Loss of Primary Containment (LOPC) is a term used to describe an event where a pipe or vessel leaks or fails, releasing its contents. No Process Hazards Analysis should be considered complete until each circuit of pipe/hose and vessel(s) has been reviewed for LOPC.
In an interesting twist, a couple of clients have decided to take a big step in their PSM efforts by venturing away from their traditional “What-if Checklist” they have used for the past 20 years (i.e. the last four PHA’s). These clients have all decided to use the HAZOP methodology and to actually start from scratch in studying their process hazards with this new methodology. In doing these HAZOPs we have come across some interesting scenarios that do not appear to have been studied “in detail” in previous PHA’s. Not being an expert in ammonia refrigeration, some of these scenarios are puzzling to me, as I have never experienced an organization accepting these LOPC events as “status quo”. I need some help in understanding what other refrigeration processes have in place to deal with LOPC in unoccupied refrigerated spaces. For example, this 4th of July holiday many facilities will be shut down for the holiday, but the production areas will continue to be refrigerated and this leads me to my questions/concerns.
The scenario involves LOPC (i.e. pipe) in an unoccupied refrigerated space. I think we can all agree that if there is one area of process safety that businesses still struggle with it is getting their pipe circuitized into a manageable/functioning inspection program and fully inspected so that a baseline can be established. With that said, we can just admit that we have one recommendation to get the pipe circuitized, into the CMMS, and get our baseline readings sooner rather than later! And let me be very clear here, what I mean is that if anyone walks up to ANY section of ammonia pipe and ask “has this been inspected”, someone could look at the P&ID (or an ISO) and without hesitation say “Yes – and here are the results”; they would be able to say that between Valve X and Vessel Y the pipe was inspected on XX/XX/XXXX. This would be the case for every inch of pipe/hose/tubing that the HHC flows through (or could flow through).
So let me set this LOPC event up… the LOPC occurs during a downtime (holiday, weekend, etc.) which means that the refrigerated area will be unoccupied and only inspected during the refrigeration techs “daily (or shift) rounds”. We can even consider the rounds are done every eight hours, as this shorter period really has little to no impact on mitigating the consequences involved, as I am certain that an LEL of ammonia can be achieved in much less than eight hours. NOTE: do not translate that no production demands (e.g. reduced heat load) means that during the down time the “rounds” can be less frequent! As long as the process is operating – it is business as usual for the refrigeration technicians and any change from normal rounds frequency should require an MOC review!
During the unoccupied time, the business is still trying to maintain temperature in the room, so this means the refrigeration process is delivering liquid ammonia to the evaporator(s). When the LOPC event occurs, no one is present; just a failure of 50 year old pipe that has never been inspected or properly cared for in its lifetime. Liquid ammonia is then delivered to the unoccupied refrigerated space via the LOPC. So what are the design expectations and safeguards for this refrigerated space which is now receiving an unconfined Class I Group D flammable material?
- Ammonia detection and alarm signal back to refrigeration tech(s)?
- Ventilation to remove the ammonia?
- Area designed as a Class I Div 2 HAZLOC?
- Other options/ideas?
In an odd twist, we would almost be better off if this LOPC event occurred while the room was occupied; granted no one is directly exposed to the liquid ammonia and everyone can safely evacuate the room! But at least we would have some indication of an issue in the room; but in an unoccupied room, what system is in place to notify anyone of the LOPC event?
In my HAZOPs I ask the simple scenario: NO FLOW; caused by LOPC. What safeguards are in place to PREVENT this event from initiating? As I said earlier, having the process piping in the MI inspection and testing program and having a solid baseline is an absolute MUST, but after this baseline MI effort, what is in place to PROTECT and/or MITIGATE the consequences of this event? How would the process controls respond to this scenario or would the process automation respond at all or in time to prevent an explosive atmosphere? So far, in six HAZOPs on ammonia refrigeration processes, each team has concluded that the process controls would continue to send liquid ammonia to the evaporator, thus into the refrigerated space. Could the entire contents of the process be emptied into this space before actions could be taken? Without any type of detection system or process protection for “excess flow” what do businesses have in place to address this scenario? Not sure about other businesses, but the businesses this has been posed to struggled to come up with a solid plan/system to address this LOPC event in an unoccupied refrigerated area.
Showing my ignorance and playing the role of the PHA facilitator, I asked the stupid question… “why is there so much attention to the “engine room” (now called “machinery room”) when it comes to detection and ventilation and so little attention shown to other areas where the HHC is present in quantities that could result in a catastrophic incident (i.e. release/explosion). For example: If we were to walk into each area where an evaporator is present and ask “what happens if there is a leak in this space when it is unoccupied”, what is the answer? Keeping in mind that Ammonia has two “WHAMMYS” of concern: 1) toxicity and 2) Explosion. With no one present in the refrigerated space, we can put toxicity concerns in the back seat and focus on the explosion hazard of ammonia.
I began to think back to my petro-chemical days and wondered why this was not a problem in my processes back then. What was different? We always did LOPC for every line/vessel in our PHAs and we never had this concern. Then it hit me… our process was “occupied” anytime the HHC was present. Operators were in constant contact with the process. If we had “remote areas” where operators would be unable to identify a LOPC event, we equipped it with detectors that sounded a local alarm, as well as on the control room DCS panel. Depending on operator response capabilities to the alarm, there were many occasions where an excess flow valve was used to ensure that a FULL LOPC could be controlled without timely operator response. In a refrigerated plant, the core of the process is the “machinery room”, but outside the machinery room, the layers of protection appear to be dramatically reduced and in some cases there are no safeguards in place for a LOPC event. It is these spaces, when unoccupied that present a significant explosion hazard to a business.
So back to the event analysis; LOPC in an unoccupied refrigerated space. What do businesses have in place to deal with this event? If the business is 24/7/365 the risk drops considerably for this “unoccupied” scenario since early detection would be in place while the space was occupied; but I would argue the risk does not go to zero, as most refrigerated spaces are NOT occupied 100% of the time AND detection of the LOPC event is just the first step in addressing the LOPC.
NOTE: I will not argue that the odor threshold of ammonia is very low, but I would personally not list this as a “safeguard” in a PHA, although there are a lot of facilitators that do.
Some specific questions I would have about a particular scenario:
1) with the size and pressure of the delivery pipe to the evaporator(s), how long would it take before the space achieved the Lower Explosive Limit (LEL) of ammonia, which is 16%? Basically, how fast would this LOPC event need to be identified in order for the process to respond or for the technician to respond in order to ensure that the LEL is not achieved.
2) when would the process begin to experience problems in other parts of the process? Are there other “unintended safeguards” that would aid in the detection and/or control of this event, such as a low level alarm on the accumulator or receiver? Would this “unintended safeguard” be adequate in notifying the technician (or anyone) of the LOPC event? Would businesses be willing to incorporate into their SOP that on the deviation of the safe lower limit in the vessel(s) that the operator was to initiate emergency shutdown? How long would it take a technician (or two or three – depending on your staffing levels across all shifts) to investigate a low level alarm on a vessel? Could they get the alarm, process the data and troubleshoot potential causes and then travel to ALL refrigerated spaces to locate the LOPC and then return to the engine room and initiate emergency shutdown before ignition occurs?
3) is it possible to lose 100% of the ammonia charge to this unoccupied area? 75%?, 50%?, 25%? What is in place within the design of the process per IIAR or ASHRAE codes, standards, or bulletins that addresses this LOPC event in an unoccupied refrigerated space? What are we missing that others in the refrigeration industry have in place?
Potential solutions?
In food plants, the daily sanitation that takes place is extremely hard on equipment, including ammonia detectors. So the industry in general has resisted installing ammonia detectors in these areas, as they get destroyed on a too frequent basis. But there may be an easy solution to prevent damaging detectors…
Install the ammonia detectors in the HVAC return duct work. This will provide protection against the sanitation damage, as well as ensure that the detectors are seeing a sampling of atmosphere within the space. In fact, we have shown that by placing the sensors in the return duct we actually get a much faster response than from those meters positioned in the room. In some situations access may be a challenge, but in many cases the detector can be inserted through a prepared opening in the duct work and sealed into place to protect it against water/chemical intrusion. This allows for easy maintenance of the detector and limits the installation cost. In fact, in some projects we were able to install one detector to handle multiple spaces since they shared a common HVAC return duct, which saved money and reduces future maintenance expenses. The ONLY issue with this design occurs when the team gets its first alarm; they will NOT know exactly where the LOPC is upon receipt of the alarm. They will have to go investigate two of the three rooms to determine which of the three rooms has the LOPC. But keep in mind, this detection is early enough that action can be taken MUCH SOONER and hopefully avoid achieving an explosive atmosphere in a space that is not designed for Class I Group D flammable vapors.
Some things to consider:
1) with “LOSS OF POWER” the HVAC system goes down and now our detectors are in the absolute worst place. We have to have air flow in the duct work for this design to work, so what we have done is to place the HVAC fan(s) (not the entire unit) on the emergency power supply. This ensures us that the atmosphere within the space will always be traveling over the detector. Keeping in mind that some refrigeration processes use process pressure to move liquid rather than pumps– this means that LOSS OF POWER does NOT translate into loss of flow!!! So if we plan to have the HHC present in the space, we need air flow over our detectors.
2) LOPC can be caused by several things: 1) impact from motorized equipment, 2) operator/contractor error by “opening/breaking” the wrong line, 3) “hammering” effect causing pipe failure, 4) just failure of old and/or neglected pipe. We must address EACH cause in a very deliberate manner; however, this article is not looking at the specific causes, but the consequences of “what if we have a LOPC (caused by any of these methods) in an unoccupied refrigerated space”. As I have said, a solid piping MI inspection and testing program is without a doubt the first layer and the best answer for PREVENTING failure of old and/or neglected pipe. Secondly, solid SOPs with adequate details and sufficient training on the SOP will go a long ways to PREVENTING hammering during hot gas defrost periods. You may have noticed that the other two causes (#1 and 2 above) are not an issue in my LOPC scenario as both entail personnel being present at the time of the deviation, so I will skip over discussing these causes.
3) when you begin to think this through and seriously consider the scenario I have presented, you will inevitably come to the crossroads of… “we need more ESD buttons in many more locations than just our engine room!” If you remember the scenario of the technician responding to the duct work alarm, imagine that technician finds the space involved, then ask “what does he/she do now?”. The technicians first thought will be to stop the flow of ammonia to the evaporator(s) in that space. But in many plants this now involves a timely trip to the roof to access the valve group for the evaporators, or at best, a trip back to the machinery room where the ESD stations are located. But here is a suggestion that may make more sense. For some capital money and a brief down time, we can install an ESD for each space. Rather than shutting down the entire process (and impacting all refrigerated spaces) or allowing liquid ammonia to freely flow to the space while our technician goes climbing ladder and walking over top of the space that is working toward achieving 100% LEL, we allow him/her to activate a local ESD for the specific space. Even if we do not have the capital to spend on each refrigerated space, there may be some opportunity to do this on a header where we would be shutting down multiple spaces – but this is still a much better alternative to shutting down the entire refrigeration process or doing NOTHING.
PLEASE do not lose sight of the fact that ALL of this does NOTHING to remove the ammonia from the space. This is all an attempt to have the ability to identify a LOPC event so that timely action can be taken in order to prevent a catastrophic explosion. NOTHING we can do will be more important than getting every inch of the ammonia piping into a circuitized MI inspection and testing program. There is still a concern that we could still achieve 100% of the LEL within the space! Depending on how far the space is from the technician when he/she receives the alarm and how far he/she has to travel in order to be able to take the appropriate actions this MAY BE A FUTILE effort in some larger facilities!
The answer to ALL of this… an excess flow valve in the liquid delivery line(s) to the evaporator(s) in these refrigerated spaces. These valves are used in many different hazardous processes involving anhydrous ammonia, so I am not sure if there is a technical reason for them not finding their way into the ammonia refrigeration processes or some other reason – BUT THEY WORK and this is a near perfect scenario for their use. Their use, would essentially provide us an ADDITIONAL LAYER OF ENGINEERING PROTECTION (on top of the piping MI) that is “engineered into the process”! Some would also consider these valves as a PREVENTION device for the LOPC scenario; I would argue they do NOTHING to prevent the LOPC, but they most certainly MITIGATE the consequences by greatly limiting the amount of ammonia that is allowed to escape the pipe. Here is a link to a maker of an excess flow valve designed for use in anhydrous ammonia service. PLEASE NOTE this is NOT an endorsement of this brand of valve; although I have successfully used this brand of valve in many projects and processes I was involved with as a Safety/PSM engineer in the petro-chemical industry.
http://www.regoproducts.com/PDFs/L-500_Section-F.pdf
I hope this article has stimulated some thought and will extend to the refrigeration team for discussion and consideration. As we approach the 4th of July holiday, ask “what if we have a LOPC in an unoccupied space over the holiday weekend”. Should we increase the frequency of rounds? Can we use security guards to aid in making more frequent rounds (if you do this PLEASE ensure they have been trained on ammonia hazards and the EAP/ERP!). Maybe the facility’s confidence level with the integrity of their piping is comfort enough! But these are questions we need to discuss or worse yet, we need to formulate our response to OSHA or EPA if we find ourselves in the middle of a LOPC event within an unoccupied refrigerated space?