One of the most common errors we find when asked to audit an RMP is the Tornado Hazard (Section 7.4.d). With all the recent storms the last three months I bet I have gotten 50 calls and 100 e-mails asking about severe weather scenarios for facilities. In this post, I want to walk us through a risk analysis involving a severe weather event and things your management team may want to consider in their discussions about severe weather risks.
First, if your facility takes a direct hit from a Tornado the least of your concerns will be your HHC. In fact, if your HHC is one that is liquefied under pressure, it will be gone before you exit your shelter! Now there is some concern if your HHC is a flammable liquid and has a lower vapor pressure; as this material could be pooled and quite possibly outside its secondary containment, allowing it to have a large surface area (which is REAL BAD with flammable liquids).
The concern with a tornado is not a direct hit, but rather suffering enough damage to cause significant structural damage that could cause equipment failure. For example, a plant that has an ammonia refrigeration system usually has its major components on the roof(s) of their facilities; this includes the majority of their HHC piping. This is being done by design as it gets the equipment out of the building and out of the way of mobile equipment, plus any leaks on pipe and pipe components are less likely to occur within working areas. And from an overall risk perspective, this is a GOOD thing; however, when you specifically look at a severe weather scenario, it actually increases the risk to the process with this scenario. For example, refrigeration condensers have HUGE SURFACE areas and are directly attached to the compressors so the ammonia load in this type of equipment could be HUGE. High winds hitting the side of these large units are a considerable force to deal with. Placing them on a roof 50′ in the air only exposes it to more force! See the typical condenser arrangement below.
If one of these units were to be blown over it would be a significant release AND if your ESD system is not designed properly it very easily could be a worst-case type scenario; just not sure if the process would lose its entire charge in 10 minutes and I am certain your atmospheric conditions would be MUCH MORE favorable (e.g. winds would be more than 1.5 mph). But this scenario would have the potential to lose an entire charge in a manner that could actually cause more issues than a WCS as defined by EPA (e.g. you could lose your entire charge over 30 minutes or many hours).
But why are we so concerned about tornadoes striking our process? They have captured our attention in recent weeks, but we often find more serious risks to the process that we CAN CONTROL and are not addressed by the facility. Some things to consider in your facility siting is not where the process is located, but rather what it located around the process. Earlier this week I posted an article about the NC Slim Jim plant that is closing after their tragic accident. They lost their entire ammonia charge (~39,000 pounds but not all went to atm, as they sent some to a retention pond) after an explosion caused significant structural damage, causing the roof to collapse, resulting in catastrophic damage to the ammonia refrigeration process. A simple question we should ask about our process is…does the process have any potential for structural damage from an explosion. Now there is ALWAYS going to be the chance for an explosion anywhere on the face of the earth, so I am not talking about an unsafe act type explosion; I am talking about the layout of the process and what is taking place around it. For example, we found a burn pattern on the outside wall of a process building during an audit. When asked, we were told it was from a fire involving a propane truck. The facility was siting a propane delivery truck right outside the process building during it’s unloading, which also meant all the propane was traveling through the process building. Investigating further, we found that the propane tank came first, and when the process was expanded, they built the expansion in the direction of their available real estate, which was available because it was there to be a buffer for the 20,000-gallon propane tank! This meant that the existing propane system would now be running through the new process building. They also did not change the propane unloading location. A propane truck is being unloaded about every other day, 52 weeks a year. This is a MUCH HIGHER risk to the process than a tornado strike. The PHA facility siting analysis should have caught this as a serious issue, but like most facility siting analysis the focus is on what the process could do to other areas and not what other areas could do to the process. Another lesson to be learned from this example is when doing a MOC for a process expansion, the change should ask some questions related to facility siting. Other things we have found that should be considered as a serious process threat:
1) flammable liquid storage within 20′ of pressure vessels (inside and outside of process areas),
2) having your oil recycling satellite collection inside your process battery limits,
3) storing your propane cylinders within the process or just outside process building exit door(s) and against the process building or worse yet, storing them inside a process building without proper administrative controls in place,
4) flammable liquids/gases unloading/loading stations within distances that an unloading incident could directly impact process safety; especially when the material is NOT associated with the process at risk, and lastly don’t forget your pipe racks that are carrying your HHC’s.
We tend to store things under pipe racks (e.g. flammable liquids, propane cylinder storage cages, empty pallets, etc.) that we feel the storage is “out of the way” and safe; however, all of these items pose a risk, some more significant than others, but all are a risk to the process and should be analyzed. I am not saying we can not store things under pipe racks, but if we are going to use these areas as storage areas, we have to be sure we are not increasing the risks to our process that go unchecked. We can fireproof our pipe racks so that if we do have a fire involving these materials stored under the racks, it will not cause a catastrophic failure of the pipe rack and release our HHC. There are other actions we can take, but these risks need to be reviewed.
So yes, a tornado is something to consider, but when you do your RMP, keep in mind we ONLY list tornado as a “hazard” when we have “designed our process” to withstand the effects of a tornado, which I am not sure how you do this, other than building a nuclear reactor building around your process!. Here are two excerts from EPA’s e-Submit User manual regarding tornado’s that we need to consider:
Section 6.14 states…
There may be some accidents that could not have been prevented because they were caused by events that are too rare to merit additional steps. For example, if a tornado hit your facility and you are located in an area where tornados are very rare, it may not be reasonable to design a “tornado-proof” process even if it is technically feasible.
Section Major Hazard 7.4.d.14 Tornadoes…
Report tornadoes as a major hazard only if they occur or are likely to occur at your site such that you plan and design for them.
Severe weather has captured our attention in recent weeks, but let us not be blinded by our everyday risk that poses a more significant threat to our process safety. We need to pay attention to severe weather threats, but we can not control these risks, but there are many risks we can control but often go unrecognized until it is too late.
I would also like to point you to a previous article where I discussed hail damage to pipe insulation that breaks the vapor barriers of the insulation, which leads to a serious problem called “Corrosion Under Insulation” (CUI). So again, a hail storm has a MUCH MORE likelihood of occurring and can cause significant issues later on down the road (e.g. pipe failure). We can not feasibly PREVENT hail damage to our outdoor piping insulation vapor barriers, but we CAN IMPLEMENT a CUI inspection process in our Mechanical Integrity Program that will PREVENT the catastrophic failure of piping caused by corrosion under insulation.
If you have questions about your process safety, facility siting risks, or your RMP, just contact me via e-mail or posting your comments and concerns below.
Bryan