Recently a client who uses anhydrous ammonia (NH3) had a significant event involving their NH3. This event is the perfect scenario to demonstrate that “inherently safe design” is by far the best design. The incident involved unloading a tank truck of NH3 into a bulk tank. A single valve was in its CLOSED position when it was supposed to be OPEN. This was called out very clearly and specifically in the unloading SOP. Two (2) trained peopled missed this deviation from the SOP. The normal transfer pump was out of service so the delivery company had agreed to use their own pumps on their trucks. NO MOC was done on this change BTW.
As soon as the transfer began, there was a significant release of NH3 through the hydrostatic relief valves on the transfer piping. This LOPC event began with the failure to “follow the detailed SOP”, but that simple error and active failure is NOT the moral to this story.
The truck’s pump had a much larger capacity and ability to exceed the set point of the hydrostatic relief valves which had set points of 350 psi. With the in-line valve CLOSED, the pump was deadhead very quickly, which lifted all of the hydrostatic RVs on the transfer line. Some of these RV were in close proximity to the driver and facility operator who were overcome by their exposure.
This LOPC event continued until such time the truck’s pump could be shut down by another operator. There was liquid NH3 spraying from the RVs. The LOPC event continued for nearly a minute after the E-Stop and Pump were shut down. The amount of NH3 was well below the 100-pound RQ, but due to the location of the workers at the time of the event, it was deemed a PSIF.
Further investigation found that no MOC was performed on this change in the unloading pump and no engineering review took place, as well. The PHA claimed that the facility pump could not create enough pressure for this scenario to occur – as was correct. This design was put into place after a lengthy HFE discussion about the SOP being an administrative control and we needed an engineering solution, as it was promised 1-day the humans will make this valving mistake. In fact, the facility personnel admitted that they had a couple of deadhead events in the past several years, but none resulted in a LOPC.
So before we throw the operators under the truck for failing to follow SOPs, it is only fair that we look at all the organizational failures that played a role in these accidents.