Over the last decade or so it has become popular to utilize a “relief header” in the ammonia refrigeration process. And in more recent years, the practice of installing an ammonia detector in this relief header has become very popular. Here are some random thoughts about these detectors that employers need to think through when considering their installation. Bottom line: The installation of the lone detector entails a bit more than just doing the MOC “paperwork” and installing the detector. Here is a breakdown of what we should have in place if we have a detector in our relief header:
Process Safety Information
We need to have an equipment file on the type, brand, etc. for our detector(s). We need to establish the “safe upper limit” for this detector(s). By this I mean the facility needs to set a ppm limit of NH3 in their header. Is 0.5 ppm of NH3 in the header acceptable or a deviation of the safe upper limit? How about 100 ppm? All of this information needs to become part of our “safety systems” documentation (1910.119(d)(3)(i)(H). We need to define what happens within the “safety system” when the safe upper limit has been detected within the RV header. PLEASE NOTE this is entirely different than the SOP instruction for the operator. Our “safety system” documentation needs to explain/define what will happen within the “safety system” when it is “tripped.” In many cases it will merely be an alarm for the operator; however, we need to define the tone of the alarm, where it will sound (e.g. in the machinery room, outside machinery room, send signal to cell phone, etc.) and we need to also make note if there is a visual alarm as well. This is all for the “safety system” documentation found in the PSI. What we want the operator to do when they get this alarm will be covered in the SOPs. Also please keep in mind that if we wire these detectors to sound either an audible alarm and/or a visual alarm for workers other than the operators we may have to revise other program/plans and training. (More on this below)
We need to be prepared to explain why we have the detector(s) in the RV header, why we installed it where we did, and why we chose the detector alarm set points. There may not be any “right or wrong” answers to these questions, but we MUST be able to demonstrate that our “safety system” meets a Recognized and Generally Accepted Good Engineering Practice (RAGAGEP) even though there is no such beast for a chemical detector in a RV header. We just need to be able to explain why we chose to install it, how we installed it, and what role it plays in our process safety management system.
Be certain that where you install your “detectors” is within the “manufacturer’s recommendations”. Many of these manufacturers PROHIBIT the installation of their detectors directly on the header!!! They only permit their detector to be installed within 3-5′ from the end of the vent line. This would be an EASY FIND for an OSHA/EPA inspection team if these detectors are not installed per the manufacturer’s instruction! One major player in this market even requires… “Discharging to the atmosphere, vent line sensors must be mounted within one or two feet from discharge into the air”.
PLEASE NOTE that an installation that penetrates into the header that could pose a “restriction” within the RV header would need to have an RV Design Basis review. Most of these detectors are flush with the inside wall of the vent line; however, someone trying to retrofit an older style probe detector could find themselves in a world of hurt if they have the detector protruding into the vent header in a way that it could be considered to cause a restriction in the flow!
TIP: consider adding a visual and audible alarm for the header detector on the roof. This would give personnel working on the roof several seconds advanced notice of what is coming their way. In these days, refrigeration processes have moved a lot of equipment to their rooftops, thus there is a lot of work taking place up there. It is a different world up there and often times there is LIMITED EGRESS from the roof. Giving the workers some indication of what is getting ready to come flying out of that pipe sticking up in the air (hopefully 15’ high or higher) will aid in their response to the release.
Although refrigeration engine rooms equipped with a ventilation system designed to ASHRAE 15 are exempt from NFPA 70, Article 500 Hazardous Location requirement, these detectors are DESIGNED to be within 3-5′ from the end of the vent line. Regardless of which RAGAGEP your facility prescribes to for its electrical classification, they all require a 5′ bubble around the end of vent lines. The manufacturers of these detectors MAKE CLEAR that these detectors are NEMA 4 rated (watertight/weatherproof) and NOT for use in hazardous locations. This is something each facility will have to square up in their engineering documentation. ALSO for those thinking that EVERYWHERE ammonia is present is exempt from NFPA 70, please refer to Article 500.5.
Final thought on the design of these systems… who gave the manufacturer’s the “drawing” they all seem to use in their manuals? I have always been puzzled by the goose neck design in their drawing(s) when ASHRAE 15, 9.7.8 states
“The discharge shall be terminated in a manner that will prevent both the discharged refrigerant from being sprayed directly on personnel in the vicinity and foreign material or debris from entering the discharge piping”.
If the discharge point is 15′ above the nearest working surface, but the end of the vent pipe makes an 180-degree turn and now points downward, how in the hell does this “prevent ammonia from being sprayed directly on personnel in the vicinity“. But I have yet to find any manufacturer who shows a diagram with a vent that discharges upwards as required by 1910.111, ASHRAE 15, 9.7.8, and IIAR 2, 11.3.6.3 & 6.4.
SPECIAL INSTALLATION NOTE: Be very careful during installation that shavings from the pipe boring activity do NOT find their way to the top of an RV. So if your system has an RV directly below the atmospheric vent discharge this may pose an additional challenge.
Process Hazards Analysis
As I said above, I do not believe that a PHA revision is needed for this type of change; however, when it comes time to do the 5-year revalidation this new detection system MUST be included in order to satisfy
1910.119(e)(3)(iii) Engineering and Administrative controls applicable to the hazards and their interrelationships such as appropriate application of detection methodologies to provide early warning of releases,
as well as
1910.119(e)(3)(iv) Consequences of failure of engineering and administrative controls.
Operating Procedures
A newly installed detector that sounds an alarm to an operator undoubtedly REQUIRES an operating procedure (SOP). Sure, we may not need to create a new SOP for this newly installed detector BUT IT MUST BE COVERED somewhere in an SOP (new or existing). The operator must have procedures in how to “correct” this deviation. Hopefully the process will have both engineering controls and administrative controls in place that will allow the operator to “avoid” this deviation (RV lifting) in the first place; but none the less, once the detector alarms, the operator (or whoever is assigned to respond to the alarm) MUST HAVE an annually certified operating procedure to use to “correct this deviation”. I have also suggested to some that the mere presence of ammonia in your header may NOT be an automatic trigger for an emergency shutdown, but it should certainly be considered as a “trigger” for ESD. I have seen some facilities actually tie their header detectors into an interlock that would take certain actions if the concentration of ammonia reached a certain level. BUT PLEASE think through your design VERY CLOSELY and with a well-rounded team, as sometimes shutting down compressors during a release can actually INCREASE the release rate! As I stated above, a PHA would not necessarily be called for with the basic installation of this detector; however, if we choose to get fancy in our design and tie this detector into some type of interlock that takes an action, over and above sounding an alarm, we very well may want to do a PHA on the design logic and failure modes and effects analysis.
And please keep in mind that the response to this detector alarm MAY EXPOSE the personnel to ammonia vapors and ADDITIONAL PPE may be called for in this detector alarm SOP. PLEASE DO NOT think that I am calling the response to this detector alarm an “emergency response” – I am NOT; however, a detector alarm is an INDICATION that there may be a presence of Ammonia in the area of the detector. I would even suggest that in your Certified PPE Hazards Assessment(s), required by 1910.132(d), that the task of responding to Ammonia Detector Alarms be one of the specific tasks called out in the assessment.
PLEASE NOTE: In regards to Ammonia being in the header, this would be considered a UNCONTROLLED RELEASE per 1910.120(q) and SHOULD BE SERIOUSLY considered as an “emergency response”.
Training
If this detector is new to the operators then, of course, we will need to conduct some training on the NEW detectors. Even if we only revise an existing SOP, rather than creating a new one for the detector, we will need to train that personnel who we expect to respond to these alarms. The specific steps in what they are to do when there is ammonia detected in the header are CRITICAL. If the facility has gotten fancy and has different actions for different “levels of ammonia” then this training could be more complex; or if a facility has multiple detectors and the facility wants a different response action taken based on which detector sounds, this too would add complexity to BOTH the SOP and the training. And don’t forget about the maintenance and contractor training, discussed in the sections below.
Contractors
Can we hire just any PSM/RMP contractor to install this detector? I would argue that this job would require MODIFICATION to the Relief Header, which means that the contractor doing the work should be capable of meeting the piping code requirements for quality of work. This vent piping should have been installed under a piping RAGAGEP such as ANSI B31.5 and we cannot allow just anyone to drill/bore into our vent header piping. The installation of this detector MUST be able to withstand the maximum pressure as indicated in our RV Header sizing calculations that resides in our PSI Relief System Design Basis. The last thing we want is a scenario where ammonia has escaped our header into an area that we have not designed the area to see ammonia. (See actual incident summary below) Contractors may also be impacted by this detector alarm, depending on how your alarm is set up. Some facilities have decided to include the header detector in the engine room alarm lights so as to notify personnel outside the room that there is an ammonia release. If your facility is one of these facilities, then I would suggest that these visual and audible alarms be included in the contractor orientation so they will recognize the alarm and now what to do when they see/hear it. I would also encourage facilities to install an audible and visual alarm indicators on the roof or “nearby” the vent discharge (to atmosphere). This would be very kind as it would give those workers in the vicinity as to what is happening and we would then train them to EVACUATE the roof/area. Yes this would call for a revision to our contractor safety orientation, but it would be well worth it. I have even suggested that some facilities install “high pressure” alarms in these areas so that workers can know of a process upset and take preemptive actions BEFORE the release occurs.
Management of Change
I would hope no one would attempt to argue that the installation of this detector, in an already operating process, would somehow not require an MOC. If the detector was installed as the process was being built, then, of course, it would be considered part of the design; however, those installed after initial start-up would certainly call for an MOC. The MOC should walk us through all of these topics I am covering to ensure nothing and/nor no one falls through the cracks.
Pre-Start Up Safety Review
A PSSR is certainly required, as this new detector requires us to update our Process Safety Information (PSI). The PSSR should be used as our final verification that it was installed properly, has been functionally tested and calibrated, personnel impacted by the detector have been trained (operators, maintenance, contractors, etc.), the detector and alarm system has been added to the MI PM program for calibration per manufacturers schedule, a maintenance procedure for calibration and inspection of the detector and alarm system is in place, personnel who would perform these maintenance tasks have been trained on the procedure (as well as the hazards of the process), and if this detector will impact the emergency action and/or response plan that these plans have been revised as needed AND personnel impacted have been trained.
Mechanical Integrity
Once the detector is installed, pressure test the installation! Your header is part of your pressure relief system which is designed to operate at HIGH PRESSURES. We must ensure the installation can withstand the pressures associated with your RV Header Design Basis. I know, that’s just crazy talk, but seriously last year we investigated an ammonia release into a crawl space because the detector in the header was damaged due to improper installation and this allowed ammonia to vent into an area that was not designed to see ammonia! (see summary below) Once installed we need to make sure that the detector is added to the work order system so that it is calibrated per the manufacturers recommended frequency. PLEASE NOTE that if this detector is DIFFERENT than your other detectors, there is a good chance that it may require different calibration gas, different calibration frequency, different procedures, etc. than your existing detectors. Also, do not forget that testing/calibrating these detectors may require the removal of the detector from the vent line and if this is done during normal operations the risk for the worker(s) doing this work goes off the chart and should require additional PPE just in case there is an over-pressure event or a RV lifts prematurely while this work is taking place. Sure it is a low probability event, but one that carries a very high consequence. Throw in the fact that many of these detectors are in elevated and/or hard to reach locations and we now may have to manage “working at heights” while opening the RV header on a live process!! In fact here is a SPECIAL NOTICE from the maintencne manual of major player in the industry…
Special Caution
Always assume that a relief valve can release at any moment. Always employ a “buddy” system, having help with you and watching what you are doing at all times. Always use safety goggles or a safety face shield, and always use gloves and have additional protective equipment easily available, including eye flushing equipment and a breathing apparatus. Personnel should be well trained and protected against falling if a sudden refrigerant leak startles the service person. Make sure there is always an escape route in case of a refrigerant release.
NOTE from me… MEMBERS, PLEASE read my article “Have PPE/Respirator Available”… : Register to read more… which discusses the concept of having “protective equipment easily available” and NOT actually donned during the hazardous tasks.
On another note, I would HIGHLY RECOMMEND that “threaded caps” made of carbon steel be provided to those who service those detector brands that call for the removal of the detector from the vent line. Make it a “permit requirement” that once the detector has been removed that this “safety cap” MUST be screwed into place and torqued down to the strength needed to withstand the pressures the header is designed to withstand. This small and easy step would protect personnel pulling these detectors should an unexpected release occur; otherwise we can image what it would be like the be looking down the barrel of a gun!!! This activity should certainly be considered a “process opening” activity that falls under our process opening/line break safe work practices.
Emergency Planning and Response
As I said earlier, depending on how the detector and its alarm are woven into the inner workings of the facilities management system, sometimes they can impact the Emergency Action Plan and/or the Emergency Response Plan. It all comes down to who will see/hear the alarm, what we want them to do, who else will be asked to take action when this alarm is tripped, etc.
Incident Investigation
Many facilities have attempted to define those incidents in which an investigation is required and many have included “activation of a safety system” within this program scope. If the program lists those safety systems, then the program would need to be updated to reflect this new safety system. Keep in mind that when this safety system is tripped it means we have “loss of primary containment” (LOPC)! So this safety system activation is NOT one that prevents the LOPC, but rather only sounds once we have an LOPC event – meaning this event would CERTAINLY fall into a PSM/RMP investigation, EVEN when the event is NOT a reportable release.
NOTE: I have seen EPA take issue with a facility claiming that their dozen or so “header alarms” over a five-year period were ALL the result of “premature lifting of an RV”. EPA then asked to see the results of their RV inspection/testing program, of which the facility had none as it is common practice in refrigeration to just remove and discard RVs every five years. EPA then asked if the other facilities within the organization uses the same type valves, with the same set points, on similar processes and were they experiencing this many “premature lifts”. Once the facility answered no, EPA then took the position that the facility should have either REDUCED the frequency of their RV replacement or had a testing program to determine the proper replacement frequency. This was the FIRST time I have ever seen an EPA RMP inspection include a visual inspection of at least 50% of the RVs in the plant. She found three that were past due for their replacement!!! Had she not found the header alarms, she would have most likely never inspected all of the RVs and thus in all likelihood would have never seen these three past due RVs!
Auditing
We have learned over the last several years that when we find a detector header that was recently installed we pounce on it as a way to measure the overall effectiveness of the facility’s process safety management system. As shown here, this one change can impact a variety of elements and taking a couple of hours to walk down all of these impacts can help a facility understand how one change can impact many of their programs and procedures. We have seen several facilities manage this change effectively, but the vast majority struggle to understand how a “safety improvement” can involve so much work.
Recent Incident involving a RV Detector
A facility in LaLa Land utilizes an RV header in their relief system design and like many facilities they decided they too needed an ammonia detection system in their header to inform them if/when they had ammonia in their header. They quickly, and unfortunately, discovered that the single detector at the end of their vent line did in fact inform them of ammonia in their header; however, it did nothing in the way of identifying which of their 62 RVs it was that lifted. (Members see my article Relief Valve (RV) Header vs. Directly to Atmosphere : Register to read more.)
So after a lengthy investigation and downtime (it was a reportable release) the facility, along with their “ammonia maintenance contractor” decided they needed additional detectors – one for each “section” of the header. They then proceeded to divide up their header in to sections so they could identify the locations for these additional detectors. The plan/idea was to have these installed so as to limit the number of RVs that would be suspect in the activation of the detector alarm. Sounds logical right? They proceeded to install the exact same detectors as the original one in their header at these strategically identified locations. A year later they got an alarm from the header detector – problem was, their installation did not include a means to KNOW WHICH of the 7 detectors was actually alarming. And by the time the operator responded to the first alarm, the header was full of ammonia and most of the header detectors were now in alarm! But that is not the moral of my story…
One of these 7 detectors was on a section of the RV header that ran through a crawl space above a production room. The facility was so focused on their “strategic” locations that they did not bother to consider the location of this detector and the consequences if it were to physically fail. We believe the detector was not installed properly and the RV Header was never pressure tested after its installation. A simple soapy water test could have identified the failed installation. When the header became pressurized, the detector install was damaged further and allowed ammonia to escape into this crawl space. We still do not know just how much ammonia escaped into the space or what the concentration level reached at its peak, but we do know it was significant, as 5 days later we were still above the IDLH of ammonia in this space!!!!
Hours after this incident the operators continued to get header detection alarms. PLEASE NOTE that the facility did NOT install “a plug or means of inducing a draft through the vent header” as required by the manufacturer in order to clear the header after a release!!! So the manager decided to have operators switch ALL of the three-way valves below the RV Tree on each RV arrangement. This was a large task and even while doing so the facility continued to get header alarms. By the next morning the team had come to the conclusion that there was residual ammonia in the header that was causing the problem – they were WRONG. Several days went by with the header alarms continuing once or twice a day. Still not having the ability to discern which detector was seeing ammonia, the next idea was that the detectors were overloaded with ammonia during the incident and needed to be changed. So the ammonia contractor was brought in to change all 7 detectors. Only then, 5 days after the incident, did they discover the ammonia in the crawl space and the damaged detector installation. The concentration in the space was well above IDLH and the contractor had only an Air-Purifying Respirator and was not trained in the use of SCBA(s) (to the surprise of the host company!). So the room had to be ventilated using a local exhaust ventilation (LEV) system that used a water scrubber to ensure the ammonia did not make its way elsewhere into the plant. Of course this activity necessitated the production room below them be shutdown and evacuated, costing the facility large $$$$ losses. It was determined via our investigation that the ammonia in the crawl space was slowly migrating back into the header through the damage detector installation since the crawl space was slightly pressurized vs. the header system which was open to the atmosphere. This ammonia was traveling over the detector and actually tripping multiple detectors over the five days.
So I hope I have painted a realistic picture of what needs to happen when we decide to install a header detection system. There is a LOT of work that goes into this installation and the more detectors we install and the more complex our safety system becomes the more work there is to be done. I also hope that I have shown that when we install multiple detectors, with the hopes of the system being able to provide useful data, that there is some design work that needs to take place! Just installing multiple detectors in a header, WITHOUT the means to know the order in which they alarmed, does LITTLE TO NOTHING in helping us return the system to service.
And PLEASE, by all means, realize this article was written based on errors we have found during audits, PHAs, engineering reviews, and risks assessment and that EACH PROCESS is uniquely different. There is NO WAY I could cover all possible deviations that could occur in each process design, but a well executed MOC and PSSR will do that for us!