8 safety systems

This chapter discusses overall safety analysis techniques lor evaluating production facilities, describes the concepts used to determine where safety shutdown sensors are required, and provides background and insight into the concept of a Safety and Environmental Management Program. 

To develop a safe design, it is necessary to first design and specify all equipment and systems in accordance with applicable codes and standards. Once the system is designed, a process safety shutdown system is specified to assure that potential hazards that can be detected by measuring process upsets are detected, and that appropriate safety actions (normally an automatic shutdown) are initiated. A hazards analysis is then normally undertaken to identify and mitigate potential hazards that could lead to fire, explosion, pollution, or injury to personnel and that cannot be detected as process upsets. Finally, a system of safety management is implemented to assure the system is operated and maintained in a safe manner by personnel who have received adequate training. 

Safety analysis concepts are discussed in this chapter by first describing a generalized hazard tree for a production facility. From this analysis, decisions can be made regarding devices that could be installed to monitor process upset conditions and to keep them from creating hazards. 

This analysis forms the basis of a widely used industry consensus standard, American Petroleum Institute, Recommended Practice 14C, Analysis, Design, Installation, and Testing of Basic Surface Systems for Ofi- i orc Production Platforms (RP14C), which contains a procedure tor dcicnniniiig required process safety devices and shutdowns. The procedures ilescribed here can be used to develop checklists for devices not covered by RP14C or to modify the consensus checklists presented in RP14C in areas of the world where RPI4C is not mandated. 

While RP14C provides guidance on the need for process safety devices, it is desirable to perform a complete hazards analysis of tlie facility to identify hazards that are not necessarily detected or contained by process sLifety devices and that could lead to loss of containment of hydrocarbons or otherwise lead to fire, explosion, pollution, or injury to personnel. The industry consensus standard, American Petroleum Institute Recommended Practice 14J, Design and Hazards Analysis for Offshore Facilities (RP14J), provides guidance as to the use of various hazards analysis techniques. 

An RBMK reactor is equipped with the following safety systems  

Accident analysis is intended to assess the capability of the plant systems and personnel to cope with abnormal and accident conditions. For analysis, it is helpful to classify the initiating events. Various approaches to this classification are possible. The Safety Report [1] suggests using the following attributes to classify initiating events  

Initiating event Frequency (1/reactor-year) Characteristic Identification 

Design basis 10-Uio-i Anticipated during nuclear power plant service life Anticipated operational occurrence 

---

Early decisions made purely for process reasons often can lead to problems of safety and health (and environment) which require complex and often expensive solutions. It is far better to consider them early as the design progresses. Designs that avoid the need for hazardous materials, or use less of them, or use them at lower temperatures and pressures, or dilute them with inert materials will be inherently safe and will not require elaborate safety systems. ... 

The best way to deal with a hazard in a flowsheet is to remove it completely. The provision of safety systems to control the hazard is much less satisfactory. One of the principal approaches to making a process inherently safe is to limit the inventory of hazardous material, called intensification of hazardous material. The inventories we wish to avoid most of all are flashing flammable liquids or flashing toxic liquids. 

Event Trees. Event trees use an inductive logic approach to consider the effects of safety systems on an initiating event. The initiating event is propagated through the various safety functions. Branching is dependent upon the success or failure of the safety function. 

Safety is a critical aspect in the design of phenol plants. Oxidation of cumene to CHP occurs at conditions close to the flammable limits. Furthermore, the CHP is a potentially unstable material which can violendy decompose under certain conditions. Thus, phenol plants must be carefully designed and provided with weU-designed control and safety systems. 

The pilot plant must also be carehiUy designed so that its control and safety systems are "fad-safe" and any unexpected equipment or utdity fadure brings the unit into a safe and de-energized condition. Unexpected or rapid process changes, if they can herald or lead to dangerous conditions (eg, mnaway exothermic reaction), should be continuously monitored by appropriate instmmentation and suitable automatic action provided (1,55—67). 

J. A. Wilkinson and B. W. Balls, "Microprocessor-Based Safety Systems Designed for Fine and Gas and Emergency Shutdown AppHcations,"... 

Actuators often provide a failsafe function. In the event of an interruption in the powder source, the actuator will place the valve in a predetermined safe position, iisiiallv either full open or full closed. Safety systems are often designed to trigger local failsafe action at specific valves to cause a needed action to occur, vv4uch rnav not be a complete process or plant shutdown. 

The design and implementation of safety systems must be undertaken with a view of two issues ... 

Regulatoiy. The safety system must be consistent with all applicable codes and standards as well as generally accepted good engineering practices. ... 

Technical. Just meeting all applicable regulations and following the crowd does not relieve a company of its responsibilities. The safety system must work. 

The ultimate responsibility for safety rests with me operating company OSHA 1910.119 is clear on this. Each company is expected to develop (and enforce) its own practices in the design, installation, testing, and maintenance of safety systems. Fortunately, some companies make these documents public. Monsanto s Safety System Design Practices was published in its entirety in the proceedings of the International Symposium and Workshop on Safe Chemical Process Automation, Houston, Texas, September 27-29, 1994 (available from... 

The purpose of the logic within the safety interlock system is veiy different from the logic within the process controls. Fortunately, the logic within the safety interlock system is normally much simpler than the logic within the process controls. This simplicity means that a hardwired implementation of the safety interlock system is usually an option. Should a programmable implementation be chosen, this simplicity means that latent defects in the software are less likely to be present. Most safety systems only have to do simple things, but they must do them very, very well. 

Reactive System Screening Tool (RSST) The RSST is a calorimeter that quickly and safely determines reactive chemical hazards. It approaches the ease of use of the DSC with the accuracy of the VSP. The apparatus measures sample temperature and pressure within a sample containment vessel. Tne RSST determines the potential for runaway reactions and measures the rate of temperature and pressure rise (for gassy reactions) to allow determinations of the energy and gas release rates. This information can be combined with simplified methods to assess reac tor safety system relief vent reqiiire-ments. It is especially useful when there is a need to screen a large number of different chemicals and processes. 

Deflagration pressure can be reduced substantially by suppression. Figure 26-30 shows the pressures measured in an ethylene-air explosion and a sodium bicarbonate-suppressed ethylene-air explosion. Fike Corporation, Blue Springs Missouri, and Fenwal Safety Systems, Marlborough, Mass., supply explosion suppression systems. 

Same sensor used for basic process control system and safety instrumented system. Failure of sensor leads to loss of control system and safety system functionality. 

Provide critical alarms and safety systems independent of BPCS... 

Install separate (independent) hardwired safety systems... 

Balls, B. W., A. B. Rentcome, and J. A. Wilkenson. 1987. Specification and Design of Safety Systems for the Process Industries, 8th International System Safety Conference, New Orleans, EA. 

NFPA 1982 Standard on Personal Alert Safety Systems (PASS), 1998 edition. National Fire Protection Association, Quincy, MA. 

Plausibility Analysis A comparison of values for process variables that allows faults in the measurement channels of the safety system to be recognized while the process is still in its normal operating range. 

Process Safety System (PSS) A process safety system comprises the design, procedures, and hardware intended to operate and maintain the process safely. 

The individuals and firm most familiar with the technology should review the intermediate and final procedures to assure both safety and commercial interests are satisfied. In many batch operations the procedure(s) can be a substantial portion of the process technology package. The procedures represent both a major safety system as well as a propriety technology. The pre-startup review should assure both PHA related and other changes proposed to the procedures have been approved and implemented. 

Most tolls involve the transfer of proprietary information from one party to the other, typically from the client company to the toller. Each party should have maintained a log of transferred documents or software code to make the return of proprietary documents a simple matter. An initial list of the documents should have been referenced in the contract or as part of the technology package. Keeping records of additional documents transferred during the course of the toll will help eliminate confusion at the end of the project. The toller may need to retain documents appropriate for their process safety system needs. 

An assessment package is a tool within a system. It can provide assessment forms, guidance notes and scoring guidelines to conduct an evaluation of a toller s quality/safety system. This sample uses assessment forms to evaluate fourteen components. The results are then compiled in the evaluation summary. The evaluation summary is the basis for a report back to the toller and for mutual discussion... 

Do audits assess that quality and safety activities comply with planned activities, that the quality and safety system are effective and that defined procedures and methods are being followed ... 

Audits should assess whether the actual quality improvement and safety activities comply with planned activities. The effectiveness of the overall quality and safety system should be scrutinized. Fundamental procedures and methods should be investigated to insure they are up-to-date and being followed in actual practice. The focus of the audit should be prevention, that is, finding areas needing improvement before they actually turn into situations that generate iioiicoiiformaiice. 

Critical Equipment Equipment, instrumentation, controls, or systems whose malfunction or failure would likely result in a catastrophic release of highly hazardous chemicals, or whose proper operation is required to mitigate the consequences of such release. (Examples are most safety systems, such as area LEL monitors, fire protection systems such as deluge or underground systems, and key operational equipment usually handling high pressures or large volumes.)... 

Recommended practices for seismic qualification of electrical equipment of the safety system for nuclear generating stations ... 

Once a decision to use QRA has been made, you must decide whether frequency and/or consequence information is required (Steps 6 and 7). In some cases you may simply need frequency information to make your decision. For example, suppose you wish to evaluate the adequacy of operating procedures and safety systems associated with a chemical reactor. The main hazard of concern is that the reactor could experience a violent runaway exothermic reaction. You believe that you know enough about the severe consequences of a runaway and nothing more will be gained by quantifying the consequences of potential run-... 

Another way of interpreting absolute risk estimates is through the use of benchmarks or goals. Consider a company that operates 50 chemical process facilities. It is determined (through other, purely qualitative means) that Plant A has exhibited acceptable safety performance over the years. A QRA is performed on Plant A, and the absolute estimates are established as calibration points, or benchmarks, for the rest of the firm s facilities. Over the years, QRAs are performed on other facilities to aid in making decisions about safety maintenance and improvement. As these studies are completed, the results are carefully scrutinized against the benchmark facility. The frequency/consequence estimates are not the only results compared—the lists of major risk contributors, the statistical risk importance of safety systems, and other types of QRA results are also compared. As more and more facility results are accumulated, resources are allocated to any plant areas that are out of line with respect to the benchmark facility. 

---