Incident control rooms

Plant Fireproofing. There is a growing practice in the chemical industry of locating principal equipment out of doors and to enclose only a control room where all instmments and control equipment are centered. The control room should be resistant to potential explosion, fire, and toxicity ha2ards of processes in the vicinity. Prompt and ordedy shutdown of processes following a serious incident is essential in order to minimise personnel-injury and property-loss ha2ards (65,66). 

The separation plant had been running smoothly for several weeks and the planned shutdown was some time away. On the day of the incident a number of unusual events occurred which contributed to its development. Shortly after the start of his day shift, the control room operator received a high vibration alarm from booster pump A in the crude fluid separation building. Following normal procedure, he switched over to the standby pump (pump B), switched off pump A, and told his supervisor of the alarm. The supervisor subsequently organized a work permit for work to be carried out on pump A by the day shift maintenance team. The permit was issued and repair work... 

A mismatch between operator procedures and the automatic control system of the reactor (see also Table 17) was the first active failure identified in this scenario. This precursor was still present mainly due to a shortage of people. Literally it was said that the pressure relief valve would open if the wrong value was inserted into the reactor s control system. The second precursor was the failure of the pressure relief valve (see also Table 17), which was not known to the responsible person who decided to ignore the difference between procedures and control system. The pressure relief valve failed, because resins stuck in the valve after it was used for the first time. Consequently the second time the valve was opened it was at a much higher pressure due to the build up of resins in the valve. If this second precursor had not been observed in time by damp on the pipes situated above the pressure relief valve or by the alarms in the control room a possible accident scenario existed. This was especially dangerous as the alarms in the control room are often ignored because of the high incidence of false alarms (see also Table 17), which was the third precursor present. 

The latest designs for onshore installations cater for a centralized control room, well distanced from the operating facility with sub control areas as part of a distributed control system (DCS). The sub-control areas are closer to the processes but contain fewer personnel and process control systems for the overall plant, so the overall risk level for the facility from a major incident is lowered. The outlying control buildings (sometimes referred to as PIBs or SIHs) still need to be sited against impacts from explosions and fires. 

CCTV technology is used to analyze digital images and identify the characteristics of a fire. CCTV can provide both a control action and display the picture in a staffed control room. The latter has a particular benefit as it allows very rapid incident assessment and also reduces the need for personnel to enter the area to investigate the fire conditions. In general terms, the CCTV flame detection system is comprised of three basic components the camera/detection element, the control panel, and the display computers. 

Isolation or emergency shutdown (ESD) valves should be installed to stop fuel flow and the process feed flow into the heater in the event of heater tube rupture. These valves can be automatically actuated by controls or safety interlocks or can be manually operated remotely. Remote actuation can be from a control room console or in the field field actuation stations should be located at least 50 ft (15 m) from the heater. It is also common to provide a manual block valve, located at least 50 ft (15 m) from the heater, on each of the fuel and process feed lines. These should be accessible to operators in the event of an incident involving the heater. 

Control rooms serving more than one process unit do not present unique hazards when considering the proper location of the building. However, they can significantly increase the size of a loss because of their multiple uses. For example, an incident in one unit could damage the central control room and impact the ability to operate other units. The business interruption financial impact is likely to far outweigh the actual damage repair costs. 

To protect the control room area from incidents occurring in the support areas, the control room area should be separated from the support areas by minimum 1-hour fire-rated partition walls. All penetrations of the walls, floors, ceilings, and roof for cables, etc. should be closed with an approved sealant having a fire resistance rating of at least one-hour. Approved y4-hour rated (Class B) fire doors equipped with self-closing devices should be installed on all openings between the control room and other portions of the building. 

The gas plant that was destroyed had been initially commissioned in 1969. It had not undergone a mechanical inspection for six years. Shutdowns were initially scheduled at three-year intervals, but this interval was extended to five years. The plant had not been retrofitted with modern instrumentation. Pen recorders were prevalent in the control room and operating problems had been encountered with several control valves. Three months before the incident, ice plugging in lines caused several process upsets that were not fully investigated. A defective bypass valve had leaked gas to the atmosphere and had been awaiting maintenance up until one day before the accident. 

The practical experiences in process control rooms mentioned earlier clearly point at biases in describing and classifying incidents the pilot studies mentioned in Chapter 2, the survey to be presented in Chapter 7, and also the Exxon case in Chapter 8 all show a tendency on the part of safety officers to concentrate on clearly visible S-B elements of task performance (e.g. pressing the wrong button) rather than on less obvious R-B errors (e.g. planning), let alone on the mainly cognitive, internal activities involved in K-B behaviour. 

The incident took place at a Central Control Room (CCR) panel controlling a socalled Hydrogen Concentration Unit (HCU), A sudden change in the flow of the feedgas to the HCU triggered an alarm, in the control room which was subsequently detected and interpreted by the operators responsible for this unit in a correct and timely fashion their appropriate corrective actions resulted in preventing a costly trip (e.g. automatic shut-off) of the entire unit. 

September 27, 1999- Control room operator discovers that two "pressurized" ton containers have been in the 90-day storage site for greater than the allowed time. Report of incident states that information transmitted to management after discovery of tons is "less than adequate,...training received on environmental inspections is inadequate." Incident results in a Government Nonconformance Report and an EG G Deficiency Report. 

The units of measurement for some of the process variables on the DCS displays were different from what the operators were used to (e.g., lbs of product in a vessel instead of % full). This caused confusion in the control room and required the operators to create temporary conversion notes to place next to the DCS monitors. Not all of these eonversion notes had been developed at the time of the incident and the use of such conversions could have led to delays in comprehending the information being presented. 

As a result of the analysis of events during the accident at the Three Mile Island nuclear plant (TMI, March 1979), the importance of human error in nuclear plants was better understood. The accident resulted from the confusion of the control room operators with inadequate instrumentation and inaccurate procedures. The most important factor was that they had to act in spite of the weaknesses in the training to respond to unexpected events. Therefore, the United States Nuclear Regulatory Commission (USNRC) called for the improvement of Emergency Operating Procedures (EOPs) and in nuclear reactor operator training. The philosophy of incident response implemented in the improved procedures was to take a symptom-based approach (operators foUow a series of yes - no questions to ensure that the reactor core remains covered and only then determine what was the cause of the problem) (USNRC, 2009). 

How can you help your organization focus on process safety when things are operating very smoothly How do you reduce the potential for complacency to low probability, high consequence events Where can you locate easy-to-use gang box rea or control room ready training materials to remind your employees of the reality of the type of incidents they could face ... 

Warranted Access Zone (Zobe V), jr 105-N Control RoSm Provide warranted access to control room for at least limited periods after any credible incident Atmospheric Atmospheric None... 

---