Loss Prevention Bulletin Improving process safety by sharing experience

Focus on HF acid tanker unloading

Issue 232, August 2013

Anatomy of HF acid tanker unloading HF acid leak from tanker unloading flange Mukuru-Sinai fuel spill and fire disaster Operator severely burned in a trimethyl indium explosion HAZOP failure Why HAZOPs can fail

ADVANCING CHEMICAL ENGINEERING WORLDWIDE

LPBaugcover.indd 1

07/08/2013 12:08

HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS

HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS

HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS 7–9 May 2014, Edinburgh, UK HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS

Hazards24 Call for papers Hazards is IChemE’s flagship process safety conference and provides a platform to share fresh thinking and latest research on all aspects of process safety related to the European chemical and process industries. The 2014 conference will address both the offshore and onshore process safety challenge and papers are welcomed under the following themes: ■■

asset integrity

■■

lessons learned from incidents

■■

chemical reaction hazards

■■

plant and site layout

■■

consequence assessment and modelling

■■

pressure relief

■■

dust explosions

■■

■■

environmental protection

■■

fire and explosion hazards

■■

process safety management

■■

hazard and risk

■■

safer plant operations

■■

human factors

■■

safety culture and leadership

■■

inherent safety

■■

shale gas technologies

■■

legislation and compliance

process safety Key Performance Indicators (KPIs)

Abstract deadline – 7 October 2013 Hazards 24 is an international symposium and contributions are welcomed from all regions where the process safety challenge is being addressed. Abstracts of no more than 500 words should be submitted electronically before 7 October 2013 via our online abstract handling system – www.icheme.org/ahs

Workshop opportunities If you have an idea for a full or half-day workshop, to take place on 7 May, email [email protected] with details – these must be in line with conference themes.

ADVANCING CHEMICAL ENGINEERING WORLDWIDE

Hazards 24 FP AD.indd 1

17/07/2013 12:00

Loss Prevention Bulletin 232

August 2013 | 1

Contents Loss Prevention Bulletin Articles and case studies from around the world Issue 232, August 2013 Editor: Tracey Donaldson Publications Director: Claudia Flavell-While Subscriptions: Hannah Treanor Copyright: The Institution of Chemical Engineers 2013. A Registered Charity in England and Wales and a charity registered in Scotland (SCO39661) ISSN 0260-9576/13 The information included in lpb is given in good faith but without any liability on the part of IChemE

Photocopying lpb and the individual articles are protected by copyright. Users are permitted to make single photocopies of single articles for personal use as allowed by national copyright laws. For all other photocopying permission must be obtained and a fee paid. Permissions may be sought directly from the Institution of Chemical Engineers, or users may clear permissions and make payments through their local Reproduction Rights Organisation. In the UK apply to the Copyright Licensing agency Rapid Clearance Service (CLARCS), 90 Tottenham Court Road, London, W1P 0LP (Phone: 020 7631 5500). In the USA apply to the Copyright Clearance Center (CCC), 222 Rosewood Drive, Danvers, MA 01923 (Phone: (978) 7508400, Fax: (978) 7504744). Multiple copying of the contents of this publication without permission is always illegal. Institution of Chemical Engineers Davis Building, Railway Terrace, Rugby, Warks, CV21 3HQ, UK Tel: +44 (0) 1788 578214 Fax: +44 (0) 1788 560833

2 4

News in brief Anatomy of HF acid tanker unloading Dave Bridger explains the main safety features of HF tanker unloading focussing in particular on the safeguarding aspects of the Tanker Safety Valve (TSV).

10 HF acid leak from tanker unloading flange Dave Bridger reveals how a catalogue of unsafe practice, involving a lack of risk assessment on a minor modification, a lack of leak-testing and an over-reliance on PPE, ultimately resulted in an HF leak.

14 Mukuru-Sinai fuel spill and fire disaster, September 2011 A major fire in Nairobi, Kenya resulting in 120 deaths was initially blamed on a pipeline explosion; however a joint investigation by the United Nations Office for the Coordination of Humanitarian Affairs and United Nations Environment Programme uncovered its surprising true cause.

17 Operator severely burned in a trimethyl indium explosion – the importance of risk assessments

19 HAZOP failure Although HAZOP is probably the most widely used technique for identifying hazards in the process industry, it can sometimes fail to produce the desired outcome. Colin Feltoe highlights some common pitfalls that can occur with HAZOPs and suggests how they may be avoided.

23 Why HAZOPs can fail The effectiveness of a HAZOP study depends on many factors such as the ability of the chairman, the quality of the HAZOP team and the information/data available. Roger Casey shares the main reasons for some of the less successful HAZOPs he has witnessed.

26 Letter 27 Events 28 PSEP highlights

Phillip Carson highlights how an explosion resulting in life-changing injuries to a worker might have been avoided if the company had carried out a suitable risk assessment.

Email: [email protected] or [email protected] www.icheme.org Printed by Lock, Stock & Printed

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

contentsaug.indd 2

08/08/2013 10:45

2 | Loss Prevention Bulletin 232

August 2013

News in brief... Halliburton admits destroying spill evidence Cementing contractor Halliburton has admitted to destroying evidence related to 2010’s catastrophic Deepwater Horizon accident, according to the US Department of Justice (DoJ). The company has agreed to plead guilty to destroying evidence relating to the accident and ensuing spill, which left 11 workers dead and released an estimated 4.9m bbl of oil into the Gulf of Mexico. It will pay a criminal fine of US$200,000 – the maximum possible. The disaster struck after the Deepwater Horizon oil rig suffered an uncontrolled blowout, sparking a series of explosions and a fire that eventually sank the rig. In the wake of the incident, it was found that the cementing job around the well, which had been carried out by Halliburton, was inadequate. Halliburton pointed out that BP used six rather than the recommended 21 centralisers – metal collars that protrude from a well casing and aid in cementing operations – in the well. BP argued that increasing the amount of centralisers would have had very little effect on the quality of the cement job. According to the DoJ, Halliburton ordered its staff to run 3D simulations of the cementing job with both six and 21 centralisers as part of its own internal investigation. It found that there was very little difference between the two, and the program manager was ordered to destroy the results.Government investigators later attempted to recover the deleted files, but failed. In a statement, Halliburton confirmed that it has agreed to plead guilty to “the deletion of records created after the Macondo well incident.” It adds that the DoJ “acknowledged the company’s significant and valuable cooperation during the course of its investigation.” Halliburton, BP and drilling contractor Transocean are all defendants in a civil trial that will assign blame and damages relating to the spill, with the costs likely to reach billions of dollars. BP and Transocean both declined to comment on Halliburton’s guilty plea.

Oil train derailment devastates Canada town The search for human remains has come to an end after a train carrying crude oil derailed and exploded in the small Canadian town of Lac-Megantic on 06 July. Investigators probing the causes of the deadly train disaster said they are focusing on the “abnormal” intensity with which the load of crude oil ignited and burned. Nearly four weeks after the disaster, the estimated death toll stood at 47 — with 42 bodies found, and five people missing. According to reports, the train was made up of 72 oil-filled tanker cars and had been parked for the night at a station in the neighbouring town of Nantes. In the early hours, the tankers came loose and rolled almost eleven kilometres downhill into the centre of LacMegantic, where they derailed. Though the details remain unclear, it is thought that at least five of the cars exploded as they came off the rails. Montreal, Main & Atlantic Railway (MMA), which operates the line, found that the locomotive of the oil train was shut down after the engineer in charge of it left for the night. This, the company says, “may have resulted in the release of air brakes on the locomotive that was holding the train in place.” The Transportation Safety Board of Canada have completed their on-site examination in the Quebec town and confirmed that the fires and explosions caused by the derailment were unusually strong. Samples of the oil have been taken and are being analysed to determine why the crude oil burned with such vigour. The investigation is expected to last for several more months, with work set to continue from the federal agency’s office in Ottawa.

Explosion at a paraxylene plant heightens Chinese public’s concerns Following the release of a state-media report highlighting the safety of paraxylene (PX) plants in China, an explosion occurred in one such facility in Zhangzhou, in the Eastern Chinese province of Fuijan. Eight workers were on the site owned by Tenglong Aromatic PX (Zhangzhou) Ltd. at the time of the incident on 30 July, though none were injured. A statement from Zhangzhou’s government said the incident happened in an unused hydrocracking pipeline that was undergoing a pressure test. Firefighters managed to extinguish the 50m flames in around 45 minutes. The plant was originally planned for construction in the densely-populated coastal city of Xiamen, but in 2007, thousands of residents who were concerned about the potential health hazards used peaceful protests to oppose the plans and succeeded in getting it moved to the less populated area of Zhangzhou. The incident occurred only days after a report in the People’s Daily claimed that paraxylene projects have a good safety record. The report claimed that there have been no major safety accidents reported, adding that more than ten paraxylene production facilities were currently functioning properly around the country.

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

lpbnewsaug.indd 2

08/08/2013 10:46

Loss Prevention Bulletin 232

August 2013 | 3

Siberian hydropower plant explosion kills two

Pipeline leaks 50,000 l of oil off Thai coast Around 50,000 litres of crude oil have spilled off the coast of Thailand, after leaking from a pipeline operated by the state-owned PTT Global Chemical (PTTGC). The oil slick washed up on several popular tourist beaches in southeast Thailand. Several ships from the Royal Thai Navy have been drafted in to help contain and clean up the spill, using surface booms and spraying chemicals designed to disperse the oil. PTTGC says it has also flown in a specialist oil spill response company from Singapore. PTTGC claims that the slick is shrinking, and has told reporters that it expects the spill to be cleaned up within a

matter of days. According to the Bangkok Post, the oil spilled out in to the ocean late on 27 July, when a tanker was loading crude to an offshore pipeline about 20 km off the Thai coast. The pipeline supplies PTTGC’s refinery on the massive Map Ta Phut industrial estate. PTTGC says the leak has not affected the refinery, claiming that seawater samples show that the spill “will not affect the environment and will have no impact on the coastal fisheries.” Even so, local media is reporting that fishermen and other business owners in the area are demanding compensation from the company for lost income.

Explosions at Florida propane plant cause multiple injuries At least seven people have been injured by a series of explosions at a gas plant in the US state of Florida, officials say. A crew of approximately 25 people were working on an overnight shift at the Blue Rhino propane plant, in the town of Tavares, when the blasts began at about 23:00 (03:00 GMT), blowing the roof off. Authorities initially reported that fifteen workers were missing, but all were later found to be safe. It is understood that the missing workers simply ran away when the explosions began and had since been contacted by their managers and emergency crews. The explosions continued for about an hour and caused a large fire. People living within 0.8km of the plant were evacuated.There is no indication as yet of the cause of the initial explosion. The Blue Rhino plant refills propane tanks typically used for barbecues. There are normally approximately 53,000 propane tanks at the factory.

A gas explosion at the Krasnoyarsk hydropower plant on the Yenisei River in East Siberia has killed two people and injured at least one. A spokesman for the Krasnoyarsk regional branch of the Interior Ministry said the accident occurred on 08 July during repainting work at the facility. A spokesperson for the plant said that the accident did not have an impact on the hydropower plant’s operational functions but was not able to say what caused the explosion. The plant, located on the Yenisei River in northern Russia, is the world’s eighth largest hydropower plant, supplying 6,000 megawatts of power to neighbouring factories. In 2009, a catastrophic failure at Russia’s largest hydro-electric plant, the Sayano-Shushenskaya plant in eastern Siberia (reported in LPB issue 228 Explosion at the SayanoShushenskaya hydro-electricity power station), resulted in 75 fatalities and more than $1 billion damage to plant/ equipment.

Explosion at West Virginia gas well site injures eight Eight people were injured early on 07 July in an explosion at a natural gas well site operated by Antero Resources, in Doddridge County, West Virginia, US. It is understood that two crews were preparing to enter production tubing into the well, following a problem during the flow back process when drilling fluids are pumped into storage tanks, when a spark triggered a flash explosion and fire. The explosion occurred about 15 metres away from the drilling rig. Two storage tanks containing brine and fracking fluid from the well exploded in the incident; however, a containment system around the well site successfully kept the tank fluids from flooding into the nearby area. The investigation will focus further on a malfunctioning pump.

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

lpbnewsaug.indd 3

08/08/2013 10:46

4 | Loss Prevention Bulletin 232

August 2013

Good safety practice

Anatomy of HF acid tanker unloading Dave Bridger Summary This paper describes the main safety features of HF tanker unloading (via the most common blow-egg method). It also describes the subtle safeguarding aspects of the Tanker Safety Valve (TSV). As well as many other well known barriers preventing harm to people during tanker HF transfers, the TSV provides the best means for ultimate recovery from unexpected HF release during routine loading/unloading. Lack of recovery from an HF acid leak at the tanker loading/unloading gantry can result in sustained large HF acid release. Off-site impact can be minimised (if not eliminated) by installation of a single manually operated remote three-way valve (at safe location) in the main air or nitrogen supply for opening the TSV. It is crucial to note that during HF loading or unloading, under no circumstances must the TSVs be opened by simply attaching a utility air hose.

Keywords: Hydrogen fluoride, HF, loading, unloading, tanker safety valve, TSV

Background The basic properties of hydrogen fluoride (HF, anhydrous hydrofluoric acid or AHF), hazards during handling and associated listing of incidents are extensively documented elsewhere1, 2, 3. It is not the intention of this paper to consider catastrophic failures due to container and/or associated piping perforations (for example, transportation crash, dropping heavy objects, toppling cranes, etc). These are covered by separate emergency response procedures. Only operational aspects related to loading/unloading are considered.

HF tanker safety valves (TSV) Nozzles for hazardous goods must remain intact during incidents causing tanker roll-over. Excess flow valves (EFV, on LPG tankers) do not slam closed under all circumstances (presenting unacceptable risk for an HF tanker incident). Thus, spring loaded check valves (in a normally closed position) are used to retain the same principle of tanker inventory containment in the event of roll-over. For anhydrous HF (and HF >85%), it is recommended to use pneumatically actuated valves, fitted with an internal stop/shut off valve3, the stem of which should be protected by a bellow. They are standardised with an outlet valve size PN25-DN40 DIN 2501, Form C3. The valves for transporting HF acid will be located on top of the tank and housed (to be protected against weather or other damage3). Conventional valves attached to standard nozzles

(i.e., with or without EFV) should certainly not be used for transporting HF. Vigilance is always required by AHF customers to ensure no rogue, unsafe HF tanker has been inadvertently delivered. The main safety feature of current HF acid tankers is then the use of TSVs (often generically called either the “Phoenix” or “Ermeto” valve by HF acid suppliers depending on source of their valves from either Phönix Armaturen, Germany5 or Senior Ermeto, France6), as shown in Figure 1. The most significant safety aspect common to these TSVs are: • An internal, spring loaded ball valve primary seal (spring to close). The latter should stay intact even in the worst case tanker roll-over and actuator damage/shear. • A back-up secondary seal (the angle valve) improves valve integrity. • The angle valve is designed to break away during an accident, leaving the ball valve intact. Furthermore, there must be a locking cap installed on each valve to prevent the valve shaft being pushed down during a tanker incident. During transportation, it is mandatory for isolation blanks to be installed as shown in Figure 2 (shipping agencies will not accept tankers without blanks on valves). TSV blanks are only removed from one HF and one vapour valve immediately prior to process piping connections being made (i.e. during the same fitting activity). However, it is vitally important to recognise a single valve isolation situation while removing the blank (because the chamber between the primary and secondary seals cannot be vented, per double block and bleed configuration). Blanks can only be removed carefully while wearing an air fed, fully enclosed tank suit. The valves must be clearly identified as vapour or liquid, by labelling and/or colouring (as shown in Figure 2). Liquid HF valves can be painted RED or PINK, and vapour valves (N2 and/or HF vapour) can be painted YELLOW, WHITE or BLUE. Colours depend on the country of origin3. Valves should be angle valves, with one (or better two) for the liquid phase, one for the gas phase (optionally two). There should be at least one relief valve with bursting disc below. The liquid valve should have a dip-pipe connected to the (internal) check valve body3. Individual air (or N2) actuation points should be provided local to each valve (generally 4 to 7 barg, with typical range being 5 to 6 barg). Operation of the TSV is normally either fully open or fully closed. Non-self-sealing couplings should only be used (at the valve)3. It is particularly important for the TSV diaphragm chamber to be vented when disconnected. Snap-lock fittings (often associated with dry-break hose couplings) can be used for the hose connection. However, only the fitting on the hose can be dry-break (reiterating the essential requirement that the

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

hftankfailure.indd 4

08/08/2013 10:48

Loss Prevention Bulletin 232

August 2013 | 5

Figure 1: Typical HF tanker safety valves (TSV) (Reproduced with permission from Phönix Armaturen and Senior Ermeto) fitting on the TSV vents to atmosphere when disconnected). Alternatively, as shown in Figure 2, universal twist type hose couplings (with clip to prevent detachment) are suitable. Overall, the safeguarding related to HF acid tanker unloading is the ability of the TSV to be remotely tripped closed. The important feature of a pneumatic system is the additional ability to isolate air or N2 supply while simultaneously venting (closing) the valve diaphragm quickly, but gently (i.e. minimising TSV seat damage). That can be achieved via: 1. Manual three-way ball (or plug) valve in the air (or N2) supply to the TSV actuator, manipulated at the gantry by a single operator (i.e. via single ¼-turn valve handle from clearly marked OPEN or CLOSED positions) closing the TSV (per description above). It is then highly recommended to have another three-way ball valve in the same supply at a safe distance from the gantry for secondary intervention by other operators in the event of an out of control situation at the gantry (generally recommended to have an additional operator at this backup, remote manual pneumatic trip location). 2. Similar to point 1 above, with the inclusion of an electronic solenoid to operate the three-way ball valve, then operated by trip switch at the gantry (again, clearly marked OPEN or CLOSED). This also enables the solenoid to be actuated from a control room (with HF gantry under video surveillance).

In facilities where such a basic pneumatic trip system is not installed, then it must be possible to close the valves manually and locally3.The manual valve closure supplied with TSVs normally requires a second plant operator at a safe location, upwind, holding the trip (or pull) wire. It is therefore a mandatory safety device to be used where remote trip pneumatics are not available (i.e. vs. simply opening the TSV with a utility air or N2 hose). Operation of the manual trip6 is shown in Figure 3. It is important to note this manual device is only used for emergency situations (and must be reported to the HF supplier if used to close the valve, as opposed to manually unscrewing the valve closed at the end of operations). Its use results in harsh mechanical hammer-like stresses on the valve components (potentially causing seal weakness and HF leaks later). It is critical to recognise that using dry air or N2 to these valves without the facility to isolate and depressure is a false sense of security offering little if any chance of recovery in the event of HF loss of primary containment (LOPC): • The TSV actuator must not be operated with a simple hose from an air (or N2) utility point (even though it can quite easily be done) under any circumstances during actual HF acid transfers. • Utility points can be isolated. However, in that case, the air (or N2) pressure is locked into the actuator and the TSV remains open. This will likely not be recognised in the heat of the moment of an incident in progress.

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

hftankfailure.indd 5

08/08/2013 10:48

6 | Loss Prevention Bulletin 232

August 2013

Figure 2: Typical HF tanker safety valve configurations Overall, with blanks removed and process piping simultaneously connected (and pressure tested before operating the TSVs), the potential for any unintentional LOPC is then minimised. The flex lines for TSV actuator operation can be connected (but remain remotely tripped closed from gantry or the control room). With everything connected, the TSVs can be remotely opened by one operator at the gantry (wearing air fed tank suit). Alternatively, the same operator would screw open a manual valve opener.

HF tanker design pressure and MAWP HF tanker design pressure is typically 10 barg3 (up to 14 barg in USA2). However, protection against mechanical impact in

case of accident typically determines minimum shell thickness. Thus, the risk of tanker overpressure from loading or unloading is typically improbable. The main objective is the prevention of relief valve activation (hence HF rich vapour release to atmosphere) during normal operation for pressurised transfer. It is crucial to check with HF suppliers their relief valve set pressure (should then be stated as maximum allowable working pressure, MAWP). The latter must be written on the side of the tanker (as shown in Figure 5). Of upmost importance is the fact that, in actual practice, tankers with relief valve set pressure (RVSP) as low as 7 barg are used for transporting AHF. Upmost vigilance is required by customers (given there can also be variations of RVSP on tankers within the same supply company!).

Figure 3: Manual trip system for HF tanker safety valve (Reproduced with permission from Senior Ermeto)

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

hftankfailure.indd 6

08/08/2013 10:48

Loss Prevention Bulletin 232

Personnel Protective Equipment (PPE) PPE is an important barrier to prevent harm to people involved in HF tanker unloading, when an unexpected release occurs. However, PPE must not be the only barrier relied upon for prevention of harm to people. When handling HF, the key principle is to assume its presence in any known HF system, decontaminated or attached system, until positively proven otherwise. Again, there is an abundance of information about PPE for handling HF acid1,3. General classification scales of A to D are employed, but caution is required1 (since one facility’s “A class” can be another’s “D class”). They become increasingly more difficult to don as the degree of protection is increased (ultimately to an SCBA Hazmat or Zoot suit for voluntary entry to regions of known atmospheric HF). Hence, most operating companies permit a reduced level of PPE in accordance with operator activity (per API RP 7511). It is of upmost importance that procedures define exactly the level of PPE required, every step of the way, to avoid subjective views by workers on the job. The protection level down from Zoot suit is the industry standard air fed hood, or preferably a one-piece external air fed, fully enclosed tank suit (such as supplied by Respirex7). The latter is mandatory PPE for working with equipment where the potential for accidental release of HF may occur (including decontaminated items). This includes (but not limited to) making connections to HF systems and during recommissioning of equipment returned to service during and/or after maintenance, as shown in Figure 5.

August 2013 | 7

Thus, HF acid tanker unloading requires a tank suit as minimum PPE at the tanker loading/unloading gantry (even if tanker is known to be empty). Hence, PPE used at the Hube Global Chemicals’ (HGC) South Korean site at Gumi prior to the massive HF acid release on 27/9/12, was indeed substandard4.

Personnel exclusion zones during HF work The presence of other personnel within the vicinity of such tank suit activity should be prohibited, unless wearing the same sort of PPE. For example, fitters working on a pump in close proximity to an HF tanker (about to be loaded/unloaded) without adequate PPE, could be fumigated by any accidental HF acid released (especially if located at the worst possible position, downwind). Procedures must include a defined exclusion zone for personnel during HF work. It is not the intention of this document to prescribe exclusion distances. However, at some locations reviewed, a minimum 15 metre radius is typically employed for routine tank suit work. In situations where there may be concerns (for example, first time use of a new procedure), the exclusion zone could be increased to a 30 metre radius (or more). Wind direction is also an obvious factor to be considered. Ultimately, pre-incident planning methods should be applied rather than such rules of thumb. Credible release scenarios can be defined with dispersion modelling of regions of potential harm to people. Nonetheless, adequate communication via the permit to work system is certainly required (even if credible scenarios have been evaluated). It is of paramount importance to be

Figure 4: Typical HF acid tanker unloading process flow scheme

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

hftankfailure.indd 7

08/08/2013 10:48

8 | Loss Prevention Bulletin 232

August 2013

Figure 5: Example AHF ISO container alongside unloading gantry (Tank suit diagram reproduced with permission from Respirex) alert to the presence of a sudden release of HF (via unfamiliar sudden venting noise or visually resembling either LPG or steam cloud) or anything untoward. Workers must be empowered to stop work and evacuate (to a location as discussed during work clearance/permit) at their discretion, and not wait for instructions to do so.

Typical HF tanker unloading PFS Figure 4 is one example of many similar configurations for HF acid unloading to an end user plant (though not limited to that configuration):

5.

6.

The key issues shown are: 1. Control over available nitrogen pressure to the HF gantry to prevent overpressure and tanker relief valve (R/V) activation to atmosphere. In this case, PZ trip is included as well as local pressure regulator. A relief valve (RV) on the nitrogen supply ensures nitrogen (not HF) blows to atmosphere. Note: The configuration shown in Figure 4 was for accepting minimum tanker RVSP of 7 barg in the 1990s, while providing a minimum 5 barg N2 to operate the TSVs, etc. However, this was later mandated to minimum 10 barg RVSP tankers (via updated procedures and double authorising signature) for a tolerated LOPA outcome. A detailed review was then required if a tanker of < 10 barg (but ≥ 7 barg) was accidentally delivered. 2. As already discussed, an important safety feature is that of remote isolation of nitrogen to TSVs and their venting to closed position. Figure 4 shows an electronic safeguard loop (via solenoid) activated locally (or from control room). As discussed previously, a manual three-way valve (as an alternative, now included in the diagram for clarity) located at safe distance should be installed if no solenoids are installed. Note: There should also be another remotely operated valve (ROV) at the other end of the transfer line to/ from the bulk HF storage vessel. In Figure 4, this was recognised as needing to be valve J (and was proposed to be changed accordingly). 3. Spiral flexible hard-pipe connection to the tanker (Figure 5). 4. Fall from heights platforms (with safe, solid platform access) are commercially available for ISO containers

7.

8.

(given installation of scaffolding, Figure 5, is expensive and generally causes tanker turnaround delays). Failure to use fall protection devices (railings and/or harness on overhead lifeline, etc, for work at >1.8 m elevation from a solid working platform below) is universally well understood to have a potentially fatal outcome. There should be a breathing air connection close by for mandatory use of air fed tank suits during tanker connection, unloading (or loading) and disconnection. Local pressure indication at the HF tanker as minimum. Pressure indication on the HF acid storage is also invaluable to ensure adequate differential pressure for the liquid transfer to take place. It is also a useful secondary indicator to determine the end point of any HF acid transfer (via pressure inflexion of the trend as liquid flowrate is much slower than gas break-through). Some form of inventory indication is essential. The facility in Figure 4 was specifically for unloading entire contents of an HF acid ISO container to on-site storage. Hence inventory control was based upon receiving vessel measurement (and pressure inflexion upon nitrogen breakthrough to storage as a secondary barrier). However, for any back-loading procedure, then a weighbridge is likely to be a mandatory safety assurance barrier. A facility is required to vent the tanker once emptied (or for depressuring the gas cap during filling and/or partial unload). An acid relief neutralizer (ARN) is typically directed to flare.

Training While this is an obvious requirement, training must have an adequate accreditation process in place. The training is not only for HF acid facility operators and maintenance personnel, but must also cover anyone requiring access within the boundary of the HF acid facility (such as technical/management staff and external combat units if expected to attend HF acid incidents). Understanding of procedures and associated documentation (such as API RP7511, etc) is essential. Training should include (but not be limited to): • Critical physical chemistry aspects of HF acid. • Procedure writing (with essential dry-run veracity

© Institution of Chemical Engineers 0260-9576/13/$17.63 + 0.00

hftankfailure.indd 8

08/08/2013 10:48

Loss Prevention Bulletin 232

checking on-site of each step of the way with “what if” challenges). • Understanding of plant safeguards (in this case, the essential features of TSVs and need for remote operation at well defined safe location(s) to close them in an emergency). • Working at heights training and use of physical fall restraints and stable working platforms. • Exclusion zone requirements for other workers during known HF works (especially where tank suits are required). • Understanding of emergency response procedures (including representation by external combat units). These should be rehearsed on a frequent basis through real-time, on site exercises. • Up to date training accreditation (with defined expiry and enforced exclusion to the HF site accordingly). Refresher training for reaccreditation (say every two years). This must include external combat units.

Safety audits In accordance with many standards and accepted practices for HF acid facilities (producers or consumers), an audit of systems and procedures shall be performed at least every three years1 (process hazards analysis every five years1).

Conclusion At the location reviewed, the above guidelines lead to the following: • A tolerated outcome via layers of protection analysis (LOPA) of