Process Safety Moments
This page contains brief descriptions of situations that have occurred at process facilities which can teach important lessons. Questions are posed to help focus on the key points.
New moments are added regularly so check back periodically.
Effects of Extreme Environmental Conditions on Process Safety Controls
A batch pilot plant operation involving a highly flammable solvent operates during daytime shifts, and is unmanned during "off hours". The unit is housed within a building that features a local Programmable Logic Control (PLC) system with mostly local alarms, with select alarming to the supporting primary process plant which is constantly operating and attended.
A serious near miss occurred one evening when ambient temperatures dropped and remained well below 0°F. The last operator to leave pushed the close button on a roll-up door, which happens to be very near and facing the PLC module. The operator left the site not noticing that the doorway failed to close, and fully re-opened due to an object in its pathway (much like our home garage door openers would operate).
From a review of the alarm history recorded within the PLC, the incident investigation concluded that spurious signals and false control inputs occurred due to extreme low-temperature effects on the PLC module circuitry. The most serious malfunction sent a "request signal" to deliver flammable solvent from a large remote storage vessel to the pilot plant receiving vessel, sending solvent for ten-minute increments (as programmed) and eventually delivering enough solvent to overfill the pilot plant vessel. Luckily, valve lineups were such that the overflow was diverted to connected vessels and the incident did not result in a release from the receiving tank's atmospheric vent to the building floor.
Corrective actions involved consultation with the PLC manufacturer, who explained that such malfunctions could occur given extreme low temperature exposure (the module was specified and purchased for indoor application). Also, alarming to the primary plant control room was rearranged to alert the constantly-attended location that flammable solvent was flowing to the pilot unit. The operating company also rearranged the roll-up door controls to require that the operator remain and hold the closure button until full door closure is verified.
Prior Process Hazards Analyses (PHAs) considered extreme weather conditions as "external events"; however, safeguards were documented as: "The process is located indoors with HVAC service". Safeguards were deemed adequate by the PHA Team.
- As we perform our PHAs, are we certain that we fully understand the limits of control systems when exposed to extreme environments, or do we just assume that since it was specified for its intended service, its functionality is a given?
- Do we adequately address failures of environmental controls (such as HVAC system failures or an inadvertent exposure such as an open door) in evaluating the hazards that can result from extreme exposures to the process?
Field Tours as part of Process Hazard Analysis (PHA)
PHA teams may question the need for conducting a field tour of an older existing facility when most or all of the team members have years of experience in the facility. During a field tour in preparation for a new baseline HAZOP study for an older facility that had not used HAZOP methodology for their earlier PHAs, the PHA team was walking through the operating area during the field tour and one of the team members noted that there was a small drain valve that was missing a plug. That observation led to a closer inspection of other drain valves on equipment and vessels and the discovery of a pattern of missing plugs or caps on drain valves, including several 2" quarter turn ball valves.
Are your field reviews done with a "fresh pair of eyes" or a "business as usual" attitude?
Does your PHA assume that caps, plugs or blinds are installed on the drains and vents without a field check?
When conducting field tours, do you take notes on the field tour findings and include them in your PHA documentation, especially any findings that warrant a PHA recommendation?
Flammable Atmospheres in Tanks
Several atmospheric storage tanks handled a product that emits a flammable vapor if it has not fully reacted. One of the tanks was taken out of service to patch some corroded areas. The product side of the tank was isolated. A hot work permit was issued and the atmosphere around the tank was checked for flammables and found to be in order.
Was it safe to proceed with welding? Absolutely not! While the atmosphere around the outside of the tank was checked, noone considered that there could be a flammable atmosphere inside the tank. Even though the process connections were locked out, the gas phase connection was left open to the other tanks. Noone recognized that flammables in the atmosphere of one tank could transport to the other tanks.
A 2010 Chemical Safety Board (CSB) study found that there were at least eleven instances where a severe injury or fatality resulted from welding on a tank containing a flammable atmosphere.
Is this issue covered by your procedures?
Contractor Awareness of Hazards
The fourth floor of the main processing building at a facility was being repaired. Cement was being pumped from the ground level. The cement truck was located next to the facility's tank farm. A crane was used to hold the cement hose above the tank farm which contained two large storage vessels of chlorine gas. When asked, the cement truck driver and crane operator did not know what was contained in the vessels or if the contents were hazardous.
Repairing floors and pumping concrete are not covered operations under OSHA's process safety management (PSM) standard. However, performing work within or in close proximity to a PSM-covered process requires proper awareness of the hazards present. In this particular situation, the cement truck driver and crane operator were subcontractors. The main contractor failed to share basic information about the process with those companies working for it.
The provisions of the PSM standard, and certainly the impacts of the hazards of an operation subject to PSM, apply not only to employees but also to visitors, contractors and subcontractors. Anyone present on-site needs to know the hazards present in areas where they will work and adjacent to them, and the provisions of the emergency action plan that pertain.
Is this true for your facility?
Protection of Hot Oil and Other Systems
At a pilot plant facility, a hot oil heating system did not have a low flow interlock. A switch failed “on” so that the oil continued to heat while not circulating (electric heater). Because of their location in the system, neither the pressure nor temperature interlocks were effective. The steel encasing the oil failed releasing hot oil, which ignited in the room only minutes after security passed through on rounds. At a plant owned by the same corporation, a similar incident occurred with a full-scale system, killing several workers. Hot oil systems must be designed with low-flow interlocks. Electric heating elements, unless designed to fail at low temperatures, can continue to heat until a failure occurs.
Does your facility recognize the need to protect hot oil systems with sensors that will operate in "no flow" situations? Are there similar situations with other protective measures where they will not function under various foreseeable circumstances?
Human Factors in the HMI
On investigating an incident involving high temperature heat transfer fluid at a facility, it was discovered that from approximately 2:00 to 4:00 in the afternoon, the operators could not see the control panel due to glare from the fall sun.
Do your human factors reviews recognize and correct deficiencies in the human-machine interface (HMI)? Do you have a system in place to respond effectively to operators' concerns about their working conditions?
At a solvent spun synthetic fibers facility, operators did not recognize for over 36 hours that a 60" duct carrying solvent laden air at 70% LEL had physically blown an end off and was releasing the mixture to the environment. Relying on detection and correction of an abnormal situation solely by operating personnel is a weak safeguard.
Are your operators well enough trained to recognize and respond to unusual process upsets in a timely manner? Does refresher training reflect lessons learned in recent incidents?
Expecting the Unexpected
A batch nitroglycerin process at a Government Owned – Contractor Operated (GOCO) facility exploded after having been operated without incident for forty-six years, proving once again that, “we have never seen anything like that,” is not a sufficient criterion for ruling a scenario out in a PHA.
Do your PHA teams understand that their charge is to identify the potential incidents that haven't happened but might? Are your risk tolerance criteria, and your culture, sufficiently rigorous to deal with rare events?
A series of PHA studies identified the possibility of the nitrogen blanket on flammable storage tanks being turned off so that the tanks might collapse during pump-out. Each scenario was judged to be acceptably safe individually. About 4 years later, one of the events occurred, and the company questioned the validity of the PHA. On review, they found that the tank collapse should have been expected based on the aggregate risk from all the tanks. They had no system to look at the aggregate risk and determine if they still met their safety criteria.
Does your company look at aggregate risk from similar scenarios that occur in multiple PHAs? If not, does management have a false sense of security?
Confined Space Created by a Tarpaulin
A work crew used a tarpaulin to provide protection from the weather while performing work on process piping. Inadvertently, they created a confined space but did not follow the company’s confined space procedure. One fatality occurred.
How will your employees know if they have created a confined space? Are they able to recognize when they encounter a confined space?