SPE Paper Number: 136694-PP Diesel Engine Runaway Safety Risk in Hazardous Environments

By Jogen Bhalla, Amot Controls

Copyright 2010, Society of Petroleum Engineers

This paper was prepared for presentation at the SPE Middle East Health, Safety, Security, and Environment Conference and Exhibition held in Manama, Bahrain, 46 October 2010.

This paper was selected for presentation by an SPE program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material does not necessarily reflect any position of the Society of Petroleum Engineers, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the Society of Petroleum Engineers is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of SPE copyright.

Abstract There are many potential ignition sources in the petrochemical, refining and oil and gas drilling industry; such as hot work, internal combustion engines, improperly classified or maintained electrical equipment, lighting, and adjacent fired equipment. These are typically controlled via measures such as hot work permits for: - Welding/burning - Hot work or vehicle entry permit requirements to operate engines inside posted areas - Proper electrical classification along with programs to maintain it, and - Programs/practices to prevent/detect releases of flammable materials. A large number of diesel engines (in vehicles, lighting towers, power generators and other equipment) are used in the petrochemical and oil and gas industry for their day-to-day operation. Diesel engine runaway is a serious hazard in oil and gas drilling and production and similar industries where flammable hydrocarbon emissions or leaks may occur. A runaway can be described as an engine running out of control on an external fuel source (i.e., the fuel in the air) where the operator cannot shut down the engine using conventional methods (i.e. turning off the engine ignition switch). In a total runaway engine situation, the result can range from minor engine damage to engine explosion, causing catastrophic damage to the equipment and surrounding facilities and/or death or injuries to personnel such as BP Texas City refinery and BP Deepwater Horizon explosions. Fortunately, there is simple, inexpensive technology available which can prevent a diesel engine runaway. The paper is presented to increase awareness and lessons learned from many accidents involving runaway diesel engines. The author will present what companies are doing around the world to avoid diesel engine runaway as an ignition source for explosions in the hydrocarbon industry.

136694-PP

Bio: Jogen Bhalla is a Vice President at AMOT with 25+ years of process instrumentation and control experience in the oil and gas, chemical and petrochemical industry. He became involved in controlling ignition sources including runaway engines after the BP refinery Texas accident in 2005 and has been working with OSHA, Cal OSHA and IADC to increase awareness on this potential detonation source that has resulted in numerous deaths and injuries in the hydrocarbon industries.

136694-PP 3

Diesel Engine Runaway Safety Risk in Hazardous Environments

By Jogen Bhalla, Amot Controls

The oil and gas and refining industry has experienced a significant increase in vapor cloud explosions within the last five years. These explosions have resulted in a large number of fatalities and environmental damage. The BP Texas City refinery and BP Deepwater Horizon incidents clearly demonstrate the risks associated with runaway diesel engines operating in hazardous environments.

The intent of this paper is to raise awareness within the industries processing hydrocarbons about (a) the potential fire and explosion hazards associated with runaway diesel engines; (b) the time it takes for an overspeed condition to occur after initial vapor release; (c) safe work practices operators should follow when operating diesel engines in hazardous areas; (d) risk to oil and gas companies when they allow unprotected diesel engines into their facilities; and (e) the responsibility of all employers to properly train employees and contractors on the safe operation of diesel engines.

Oil and gas and petrochemical companies which handle, or are exposed to hydrocarbons or other combustible gases or materials, should systematically identify hazards related to possible releases to the atmosphere of these materials. The results of the hazard identification process should be used to evaluate both the consequences of hazardous events and to determine appropriate risk reduction. Risk reduction measures should focus on: Preventing incidents (i.e., reducing the probability of occurrence) Controlling incidents (i.e., limiting the extent and duration of a hazardous event) Mitigating the effects (i.e., reducing the consequences)

136694-PP

Figure 1: Tank Farm Explosion involving runaway truck. Source: Center for Chemical Process Safety, AIChE-Process Safety Beacon, October 2009

Understanding the Hazard

Stationary, mobile and vehicular diesel engines are used in the oil and gas production, refining and petrochemical industry for their day-to-day operations. These industries are particularly prone to diesel engine runaway due to hydrocarbon vapor cloud release.

As refineries age and the oil and shale gas activity rises, the probability of a sudden hydrocarbon release increases substantially. Over time, refineries will require upgrades and expansions. This will require a large number of contractors and diesel engines to perform the work. The use of unprotected engines by employers and contractors will continue to increase the risk of fire, explosions, and fatalities.

The majority of the drilling and refining support operations are subcontracted to various companies. In these situations, safety may become compromised. New drilling technologies have enough risks of their own without the added unpredictability of human error.

Release Causes
The following are common causes of releases and leaks that can contribute to a diesel engine overspeed condition:

136694-PP 5

Hazardous area maintenance work Equipment failure Operator errors Overpressuring process equipment Natural disaster (e.g., earthquake) Gas and oil well blowouts Plant start-up/shutdown Process upset Power dip or interruption

Leaking control or safety relief valves Gasket failure/flange leak Pump seal/valve packing/fittings leak Sight glass blowout Electrical problem Holes due to corrosion Instrument calibration and deviation Metal fatigue Leaking/broken lines/pipes/fittings

Runaway Diesel Engine

A runaway can be described as an engine running out of control on an external fuel source where the operator cannot shut down the engine using conventional methods. During this condition, turning off the engine ignition switch, fuel system, shutting off the solenoid or disengaging the engine's load will not stop a diesel engine. An automatic diesel engine overspeed protection system installed in the engine's intake system is the most effective method of eliminating this ignition source.

Diesel engine speed is governed by the controlled amount of fuel fed to the engine through its normal fuel system and by its internal speed governor. When additional uncontrolled fuel is present in the environment, in the form of combustible vapors, the engine may ingest this uncontrolled fuel causing the engine to overspeed. If the engine draws in a flammable vapor, the engine is likely to backfire through the intake system. Turning off the normal shutdown system will only turn off the engine's normal fuel source, permitting the engine to run uncontrolled on the external fuel source. In a total runaway engine situation, the result can range from minor engine damage to engine explosion, causing catastrophic damage to the equipment and surrounding facilities and deaths or injuries to personnel.

Figure 2: Typical air intake system4 cycle diesel engine

136694-PP

In addition, a diesel engine is not just an ignition source but can potentially act as a hot box; a high-energy detonation source for a hydrocarbon release that can cause large scale explosions.

Figure 3: BP Texas City, BLSR and off-shore diesel engine explosions

High Risk Diesel Engines

Diesel engine powered equipment are required to perform many operations in oil and gas production and refining facilities. These engines listed below must be protected to prevent runaway conditions caused by unexpected hydrocarbon releases and leaks:

Stationary diesel engines: gas compressor engines, generator sets, pump stations Mobile equipment: forklifts, cranes, well servicing equipment, drilling rigs, drilling support equipment, backhoes, wheel loaders, excavators, skid steer loaders, portable generator sets, pump systems, trenchers, compaction equipment, light towers, welding trucks, straddle carriers, aerial work platforms, industrial lift trucks and other like equipment

Emergency response vehicles: fire engines, ambulances Vehicle mounted engines: pick-up trucks, trash haulers, vacuum trucks, environmental cleaning trucks, tankers, product haulers, pump systems

136694-PP 7

Area Classification and Diesel Engine Risk

Area classification is a method of analyzing and classifying the environment where explosive gas atmospheres may occur. The main purpose is to facilitate the proper selection and installation of equipment to be used safely in that environment, taking into account the properties of the flammable materials that may be present.

Hazardous areas are classified into zones based on an assessment of the frequency of the occurrence and duration of an explosive gas atmosphere. Diesel engine should be protected for Zone 1 and Zone 2 areas.

In addition to air intake shutdown systems, consideration should be given to explosion protection kits for mechanical and electronically controlled engines. Typically, these engines are used to drive equipment such as wireline units, nitrogen units, coiled tubing, cement or fire water pumps working in Zone 2 areas in the oil and gas industry. These protected engines will prevent the ignition of gas or vapor by cooling the engine skin temperature, eliminating sparking components and preventing overspeed conditions.

Choosing Appropriate Control Methods

Traffic management and control is the first step that can significantly reduce the risk of runaway diesel engine. Vehicle entry into or adjacent to processes handling flammables is not tightly enforced at some plants. Once vehicles are inside the gate, there is often no control of where they go; therefore, they may be in the wrong place at the wrong time (i.e., downwind and within the flammable cloud). Even if a flammable leak is detected promptly, not everyone with a vehicle may follow the engine safety procedures (e.g., turn off engine if not in the vehicle, turn off engine if emergency alarm sounds).

Refining and other large petrochemical facilities can incorporate advanced RFID technology to secure transportation access to secure facilities. This low-cost technology can provide:

Mobile and vehicular diesel identification and access control Safety equipment installation verification Personnel and visitor identification and access control Delay/denial of access to vehicles without safety equipment Ability to control the gates during any vapor cloud release

136694-PP

In addition, based on the Center for Chemical Process Safety, AIChE - Process Safety Beacon, October 2009 Safety Alert, the following steps can minimize or eliminate the safety risks associated with runaway diesel engines: Never drive into an area where you suspect there might be a flammable vapor cloud. Protect equipment driven by an internal combustion engine as this can also act as an ignition source. Such equipment might include mobile or portable generators, air compressors, engine driven pumps, and lawn mowers, etc. Educate personnel that the normal engine shutoff methods will not work as long as flammable vapor continues to enter the intake system. Install an automatic overspeed shutdown system on stationary, mobile and vehicular diesel engines operating in hazardous environment. This system detects the speed and activates the shutdown system as the engine speed level reaches an unsafe limit. Train site security personnel that control access to applicable facilities or areas. Inspect applicable engines for an automatic overspeed protection device prior to entering the facility. Educate employees, contractors and other users on how to properly maintain a diesel engine overspeed protection device. Do not allow unprotected diesel engines into the facility.

Recommended Control Methods by Diesel Engine Manufacturers and Experts

Most diesel engine manufacturers and dealers offer shutdown devices on their engines as standard and/or optional equipment. Check with your engine manufacturer for specific details. For after-market engines, air intake shutdown system manufacturers can provide magnetic pick-up speed sensors, speed switch and air intake shutdown valves along with a complete installation kit for each engine type. The installation kit can save many design, engineering and installation hours, as well as eliminate errors.

As shown in Figure 4, an automatic overspeed system detects the RPM velocity of an engine and activates the shutdown system as the RPM level reaches an unsafe limit. This action eliminates the diesel engine as an ignition source and limits the workers exposure to the hazardous environment. Automatic systems are available in the following configurations: Automatic electric overspeed detection shutdown system with manual override. Automatic electric to pneumatic overspeed shutdown system with manual and override. Automatic hydro-mechanical overspeed shutdown system with manual override.

136694-PP 9

Figure 4: Automatic overspeed shutdown system with manual override Manual systems are available in: Manual electric overspeed shutdown systems Manual electric to pneumatic shutdown systems Pneumatic manual shutdown systems Cable operated shutdown systems

Manual systems as shown below in Figure 5, are typically installed on smaller, vehicular or portable engines where an operator is continually present to activate the toggle switch or pull the cable handle to shutoff the air to the engine. Figure 5: Manual Electric to Pneumatic Shutdown System

10

136694-PP

Industry Recommended Practices

API, ISO, Canadian, British and other international standards recommend installing a field proven overspeed protection system for all diesel engines that are at high risk of ingesting flammables in order to prevent a diesel engine from becoming an ignition source. An overspeed shutdown system and a dry cyclone certified spark arrestors should be provided on all internal combustion engine exhausts operating within 23 meters of the well bore or oil and gas well drilling and servicing operations.

Following API area classification guidelines, it is recommended that any diesel engine operating within 7.6 meter (25 feet) of Class I, Division 2 electrically classified area in refineries, petrochemical, or similar facilities should be equipped with an overspeed protection system and a spark arrestor.

The intended function of a flame trap fitted to the exhaust system of diesel engines is to extinguish flames before they are discharged from open end of exhaust system or to atmosphere. Although there is no evidence to suggest that flames are discharged from exhaust system of normally running engines, flames may be present if engine ingests flammable gas or if abnormal combustion conditions exist. The case for fitting exhaust system flame traps is therefore based on possibility of flames being discharged if engine ingests flammable gases. The main drawback to exhaust flame traps is that they are very susceptible to carbon blockage, which if not rectified leads to engine power loss and overheating. A typical plate type flame trap may require cleaning after less than 24 hours of operating time. In addition, flame traps are expensive and vulnerable to damage. Nevertheless, if special reasons exist, flame traps may be fitted as additional precaution. In all cases where exhaust system flame traps are fitted, cleaning interval must be clearly established and cleaning made mandatory.

136694-PP 11

Figure 6: Spark Arrestors, Flame Arrestors, Flameproof Alternators

Current U.S. and International Standards

Many regulations and standards have been enacted with respect to diesel engine overspeed protection. Some of these are: MMS: 30 CFR 250.510, 250.610, and 250.803(b)(5)(ii) for off-shore diesel engines MSHA: Regulation 30 CFR 36, Para V (E) 1985 OSHA 2007 Petroleum Refinery Process Safety Management National Emphasis Program-Page A-53 Motorized Equipment NFPA 37 - Installation and Use of Stationary Combustion Engines and Gas Turbines API Recommended Practice 54 - Occupational Safety for Oil and Gas Well Drilling and Servicing Operations API Publication RP 2001 section 4.2.10 Cal OSHA State of California, subchapter 14 - Petroleum Safety Orders - Drilling and Production Article 35 Drilling and Well-Servicing Machinery and Equipment Subchapter 15. Petroleum Safety Orders - Refining, Transportation6874. Stationary Internal Combustion Engines U.S. Coast Guard - 58.1015 ISO3046-6;1990

12

136694-PP

European - EEMUA-107 "Recommendation for diesel engine operating in potentially flammable atmosphere" require the use of air intake shutdown valve with flame arrestor US Nuclear Regulatory Commission

Gaps in Current Standards

Canada and Europe have implemented comprehensive diesel engine safety standards and as a result has essentially eliminated the hazard associated with runaway diesel engines. API Drilling and Production recommended practices (RP) and Fire Protection in Refineries standards must not be viewed just as recommendations, but sound safety practices that must be followed and implemented to prevent fatalities, fire and explosions.

Process Safety Management (PSM) standards are administrative controls. Administrative controls address hazards through the development and application of suitable work systems and processes that involves human intervention at every step. Refineries should not solely depend on PSM standards to prevent runaway diesel engine incidents. Why? A runaway diesel engine, depending upon the richness of the environment, can explode in less than 60 seconds. Engine runaway can occur at any time and the gas cloud would typically reach the running engine in the area before the gas detector and will speed up the engine. If the air intake is not closed quickly, it could result in a valve bounce, flame, sparks, mechanical failure and ignition of the gas and air mixture. As the environment gains saturation and approaches the flammable limits, the engine runs faster and gets to the valve float / runaway condition sooner and explodes. When it explodes, the plume of flame ignites the air resulting in detonation.

In case of a sudden hydrocarbon release, the goal is to protect workers and operators. In many documented cases, workers were severely injured or killed trying to manually shut down diesel powered equipment or vehicles. The human instinct is for the operator or worker to use manual methods (clothing, books, piece of wood) to try to block the air intake to stop a diesel engine from overspeeding. This is very dangerous and is not an acceptable practice to control an ignition sources in an oil and gas facility.

Recent incidents confirm that the current PSM standards and Hot Work Permit programs by themselves cannot prevent runaway diesel engine explosion.

Hot Work Permit Program

136694-PP 13

Although many refineries and petrochemical plants control the use of diesel and gas engines into or adjacent to processes with Hot Work Permits, most permits only require continuous standby and gas monitoring when welding or burning is occurring. Vehicle entry generally requires an initial check for flammable gases, and periodic re-checks if the vehicle stays in the area (e.g., crane operation).

These practices make the likelihood of detecting a flammable release and shutting down the vehicle engine in time to avoid being the potential ignition source is extremely low.

Assuming, that all the steps required to check the presence of flammable gases and vapors under a Hot Work Permit program are completed, and a Hot Work Permit is issued to complete the work, the scenario can be as follows:

1. A vacuum truck, crane, lighting tower or welding machine is allowed to enter the oil and gas facility 2. A sudden gas leak caused by a ruptured disc or broken line at the facility creates a vapor cloud that moves with the air 3. The gas detector detects the vapor in the atmosphere once the percent exceeds the pre-set lower explosive limit 4. The gas detector reacts and sounds an alarm 5. An operator hears the alarm, stops his job and decides what to do next 6. If the operator or contractor is close to the engine and sees it running (e.g., a crane), they may try to turn it off when the alarm sounds 7. The operator climbs up the crane or the vacuum truck looking for the controls 8. The operator finds the fuel control and turns it off 9. The engine does not stop - it is consuming the same gas leak cloud and is running on compression ignition of the mixture 10. The engine overspeeds and puts a flame through the exhaust 11. The flame results in explosion of the gas and operator injury or death 12. The explosion spreads to the whole refinery resulting in additional fatalities - creating economic and environmental damage.

Typically, the operator or the contractor will not go to the engine (at point 6) and will run the other way and (if lucky) save himself, but the runaway and explosion would still happen, hurting other people. With several engines, working simultaneously, there could be several points of ignition. Considering that a runaway diesel engine can explode within

14

136694-PP

seconds, there is a high probability that the operator would be killed. Recent accidents validate this scenario.

Gas Detection
There are rarely enough detectors installed to pick up all possible flammable material releases. The detectors take some time to detect a leak (up to 1 minute for some types), and it is likely to take 5-10 minutes once a detector alarms before operators verify there is a release and begin to take action to stop it. By this time, the flammable release will have already reached ignition sources (such as diesel engines) in the vicinity. A running diesel engine may be the first gas detector to sense the leak. Moreover, there is rarely enough confidence in gas detectors to allow them to automatically take any action. If a diesel engine is equipped with an overspeed shutdown valve, the engine will be shut down as soon as the engine crosses the safe speed limit preventing explosion.

Lessons Learned
Based on the BP Texas City Refinery and Deepwater Horizon Explosion investigations and hearings, there are numerous diesel engine safety related issues that must be addressed. These include: 1. Rig power emergency shutdown devices should have actuation checked no less than once a week to determine that they are in proper working condition 2. All the other internal combustion engine air intake shutdown devices should have actuation checked no less than once each thirty (30) days. 3. A field proven overspeed protection system with proper installation kits for diesel engines in vehicles and mobile equipment should be used to prevent a diesel engine from becoming an ignition source. 4. Any diesel engine operating in or adjacent to a unit containing flammable liquids/gases under a hot work or similar permit should be equipped with an overspeed protection system. 5. Ensure that employees and contractors shut off their diesel engines when not in use. 6. Industry should not allow gasoline engines in hazardous areas (as they cannot be protected like diesel engines). 7. Provide adequate training on safe operation of diesel engines 8. Ensure that employees and contractors follow the company guidelines on operating diesel engines in hazardous areas

In summary, diesel engines come in a variety of design configurations and fuel schemes but handle air the same way

136694-PP 15

for combustion. Every diesel engine has the potential to overspeed when in the presence of hydrocarbon vapors. This fact, along with the previously mentioned contributors, proves that providing effective combustion air control is the only way to prevent diesel engine overspeed.

Acknowledgements: The Runaway Diesel-a side by side comparison-by C. Ferrone , Charles Sinkovits;Triodyne Inc. Center for Chemical Process Safety, AIChE-Process Safety Beacon, October 2009 James Thompson-ABS Consulting-Controlling Ignition Sources Dr. Sam Mannan-Mary OConnor Process Safety Center-Texas A&M Professor Trevor Kletz- Fellow of the Royal Academy of Engineering, the Royal Society of Chemistry, the Institution of Chemical Engineers, and the American Institute of Chemical Engineers.

ABOUT THE AURTHOR: Jogen Bhalla is a vice president at AMOT, with 25+ years of process instrumentation and control experience in the oil and gas, chemical and petrochemical industry. He became involved in controlling ignition sources and runaway diesel engines after the BP refinery Texas accident in 2005 and has presented and published numerous papers on the subject. Email: Jogen.bhalla@amot.com; (1)512.789.2751