chemists were unaware about the effects of Methyl Isocynate on humans and also the medical treatment to deal with cases of exposure. The Chief Medical Officer of the Union Carbide Factory initially deemed MIC as only an irritant! Since the gas was of the cyanide family, Sodium Thiosulphite was administered as a probable antidote. Specifically the factory was to blame because:

• The plant did not give vital information about the storage and handling of hazardous and dangerous materials.
• Effect of MIC on humans and the antidotal treatment was not known to the medical fraternity and such knowledge if available was not disseminated to the emergency services.
• There was a lack of appreciation of disaster management within the Government and also inadequate co-ordination between the factory and the emergency services.
• There was an absence of proper warning system in the plant. No practice drills were ever held.
• Union Carbide itself had limited data on MIC and probably had never anticipated the 'worst case scenario
• Poor plant maintenance practices. Inventory of vital spares had been depleted.
• Exodus of some of the experienced engineers and operating personnel from the plant.
• Economy measures, overriding safety concerns.

Apart from these, we noticed some other difficulties all inextricably linked up with the developmental process in the country.

• Densely populated areas around the plant. Often shanties / slums come up on vacant areas surrounding the factories greatly increasing the danger of loss to human life. Urban planning authorities are powerless, there is an absence of political will since much of the problem is caused by the poor flocking to the cities in search of employment.
• Absence of a proper road network, rescue workers had to move on foot through densely populated areas
• Poor communications, though things have improved now.
• Lack of effective emergency medical facilities.
• Inadequate transport for emergency evacuation, even today the infrastructure is woefully in adequate.
• Cattle living in residential areas, a peculiar Indian problem, not there in the metros, but very much in existence in other urban centers.
• People sleeping on pavements/ railway platforms.
• Unidentified dead bodies. Creating difficulties in identification of religion and also medico- legal problems. Many could not be identified. They were photographed, given numbers and cremated/buried
• Along with humans a large number of animals, mostly cattle perished in the disaster. Their disposal became a serious health problem. There was a threat of an epidemic. Cranes and bulldozers had to be put in operation to remove the dead animals and then bury them in a mass grave disinfected with tonnes of bleaching powder.
• Administration collapsed with key functionaries running for their lives instead of manning key positions
• Relief operations became difficult as the disaster caused total enervation in those entrusted with emergency relief.

SUCCESSES
Not every thing was a failure, the Police and the Medical Department with whatever meager resources at their disposal put up a tremendous immediate response. NGOs and social service organizations moved in immediately to help in the relief efforts. Local media was extremely helpful in scotching rumors and in disseminating essential information. Even the international media cooperated. The most affected area included the Bhopal Railway Station, the station master perished from the effects of the gas but the railway personnel immediately alerted the concerned, regulating the movement of trains and thus saving many lives.
FOR THE FUTURE 
The Administration, the Police and other essential services must know the location and exact nature of any hazardous chemical that is stored by any industrial establishment. The procedure to be followed in case of exposure and the antidotal treatment should be known to the aforesaid. Adequate quantity of antidote should be available with the industry which stores such hazardous chemical.

1. The people living in the vicinity should be made aware of

• the chemicals being stored
• The likely symptoms and antidote
• Emergency procedures which should be also rehearsed
• Nearest medical facilities
• System of contacting the Factory management
• Sources of transportation for emergency evacuation and the availability of ambulances.
• Rumors and unfounded fears should countered by local Radio and TV
• NGOs and other Voluntary Organizations capable of providing help should be involved in the disaster management process and be listed and known to the administration as well as the residents of the vicinity
• Residents living in the vicinity should train with the emergency services"

I still do not believe that we are ready for handling another similar disaster. Read Mr Swaraj Puri's account of Bhopal disaster in this link.

Pilots and Process Safety

I am talking about Flare Pilots! Do not underestimate the need for keeping your flare systems and pilots, including their ignition systems in good condition. A working flare is a silent sentinel for process safety. For a troubleshooting guide on flare systems see this link.

Lessons from Deepwater Horzon incident investigation by USCG

The US Coast Guard has released its investigation report on the Deepwater Horizon disaster. There are lessons to be learnt for us in the chemical processing industry. The key findings from the report are given below:
"Failure to Use the Diverter Line: When the drilling crew directed the uncontrolled well flow through the Mud Gas Separator (MGS), the high pressure exceeded the system’s capabilities and caused gas to discharge on the Main Deck. Alternatively, the crew could have directed the well flow through a “diverter line” designed to send the flow over the side of the MODU (Mobile Offshore Drilling Unit). Although the diverter line also may have failed under the pressure, had it been used to direct the flow overboard, the majority of the flammable gas cloud may have formed away from the Drill Floor and the MODU, reducing the risk of an onboard explosion.
Hazardous Electrical Equipment: At the time of the explosions, the electrical equipment installed in the “hazardous” areas of the MODU (where flammable gases may be present) may not have been capable of preventing the ignition of flammable gas. Although DEEPWATER HORIZON was built to comply with IMO MODU Code standards under which such electrical equipment is required to have safeguards against possible ignition, an April 2010 audit found that DEEPWATER HORIZON lacked systems to properly track its hazardous electrical equipment, that some such equipment on board was in “bad condition” and “severely corroded,” and that a subcontractor’s equipment that was in “poor condition” had been left in hazardous areas. Because of these deficiencies, there is no assurance that the electrical equipment was safe and could not have caused the explosions.
Gas Detectors: Although gas detectors installed in the ventilation inlets and other critical locations were set to activate alarms on the bridge, they were not set to automatically activate the emergency shutdown (ESD) system for the engines or to stop the flow of outside air into the engine rooms. The bridge crew was not provided training or procedures on when conditions warranted activation of the ESD systems. Thus, when multiple gas alarms were received on the bridge, no one manually activated the ESD system to shut down the main engines. Had it been activated immediately upon the detection of gas, it is possible that the explosions in the engine room area could have been avoided or delayed.
Bypassed Systems: A number of gas detectors were bypassed or inoperable at the time of the explosions. According to the chief electronics technician, it was standard practice to set certain gas detectors in “inhibited” mode, such that gas detection would be reported to the control panel but no alarm would sound, to prevent false alarms from awakening sleeping crew members. Similarly, the crew bypassed an automatic shutdown system designed to cut off electrical power when ventilation system safety features failed, possibly allowing flammable gas to enter an enclosed area and reach an ignition source. The chief electrician had been told that it had “been in bypass for five years” and that “the entire fleet runs them in bypass.”
Design of the Main and Emergency Power Sources: Although the arrangement of main and emergency generators on DEEPWATER HORIZON met IMO MODU Code requirements to have completely independent engine-generator rooms along with independent power distribution and control systems, it did not prevent a total failure of the main electrical power system, when the explosions and fire damaged multiple generators and their related power distribution and control equipment. The design did not adequately take into account that the proximity of the air inlets to each other created a risk that flammable gases could impact all six generators at once.
Crew Blast Protection: DEEPWATER HORIZON did not have barriers sufficient to provide effective blast protection for the crew. Although the barriers separating the Drill Floor from adjacent crew quarters met the standards of the IMO MODU Code, those specifications are only designed to slow the spread of fire, not to resist an explosion. They did not prevent personnel in the crew accommodations area from sustaining injuries.
Command and Control: Because of a “clerical error,” by the Republic of the Marshall Islands, DEEPWATER HORIZON was classified in a manner that permitted it to have a dual-command organizational structure under which the OIM was in charge when the vessel was latched on to the well, but the master was in charge when the MODU was underway between locations or in an emergency situation. When the explosions began, however, there was no immediate transfer of authority from the OIM (Offshore Installation Manager) to the master, and the master asked permission from the OIM to activate the vessel’s EDS. This command confusion at a critical point in the emergency may have impacted the decision to activate the EDS".

The full report is available in this link.

Ammonia and thermal expansion

For my friends in the ammonia industry, let me remind you ammonia can also kill you in another way apart from exposure to it. 25 years ago, I witnessed a large leak due to thermal expansion of liquid ammonia which was not understood by the technical services team of the plant who had carried out an in house modification. The liquid ammonia which was blocked in, expanded due to thermal expansion and a pressure gauge in the line gave away, rocketing the gauge and causing a large leak. The flying projectile could have killed people.Airgas has published a technical bulletin about ammonia, which all personnel in ammonia facilities should read. Read it in this link.