Beruflich Dokumente
Kultur Dokumente
VESSELS
3.1 INTRODUCTION This chapter presents potential failure mechanisms for vessels and suggests design alternatives for reducing the risks associated with such failures. The types of vessels covered in this chapter include: In-process vessels (surge drums, accumulators, separators, etc.) Pressurized tanks (spheres, bullets) Atmospheric, fixed roof storage tanks (cone/dome roof) Atmospheric, floating roof storage tanks
Reactors are a unique subset of vessels, in that they are specifically designed to contain chemical reactions. Because reactors have unique failure scenarios specifically attributable to the reaction (e.g., reactant accumulation), a complete chapter (Chapter 4) is devoted to this important class of equipment. However, many of the generic vessel failure modes discussed in this chapter, such as corrosion related failures or autopolymerization may also apply to reactors. 3.2 PAST INCIDENTS "Those who cannot remember the past are condemned to repeat it" (Santayana 1905). Important lessons can be learned from prior mistakes. Several case histories of incidents involving vessel failures are provided to reinforce the need for the safe design and operating practices presented in this chapter.
3.2. / Storage Tank Autopolymerization Incident
Plant operating problems had resulted in the production of a tank (approximately 32,000 Ib) of glacial acrylic acid (GAA) which did not meet specifica-
tions due to high water content. The material was held in storage until it was loaded into a tank wagon, where it was to be kept until the GAA could be reworked. The operator's logbook specified that warm water (250C maximum) was to be used to keep the GAA from freezing (freezing point = 130C). The outside temperature was 5-1O0C at the time. A standard steam-water mixing station was used to supply the warm water to the tank wagon coils. Water flow was maintained to the tank wagon, but no measuring devices were available for observing actual temperature or flow rate. The steam-water mixing station operation was monitored and adjusted by observing that warm water was running out of the coil outlet (noting vapor evolving from water in the cold weather). It was not clear after the incident whether the tank wagon dome lid was open, or just loosened to allow "breathing" during the hold period. Approximately l5l/2 hours after the tank wagon was filled, vapors started blowing out the loosened tank wagon lid and accumulating in the vicinity of the tank wagon. The steam-water mixer was shut off and approximately six minutes later the tank wagon exploded. The blast effect from the explosion destroyed an adjacent loading rack/pipe rack, and damaged other plant structures. A combination of local overheating (hot surface) and local inhibitor deficiency was considered the most probable mechanism for initiation of polymerization. Contamination may have contributed to the violence of the polymerization once it was initiated. Water and iron were the two main candidates in contamination considerations. Screening experiments showed that water can reduce GAA stability at temperatures > 10O0C, and that soluble iron in the 1-100 ppm range can also reduce stability. See item 10 in Table 3 for potential design solutions. Ed. Note: This example illustrates the hazard of using temporary facilities for the storage of hazardous materials. Such facilities are often not subject to the same scrutiny as permanent facilities.
3.2.2 Storage Tank Stratification Incident Acetic anhydride is used as an acetylating agent for many compounds. When it reacts with a hydroxyl group, acetic acid is formed as a byproduct. Pure acetic anhydride will react energetically with water to form acetic acid. In typical acetylation reactions, an excess of anhydride is used to drive the reaction to completion. This excess is then reacted in the receiver tank with water to convert the excess anhydride to acid. The acid is then refined and remanufactured into anhydride. This operation can be performed safely, since die presence of acetic acid makes water and acetic anhydride miscible, and therefore the rate of reaction can be controlled by the rate of water addition.
In this case, the acetylation reaction did not proceed as designed, due to an inadvertent omission of the strong mineral acid catalyst needed to initiate the reaction at low temperatures (-1O0F). Thus, the receiver tank did not contain a mixture of acetic anhydride and acetic acid, but only very cold, pure anhydride. The operator in charge of the water addition did not realize the change in composition, and additionally failed to turn the tank agitator on prior to beginning the water addition. After several minutes of water addition, he realized his mistake with the agitator, and hit the start button. Immediately, the water, which had layered out on top of the cold anhydride, mixed and reacted violently. This caused a partial vaporization in the tank, and eruption through an open manway, resulting in fatal burning of the operator. Had the agitator been turned on prior to beginning the water addition, the reaction rate would have again been controlled by the water addition rate. In this case, the water was added at near-stoichiometric concentrations virtually instantaneously, resulting in an uncontrolled exotherm.
3.2.3 Botch Pharmaceutical Reactor Accident While two operators were charging fiber drums containing a penicillin powder into a reactor containing a mixture of acetone and methanol, an explosion occurred at the reactor manhole. The two operators were blown back by the force of the explosion, and were covered with solvent-wet powder. The incident was initiated by the ignition of solvent vapors, which resulted in a dust explosion of the dry powder. The solvent liquid mixture in the reactor did not ignite. Tests on the polyethylene liner inside the fiber drums, which had been grounded at the time of the incident, showed that they were of the non-conducting type. The most probable cause of the ignition was an electrostatic discharge from the polyethylene liner during reactor charging. After this accident, the company instituted the following procedures (Drogaris 1993): Requiring nitrogen inerting when pouring dry solids into flammable solvents Adding dry powder to the reactor by means of grounded metal scoops, where possible, rather than by pouring in directly from drums with polyethylene liners Using only conductive polyethylene liners Using a closed charging system rather than pouring dry powders into flammable solvents directly via an open manhole Performing an electrostatic hazard review of the whole plant and all the processes whenever powders and flammable solvents are used
Ed. Note: Even though this incident involved a reactor, it applies as well to any vessel, open-manhole, charging operation. Most likely the liners were loose and the operators not grounded. If fixed liners were in place and the operators grounded, the accident might not have occurred.
3.3 FAILURE SCENARIOS AND DESIGN SOLUTIONS The information on equipment failure scenarios and associated design solutions is introduced in table format in this chapter and followed in each subsequent equipment chapter. The organization of the tables is the same in each chapter. The table headings used are described below. Operational Deviationgeneric operational parameter deviation such as overpressure. Analogous to HAZOP parameter deviation. Failure Scenariospecific failure mechanism/cause for specified generic parameter deviation (e.g., overpressure due to upstream control system failure). Potential Design Solutionpotential design solutions that could be considered to reduce the risk of the failure scenario. For the reasons given in Chapter 2, the design solutions are grouped into the following three categories: inherently safer/passive, active and procedural. Vessel failure scenarios, along with associated design solutions, are presented in Table 3. Design solutions are provided for each scenario, although some scenarios do not have practical design solutions for all categories. Operational deviations marked with (T) are discussed in further detail in the chapter text.
3.4 DISCUSSION
3.4. / Use of Potential Design Solutions Table
It should be recognized that the design solutions presented are possible approaches for reducing the risk of the associated failure scenario. The authors of this book could not anticipate all the possible applications nor conditions that may pertain to a specific design situation. Also, the design solutions are not necessarily equivalent in terms of benefit in reducing the risk of the stated hazard scenario. Therefore, it is intended that the table be used in conjunction with the design basis selection methodology presented in Chapter 2 to arrive at the optimal design solution for a given application. Furthermore, some solutions are not applicable to all classes of vessels. (For example, designing
for maximum expected deflagration pressure is not practical for tanks designed to API Std 650 (1988) but should be considered for some pressure vessels.) Use of the design solutions presented in Table 3 should be combined with sound engineering judgment and consideration of all relevant factors. For example, let us assume that it is decided that a nitrogen blanketing system will be installed on an atmospheric storage tank to reduce the risk of internal explosion. Typically nitrogen supply pressures are significantly higher than the design pressure of a storage tank designed to API Std 650 (1988). Consequently the total system design also needs to address the hazard of overpressure due to uncontrolled opening of a high pressure utility system. This example illustrates an important aspect of the intended use of the equipment failure tables. The design and installation of safety systems, especially active systems, can also introduce potential hazards that were not originally present. Therefore, it is necessary to use the table in the context of the total design concept to insure that all hazards have been considered. As shown in the example, this may involve combining several scenario design solutions to arrive at a final acceptable design. Consequently, the table should be consulted at various stages of the design to reaffirm that all failure mechanisms are considered. Utilizing several design solutions for the same scenario is also possible and often desirable. Again referring to the design of a flammable liquid storage tank, employing ignition source controls (e.g., non-splash filling, grounding) as well as vapor space inerting may be desirable based on the consequences of catastrophic tank failure. In addition to providing the required degree of reliability for any one failure scenario, multiple safeguards may be the optimum approach to process deviations caused by very different failure scenarios. For example, suppose a vessel can be overpressured by deflagration in the vapor space in one scenario and by runaway reaction in another scenario. The deflagration event may be characterized by a high pressure rise rate but a modest pressure rise ratio. The reaction runaway may be characterized by a very high pressure rise ratio but a modest reaction rate early in the runaway. With this disparity in the scenarios, the optimum safeguard design might be pressure containment for the deflagration and emergency pressure relief for the runaway reaction. In this situation, these safeguards are not redundant.
The tables contain numerous design solutions derived from a variety of sources and actual situations. Many of the solutions are readily understood. In some instances, additional explanation is warranted to fully appreciate the
approach. This section contains additional information on selected design solutions. The information is organized and cross referenced by the Operational Deviation Number in the table.
Ignition of Flammable Atmosphere (3,19)
When applying vapor space inerting, there are some special circumstances that need to be recognized; namely, the presence of oxygen is needed for some hazard mitigation measures. For example, the corrosion inhibiting mechanism of certain metals (e.g., stainless steel) depends on the presence of some oxygen. Likewise, some polymer formation inhibitors that are added to reactive materials need oxygen to stay active. In such situations, a reduced oxygen atmosphere may achieve the desired balance between inhibitor activity and flammability protection. The use of flame arresters deserves additional consideration. Flame arresters are often implicated in vessel incidents, not because they are ineffective, but because they are misapplied or improperly maintained. Flame arresters that are not routinely inspected can become plugged (e.g., condensation/corrosion by stored fluids, foreign debris). Eventually, the protected vessel can be subjected to overpressure or vacuum conditions if the vessel is not protected by a relief device. Flame arresters do not necessarily provide protection against detonation unless specifically designed for that purpose. When using in-line flame arresters, it is necessary to evaluate the potential for deflagration to detonation transition (DDT) in the piping systems being considered. Information on analysis of DDT can be found in CCPS 1993, Chapter 13.
Chemical Reaction Increases Pressure (10)
In the case of cold storage tanks, emergency cooling needs to be independent since loss of primary cooling may be a cause of high reaction rate. When polymerization inhibitor is used, the solubility of the inhibitor in the reactive monomer over the range of potential operating conditions needs to be considered. For example, as acrylic acid melts, the inhibitor tends to stay in the solid producing a potential runaway hazard in the molten liquid. See Section 3.2.1.
Pressure Generated by Rollover (12)
The earliest recognized incident of rollover occurred in a Liquefied Natural Gas (LNG) tank due to density stratification. In this incident LNG was transferred from a tanker to a partially filled LNG tank. The LNG transferred was more dense than the LNG in the tank and was added to the bottom of the tank. As a result, two discrete layers of LNG existed in the tank. With heat
transfer from the surroundings, energy accumulated in the lower layer since the hydrostatic head of the upper layer suppressed vaporization. As the lower layer temperature increased, its specific gravity decreased. Heat transfer to the upper layer resulted in boil-off of methane and an increase in the specific gravity as the concentration of heavier components increased. In time the difference in specific gravity between the two layers disappeared, and the resulting rapid equilibration released the stored energy in the lower layer as a high rate of liquid vaporization. Fortunately, in this situation tank safety relief devices were able to provide adequate protection, and tank failure was averted (Drake etal. 1973). Rollover can also occur with two immiscible, reactive materials, such as acetic anhydride and water. As the materials react at the interface, acetic acid is formed as a reaction product. Once a sufficient amount of acid is generated, the two phases become miscible, collapsing together and generating a large, nearly instantaneous exotherm. With this energy release, the resulting reaction mixture can be partially vaporized, with an accompanying rapid rise in vessel pressure.
In flammable service, generally it is not desirable to allow air into a vessel to prevent vacuum conditions. Bleeding in an inert gas under pressure control is a design solution that is often utilized. Depending on the consequences of inert gas failure, an emergency supply of inert gas may be needed. In some instances, an air vacuum breaker is provided as a last line of defense. This design approach is based on acceptance of the lower likelihood of ignition instead of the much more likely prospect of damaging the tank which could result in loss of containment.
Tank Failure from Frost Hea/e (47)
This is a serious problem for design of cryogenic fluid storage tanks. However, it can be managed through proper foundation design. Design solutions that have been used include elevated foundation pedestals to minimize heat transfer from the soil and foundation heating elements.
3.5 REFERENCES
API Std 650 1988. Welded Steel Tanks far Oil Storage. Washington, DC: American Petroleum Institute. CCPS 1993. Guidelines for Engineering Design for Process Safety. Center for Chemical Process Safety, New York: American Institute for Chemical Engineers.
Drake, E.M., Geist, J. M., and Smith, K. A. 1973. Preventing LNG "Rollover." Hydrocarbon Processing. Drogaris, G. 1993. Major Accident Reporting System: Lessons Learned from Accidents Notified. Amsterdam: Elsevier Science Publishers, B.V. Santayana, G., 1905. The Life of Reason Vol. I, Reason and Common Sense.
Suggested Additional Reading API Publ 2210 1982. Flame Arrestersfor Vents of Tank Storing Petroleum Products, 2nded., Washington, DC: American Petroleum Institute. US Coast Guard 1990. Specifications for Tank Vent Flame Arresters 33 CFR Part 154, Appendix B, United States Coast Guard: US Department of Transportation. UL 525 1984. Flame Arresters for Use on Vents of Storage Tanks for Petroleum Oil and Gasoline, 5th ed. UL.
No. 1
l
Failure Scenarios Liquid overfill resulting in back pressure or excessive static head Inherently Safer/Passive Vessel design accommodating maximum supply pressure Use open vent or overflow line
Procedural Instructions to monitor level during transfer Verify tank has sufficient free board prior to transfer High level alarm with instructions to intervene to prevent overfilling Labeling of utility connections
Overpressure
No utility connections above pressure rating of vessel Incompatible utility couplings to prevent connections of high pressure utilities Mechanical flow restriction (e.g., restriction orifice) of utility with open vent on vessel Vessel design accommodating maximum utility pressure
Emergency relief device on vessel or utility line Pressure sensor interlocked to isolate utility pressure
Operational Deviations
Inherently Safer/Passive Floating roof tank instead of fixed roof (see procedural) Ignition source controls (e.g., lightning protection, permanent grounding/bonding, non-splash filling including dip pipe, fill line flow restriction, or bottom inlet) Vessel design accommodating deflagration pressure Store belowflashpoint (if not heating) Use non-intrusive instrumentation (e.g., radar level detection)
Active Explosion venting (e.g. frangible roof for fixed roof tank) Store material at temperature below its flash point (cooling) Vapor space combustible concentration control Vapor space inerting Flame arrester in vent path Emergency purge and/or isolation activated by detection of flammable atmosphere
Procedural Oxygen analyzer with alarm Instructions to feed empty tanks at low rate until fill line submerged, avoiding splash filling No transfers during electrical storms Low feed rate until floating roof is afloat
Overpressure
Use open vent (e.g., vent diameter larger Flow shutdown interlock Operating instructions to activated by high pressure limitflowto a maximum thanfillline for short vent lines) safe value or high flow Flow restriction orifice in fill line Operating instructions to Automated flow control Vessel design accommodating maximum monitor filling rate and loop on fill line with high supply pressure intervene to prevent flow alarm excessive fill rate Emergency relief device
Overpressure
External fire
Buried (underground or bermed) tank (consider environmental issues) Fireproof insulation (limits heat input) Slope-away diking with remote impounding of spills Locate outside fire affected zone Provide recommended tank-to-tank separation
Fixed fire protection water spray(deluge) and/or foam systems activated by flammable gas, flame, and/or smoke detection devices Emergency relief device
Emergency response plan Manual activation of fixed fire protection water spray (deluge) and/or foam systems
Overpressure
Inadequate or obstructed vent path, resulting in high vapor space pressure during filling
Use open vent Emergency relief device Vessel design accommodating maximum Heat tracing of vent to supply pressure avoid condensation and solidification Vent screen to avoid entrance of foreign objects
Operating instructions to verify open vent path before initiating fill operation Operating instructions to periodically examine vent opening for obstructions Periodic sampling/ analysis of contents for leakage Emergency action plan to transfer contents to safe location if adverse reaction can occur
Use of external heater/cooler (panel coil) Emergency relief device Use of heating/cooling medium which is High pressure interlock not reactive with vessel contents that activates utility Vessel design accommodating maximum closure heating/cooling medium pressure Back pressure control with external heating/ Use electrical heating cooling circulation to Use lower pressure/temperature heating avoid leak into vessel or cooling medium Vessel design accommodating maximum stored material vapor pressure at maximum heating medium temperature
Failure Scenarios
Inherently Safer/Passive
Active
Procedural
Vessel contamination Vessel design accommodating maximum Emergency relief device Isolation of volatile expected pressure with high vapor materials by blinding, Weak seam roof for tanks pressure material removable spool, Use of incompatible couplings (introduction of disconnection, etc. volatiles) Excessive heat input resulting in high vapor pressure Vessel design accommodating maximum Emergency relief device expected pressure High temperature or Limit the temperature orflowof the pressure alarm and heating medium (e.g., use hot water interlock which isolates instead of steam) the heating medium High temperature or pressure alarm with operator activation of heating medium isolation Operating instructions to periodically test for inhibitor concentration or activity High temperature and/or pressure alarm and manual addition of quench, diluent or inhibitor Manual activation of quench or cooling system Periodic draining of accumulation points (i.e., knock-out pots)
Overpressure
10 (T)
Overpressure
Chemical reaction Vessel design accommodating maximum Emergency relief device resulting in increased expected pressure High temperature and/or pressure Limit or avoid the storage or unintended pressure alarm and accumulation of reactive materials automatic addition of quench/diluent fluid or Consume reactive intermediate process inhibitor materials as soon as they are produced Automatic activation of emergency cooling system
11
Overpressure
Control or equip Vessel design accommodating maximum ment failure in vapor expected pressure recovery system on Additional insulation to prolong refrigerated/chilled acceptable refrigeration outage storage Roll-over of stratified layers, resulting in high vapor pressure
Emergency relief device High pressure interlock to automatically start spare compressor
12 (T)
Overpressure
Vessel design accommodating maximum Mechanically agitate or expected pressure recirculate tank contents Use of in-line mixer external to vessel to Emergency relief device premix feeds Provide tank filling system design that avoids tank stratification (e.g., top splash filling) Emergency relief device High pressure alarm and interlock which isolates the inlet flow(s) Emergency relief device or breather vent valve Automatic external cooling water spray
13
Overpressure
Failure of upstream Vessel design accommodating maximum process controls, expected or upstream pressure resulting in vapor or Ensure control valves are not oversized flashing liquid feed Ambient temperature change, resulting in higher vapor space pressure Vessel design accommodating maximum expected pressure Use of buried (underground or aboveground) tank Insulate tank Open vent on fixed roof tanks Place tank under a roof Use reflective coating on vessel
Operator activation of flow isolation on high pressure indication Operator activation of water spray on indication of high temperature in vessel
14
Overpressure
15
Overpressure
Vessel design accommodating maximum Emergency relief device upstream pressure Interlock to isolate vessel Eliminate unnecessary outlet block valves inlet or trip feed pump on high pressure Outlet sized to eliminate or reduce likelihood of plugging
Failure Scenarios
Inherently Safer/Passive
Active
Procedural Operating instructions to maintain liquid level above heating surface at all times Manual response to low level indication
Ignition/reaction due Vessel design to accommodate maximum Automatic level control to high temperature expected temperature and pressure with low level alarm and shutdown of liquid at unwetted internal Use of external recirculation heating withdrawal system to heating element sursystem ensure liquid is above face Maintain submergence of heating surface heating surface at all times by locating liquid withdrawal connection Vapor space inerting above the heating element Limit temperature of heating medium Selection of materials to avoid rust (i.e., eliminate potential catalytic effects) Heating and thermal expansion of liquid Temperature controls on Install open overflow nozzle to heating medium to containment system prevent overheating Elimination of all unnecessary heating High level shutoff connections preventing liquid from Eliminate capability to "block in" system rising above level where Provide vapor space in vessel expansion would cause overfill Thermal expansion relief valve
17
Overpressure
Operating instructions on control of temperature below a certain limit, or restrictions on the length of time that heat can be applied Instructions on limiting the maximum liquid level Manual shutoff on detection of high level Instructions on draining vessel or isolating source of heat input before blocking in
18
Electrostatic spark discharge and ignition of vapors during charging of solids through an open manhole or charging chute resulting in deflagration or flash fire
Eliminate addition of materials as solids (e.g., use slurry) Charging of solids through a nozzle by means of a closed system (e.g., hopper and rotary airlock, screw feeder, doubledump valve system, etc.)
Automatic inerting of vessel prior to solids addition Ground indicator with interlock to prevent manhole opening if ground connection to solids container is faulty
Manual inerting of vessel prior to solids addition Procedures for manual grounding and bonding of solids container and runnel to vessel Ground operator Avoid use of nonconductive plastic containers Verify acceptable oxygen concentration before charging
19 (T)
Ignition of flamma- Provide double roof seal ble atmosphere in Provide adequate natural ventilation tank vapor space folbetweenfixedroof and floating deck lowing seal failure Eliminatefixedroof provided over the on internal floating floating deck roof Ignition source controls (e.g., lightning protection, permanent grounding/bonding) Failure of vacuum system control
Use offixedroof tank with inerting Provide inerting between fixed roof and floating deck End-of-line flame arrester
Periodic inspection of roof seals Periodic testing for combustibles in tank vapor space
20 (T)
Underpressure or Vacuum
Vessel design to accommodate maximum Vacuum relief device vacuum (full vacuum rating) Automatic isolation of vacuum system on high vacuum
Inherently Safer/Passive
Active
Procedural
Vessel design to accommodate maximum Use of blanketing gas Operating instructions to vacuum (full vacuum rating) pressure control system to verify open vent path minimize vacuum before initiating Vent screen to avoid entrance of foreign withdrawal operation objects Vacuum relief device Operating instructions to Heat tracing of vent to periodically examine vent avoid condensation and opening for obstructions solidification Low pressure interlock to isolate outlet path Vessel design to accommodate maximum Use of blanketing gas vacuum (full vacuum rating) pressure control system to minimize vacuum Insulation Vacuum relief system Open vent Feed heater Vessel design to accommodate maximum Use of blanket gas vacuum (full vacuum rating) pressure control system to minimize vacuum Open vent Vacuum relief system Restrict withdrawal rate Vessel design to accommodate maximum Use of blanket gas vacuum (full vacuum rating) pressure control system to minimize vacuum Open vent on fixed roof tanks Vacuum relief device Insulation Locate tank under roof Operating procedure for monitoring temperature and addition rate of materials
22 (T)
Underpressure or Vacuum
23 (T)
Underpressure or Vacuum
24 (T)
Underpressure or Vacuum
25 (T)
Underpressure or Vacuum
Control or equip Vessel design to accommodate maximum Use of blanket gas ment failure in vapor pressure control system vacuum (full vacuum rating) recovery system on to minimize vacuum refrigerated/chilled Air vacuum breaker storage device Interlock to shutdown compressor/blower on low pressure
26
High external level High external pressure on vessel walls liquid from water level in dike or vault resulting in dislodging tank or external collapse of tank wall
Vessel design to accommodate maximum Dike level measurement external pressure with automatic drain or pump-out Use of remote impounding instead of dike Anchor tanks Elevate tank Dike height limits liquid level
Storm water drain system Operating instructions to drain storm water collected in the dike after heavy rainfall Keep tanks filled to a minimum liquid level Instructions to cool or shut off feed when temperature rises above a certain level Manual shutdown on high temperature indication
27
High Temperature High temperature Vessel design to accommodate maximum High temperature material fed to vessel expected temperature and pressure of interlock to activate feed material(s) cooling or shut off feeds at desired temperature High Temperature Control failure of heating/cooling system Vessel design to accommodate maximum High temperature alarm expected temperature and pressure and shutdown interlock experienced due to loss of heat transfer Auxiliary cooling/quench Use of heating medium whose maximum or heat transfer system temperature is limited to vessel design Emergency relief device temperature
28
Operational Deviations
Failure Scenarios
Inherently Safer/Passive
Active
Vessel design to accommodate maximum Emergency relief device expected temperature and pressure of a High temperature alarm possible exothermic reaction and interlock shutdown Substitute less-reactive material Automatic addition of reaction inhibitor and/or quench fluid Automatic activation of emergency cooling system Use of buried (underground or aboveground) tank (consider environmental issues) Insulate with fireproof insulation Provide remote impounding of flammable liquid spills Locate vessel to minimize exposure Provide recommended tank-to-tank spacing Fixed fire protection water spray (deluge) and/or foam systems activated by flammable gas,flame,and/or smoke detection devices Emergency relief device Fire detectors
30
Emergency response procedures Manual activation of fixed fire protection water spray (deluge) and/or foam systems Monitoring of vessel wall temperature with thermocouples or optical devices Instructions to turn off agitator on high temperature indication
31
High Temperature Excessive mechanical Vessel design to accommodate maximum Agitator shutdown on high temperature agitation expected temperature and pressure detection Limit agitator motor power Leave vessel uninsulated to allow heat loss
32
Low Temperature
Vessel design to accommodate minimum Automatic activation of expected (ambient) temperature heating system Use of buried (underground or aboveground) tank Insulate tank Locate equipment indoors
33
Low Temperature
Vessel design to accommodate minimum Low temperature alarm expected temperature and shutdown interlock Auxiliary heating system
Operate system manually or activate back-up heating/cooling system Instructions to isolate feed on low temperature indication
34
Low Temperature
Low temperature Vessel design to accommodate minimum Low temperature alarm material fed to vessel expected feed temperature and feed isolation interlock Low temperature alarm activates external heating
35
Low Temperature
Vessel design to accommodate minimum Low temperature alarm expected refrigerant temperature and refrigerant system shutdown and/or Use refrigerant with vapor pressure isolation interlock below process pressure Interlock to close depressuring valve at specific pressure Provide external heating
Manual system shutdown on low temperature indication Instructions to deinventory liquid before depressuring Instructions to warm-up vessel before repressuring Instructions to stop feed when level reaches a certain point
36
Low Temperature
Depressuring of Provide metallurgy suitable for low vessel containing liq- temperature uified gases
37
Over-fill
Install open overflow nozzle to containment system Closed loop filling Diking or drainage to remote impounding
Failure Scenarios
Inherently Safer/Passive
Procedural Operating instructions on correct or permitted crossconnections between tanks and vessels Operating/maintenance instructions to isolate tanks via blinding and disconnection Manual isolation on high level Leak detection devices (e.g., pH, conductivity, capacitance) and manual isolation
Incorrect or unantici- Install open overflow nozzle to pated crosscontainment system connection Use of dedicated connections Use of incompatible connections
39
Over-fill
Install open overflow nozzle to containment system External heating/cooling system Operation of heating/cooling system at pressures below process pressure Double tubesheet heat exchanger Intermediate heat transferfluidat a pressure below process pressure Install open overflow nozzle to containment system Orifice restriction in utility connection
High level alarm and automatic heating/cooling medium cutoff/isolation Electrical bonding of floating roof to tank
40
Over-fill
Leak or excessive fill from liquid utility system (e.g., utility water)
Operator isolation (e.g., disconnection, blinding, double block and vent) of utilities Leak detection devices (e.g., pH, conductivity, capacitance) and manual isolation
41
Low Level
Low level alarm with shutoff preventing further liquid withdrawal from vessel via either pump shutdown or closure of block valve Low level alarm with shutoff preventing further liquid withdrawal from vessel via either pump shutdown or closure of block valve
42
Low Level
Locate underflow nozzle to maintain a minimum liquid level in the vessel Eliminate all unnecessary crossconnections Use incompatible couplings to avoid improper cross-connections where hoses are used
Operating instructions on the correct or permitted cross-connections between tanks and vessels Operating/maintenance instructions to isolate tanks via blinding and disconnection Manual outflow isolation on low level indication
43
Ignition of flamma- Locate underflow nozzle to maintain a ble atmosphere in minimum liquid level in the tank tank vapor space following low level that results in floating roof sitting on its internal legs Incompletely sub Locate underflow nozzle to maintain a merged agitator minimum liquid level in the vessel impeller causes Agitator designed to run stably during excessive forces on filling and emptying (e.g., stiffer shaft, vessel wall and heads foot bearing)
Low level alarm with Operating instructions to interlock to automatically monitor tank level shutdown the transfer periodically pump Electrical bonding of floating roof to tank Low level shutoff Instructions to stop preventing further liquid agitation at withdrawal from vessel predetermined level Low level alarm with interlock to automatically shutdown the agitator
44
Loss of Containment
1
Procedural Corrosion coupons with periodic withdrawal and analysis Regular thickness measurements (i.e., nondestructive testing) at key points On-line corrosion analysis with alarm Respond to indication of tank subsidence
Inherently Safer/Passive Use corrosion resistant materials of construction Protective coatings and paints Double walled tank design
46 47 (T) 48
Design and construction of tank foundation (piling and soil compaction) Foundation heating system Self-closing drain valves Excess flow check valves Flammable and/or toxic vapor sensors interlocked with agitators
Frost heave (on cryo- Design and construction of tank genic tanks) foundation (elevated pedestal) Insulation between tank and foundation Open drain connections Loss of sealing fluid to vessel agitator resulting in seal failure and emission of flammable or toxic vapors Eliminate bottom connections Limit size of drain connections Circulate vessel contents via external, seal-less pump Use of double or tandem mechanical seal Alternative design which does not use a sealed agitator (i.e., continuous reactor with static mixer)
Operating/maintenance instructions to blind drains when not in use Operators to visually check reservoir levels on regular basis Seal liquid reservoir to have low level sensor and alarm Flammable and/or toxic vapor sensors Operator emergency response to indications of a seal leak
49
50
Floating roof sinks from snow or water on top of roof or corrosion of roof/pontoons Fire following seal failure on external floating roof Corrosion from contaminated earth moisture trapped between insulation and vessel walls chemical contamination aggressive environment Incorrect or unanticipated crossconnection
Provide fixed roof to protect the floating roof Double deck or pontoon floating roof Corrosion-resistant material selection for floating roof Use fixed roof tank Double roof seal Electrical bonding/grounding of roof and shell Protective coatings and paints Cathodic protection Use above-ground construction Do not insulate tank Locate below-ground vessel in secondary containment Install weatherproof jackets to protect insulation from moisture especially where chlorides may also be present Use of dedicated connections Use of incompatible couplings Physically separate points of connection of incompatible materials Use of interlocks which prevent certain addition combinations
Operating procedures for periodic draining of roof Periodic inspection and repair of pontoons Emergency response procedures Fire fighting foam system
51
Loss of Containment (Floating Roof Tank) Loss of Containment (Underground Storage Tanks and Insulated Vessels)
52
Corrosion coupons with periodic withdrawal and analysis Regular thickness measurements at key points Periodic leak detection
53
Wrong Composition
Operating instructions on the correct or permitted cross-connections between tanks and vessels Isolate tanks and vessels via blinding and disconnection Sample/analyze prior to transfer Color coding and labeling of lines
I
Procedural Periodic analysis to detect the presence of water or other coilfluidin the stored material Periodic draining of floating roof Intermittent sampling and analysis with instructions to cut-off feed Operating instructions to verify inhibition effectiveness periodically Manual activation of back-up pump around system Manual shut off of feed on detection of loss of agitation
Inherently Safer/Passive Indoor location (shielded from rain) External heating/cooling with leak protection Electrical heating instead of steam
Active
55
Wrong Composition
56
Incorrect inhibitor composition or concentration Failure of agitator causing stratification of immiscible layers External, inline mixing of feeds before entering tank Use of compatible/mutually soluble materials
Automatic control of inhibitor addition rate Agitator monitor interlocked to stop feed stream Automatic backup pump around system
57