A couple of weeks ago, I wrote about how the Process Safety Information (PSI) “Safe Upper and Lower Limits” will differ from those “Safe Upper and Lower Operating Limits” found in our Operating Procedures. The article needed to be written as it received over 10,000 hits, and the e-mails continued with positive comments and more questions. Several have asked for a real-life example of how this works and what it would look like when developing our PSI. One member gave me a perfect example to show how this can all go awry quickly and in a big way.
In this article, I will use his/her process example to attempt to demonstrate why OSHA and EPA placed this requirement as part of our PSI and WHY we are required to evaluate the consequences of deviations of our PROCESS DESIGN as part of our PSI development.
Here is OSHA/EPA’s requirement for Information pertaining to the technology of the process as it relates to safe upper and lower limits:
(d) Process safety information
…
(2) Information pertaining to the technology of the process. (i) Information concerning the technology of the process shall include at least the following:
…
1910.119(d)(2)(i)(D)Safe upper and lower limits for such items as temperatures, pressures, flows or compositions; and,
1910.119(d)(2)(i)(E) An evaluation of the consequences of deviations, including those affecting the safety and health of employees.
The Process in this example
The process:
- is a very simple one and has NO safety instrumented controls at any point in the process, thus all manual valving and gauges (pressure, temp, and level).
- has an industry-specific RAGAGEP that plays into the example; however, for the privacy of the member, I will not mention the HHC/EHS or the RAGAGEP. The example will hold true for ANY PSM/RMP-covered process, and certainly, the methodology and principles apply to ALL hazardous processes, REGARDLESS of whether your process exceeds the PSM/RMP thresholds for the HHC/EHS.
- involves a single HHC/EHS with a low Boiling Point/high Vapor Pressure.
- can receive its HHC/EHS by pipeline, rail, and tanker truck and involves receiving the HHC/EHS from the pipeline/shipping container directly into the storage tank, which is an ASME Section VIII pressure vessel. The process then transfers the HHC/EHS as needed to the receiving vessel and the process ends at the receiving vessel.
The storage tank (e.g., pressure vessel) was built to an industry-specific RAGAGEP, which establishes a minimum design pressure of 250 psi for the ASME storage vessel. The pressure vessel in our example does meet the minimum MAWP of 250 psi @ XXXF. Our HHC/EHS has physical properties such that on hot days, the pressure in this vessel can reach upwards of 200-215 psi merely from environmental heating.
NOTE: at 100ºF, the vapor pressure of our HHC/EHS is 200 psi; at 105ºF, the vapor pressure of our HHC/EHS is 215 psi (i.e., just 35 psi shy of our UPPER DESIGN LIMIT).
At these times of the year, when the operating pressure is 200-215 psi from the environmental conditions, it is stated that when transferring the HHC/EHS to the receiving vessel, the relief valves (RVs) will chatter/lift, allowing the HHC/EHS to escape the pressure vessel. The process utilizes a vapor compressor to generate a pressure differential between the storage tank and the receiving vessel. This compressor pulls vapors from the receiving vessel, compresses them (adding heat), and discharges the vapors into the storage tank, thus increasing the pressure within the storage tank. The compressor has no controls, and the process has not established any type of SAFE UPPER limit on this compressor. The typical pressure differential needed between the storage tank and the receiving vessel is 30 psi to transfer the HHC/EHS.
On these hot days, the PRVs will chatter/lift; hopefully, we can now see why. Relief valves with a set point of 250 psi can begin opening at some point BEFORE 250 psi. Depending on the manufacturer, some begin to open at 5% of the set point, which would mean we lose primary containment at closer to 240 psi. In this example, the storage tank’s MAWP appears TOO LOW for the combined environmental and process conditions. Our process’s NORMAL OPERATION (using the compressor) on a hot day (105ºF +) can take the pressure vessel to within ~10 psi of the vessel’s MAWP and RV set points. This is cutting it WAY TOO CLOSE, and just this may be a citable violation of…
1910.119(d)(3)(ii) The employer shall document that equipment complies with recognized and generally accepted good engineering practices.
Of course, our discussion turns to the industry-specific RAGAGEP, which he/she thought was a “get out of trouble free card” because it states:
The minimum design pressure for … containers shall be 250 psi (1724 kPa). NOTE: I deleted one word from the statement to not bring attention to the specific industry or RAGAGEP, but it does not matter to my specific example.
As we can see, the industry RAGAGEP states that the minimum design pressure is 250 psi. This means we can NOT have a pressure vessel rated for less pressure, but we can (and should, in our example) have a pressure vessel rated for more pressure. Merely pointing to an industry RAGAGEP stating a minimum design pressure does absolutely nothing for process safety or compliance with PSM/RMP in our example!
So when we establish our “Safe upper and lower limits for such items as …, pressures, …” and we perform our “evaluation of the consequences of deviations, including those affecting the safety and health of employees,” we MUST consider that Loss of Primary Containment (LOPC) of this HHC/EHS is going to affect “the safety and health of employees.” Having an MAWP that is so low, EVEN when meeting the MINIMUM design pressure required by our chosen RAGAGEP, that our “normal operations” take us into our safety buffer, we MUST be able to identify that environmental conditions AND our process operating condition can CAUSE an LOPC event. And it does NOT matter how small, brief, or rare the event is – it is NOT good process safety. Let me say this here… some will say that activation of the RV is not a “bad thing” and the “RV is doing what it’s designed to do”. Yes, it is doing its intended function, but lifting an RV should be viewed as a significant failure of our layers of protection! The RV is our last line of defense and if we get to a point where we lifted it, we have failed. An RV is a pressure control device – it is a PRESSURE RELIEF DEVICE, and there is a huge difference!
In this example, the BEST advice I can give is that when building new plants or when replacing the pressure vessel(s), to INCREASE the MAWP to something that will allow for a BIGGER CUSHION between the NORMAL OPERATING pressures and the MAWP/RV set point(s) so that we have NO LOPC events merely from our “normal operations.” As I stated in the previous article, our Safe Operating Envelope for our operating procedures will be (and MUST BE) something less than the MAWP of our pressure vessels. We NEVER want a safe upper limit of our operation to be bumping up against our DESIGN SAFE upper limit, as this allows us almost no chance of correcting a deviation before our consequence (i.e., LOPC) occurs. As we know, an LOPC event for any HHC/EHS is a failure of our process safety efforts. We can NOT accept this type of design, regardless of how many neighbors/competitors are doing it or for how long it has gone on in the industry. This is called an “industry practice,” and it is FAR FROM being a “recognized and generally accepted good engineering practice” (RAGAGEP).
There is an INTERIM measure, and I say this with a red face as pressure vessels last decades, so I am not sure “interim” is the best word to use. We can implement this change and it may assist us in preventing an LOPC event during our “normal operations”. This “interim measure” comes at a cost and may also impact operability efficiency. Still, it is MY PROFESSIONAL OPINION that something would have to be done in our example process to prevent these LOPC events on those hot days – EVEN to PREVENT ONLY one (1) LOPC event that lasts one second! This is NOT about keeping our Reportable Quantities below the HHC/EHS’s RQ so that we do not violate some EPA limit; this is BASIC process safety… designing our process so that it can SAFELY operate under our normal operating parameters.
Please do not forget that we DESIGN to even those emergency conditions, especially when it comes to our largest risk – our storage vessel holding tens of thousands of pounds of our HHC/EHS. So our pressure vessel has an MAWP of 250 psi, and even if we did NOT use our compressor to create our pressure differential, we would have suspect safety margins based SOLELY on environmental conditions. But let me say this, as a rule of thumb, I was taught to always design for an LOT of “cushion” between the MAWP and the “safe upper operating limit”. 10-15 psi cushion is NOT enough cushion for even the environmental conditions, much less when we begin to purposely raise the pressure within the vessel during our “normal operations.” If the vessel is already at 210 psi and we raise it 30 psi we are only ten psi under our MAWP! So here is my idea…
Because the receiving vessel MUST be at a lower pressure than the storage tank, we need to consider a means to lower the pressure in our receiving container, RATHER THAN raising the pressure in our storage tank to such a pressure that we approach the MAWP and have these LOPC events. So to do this, we could install a condenser between the compressor and the storage tank, and instead of sending hot pressurized vapor to our storage tank, we send the compressed/hot vapors to a condenser where we use “well water” to condense our vapors into a liquid which then drains (or we pump it) into our storage tank. This means we are LOWERING the pressure in our receiving container WITHOUT substantially increasing the pressure in our storage tank, where we have a small safety cushion. Thus, we could use the ambient pressure in the storage tank (WITHOUT the compressor discharging hot compressed vapor into the tank) when the tank pressure is 30 psi over our receiving container AT THE TIME of the transfer. On days where we are filling our receiving vessel multiple times a day in somewhat rapid succession and thus are moving a lot of our HHC/EHS and creating a cooling effect within our storage tank and losing our ambient pressure, we could then valve in our compressor to the storage tank to boost our pressure as needed, but NEVER exceeding our Safe Operating Limit, which will ENSURE we do not exceed our safe DESIGN limit.
PLEASE CONSIDER this:
1) This process has ZERO process controls to alert the personnel (or intervene) should they exceed their safe UPPER OPERATING pressure limit.
2) The DESIGN LIMITATIONS of using pressure vessels with a 250 psi MAWP in certain parts of the country appear to be the absolute minimum and do not allow for any operational errors/deviations.
3) When asked if the storage tank can be filled from pipeline/rail/truck while the compressor is running, the answer was YES, thus setting us up for even yet another scenario in which we could exceed our safe operating upper limits AND our safe design upper limit (e.g., filling the storage tank from pipeline, rail or truck at the same time we are using pressure differential to fill the receiving container AND the storage tank filling capability is greater than the receiving container fill rate)
4) We must be 100% certain that the receiving vessel is rated for a vacuum BEFORE pulling any level of vacuum on it.
5) Remember, we do not have to get to 0 psi or below in our receiving container – we ONLY have to have a 30 psi differential between the receiving vessel and the storage tank. So we are going from 200 psi to 170 psi, and anything less just allows us to flow our HHC/EHS with less pressure, and less pressure is something we all like to see in our pressure systems!
4) This is NOT design information, and I am NOT recommending that anyone do this without a VERY THOROUGH ENGINEERING/CODE REVIEW and PHA.
BOTTOM line…
Operating a process so close to its MAXIMUM DESIGN PRESSURE is just bad process safety, and it is a potential citation of 1910.119(d)(3)(ii); throw in the LOPC consequence during “normal operations,” and we are making the case for OSHA/EPA! Regardless of what OSHA/EPA says, the loss of primary containment (LOPC) due to this design is UNACCEPTABLE. OSHA may choose to use 1910.119(d)(3)(ii) and reference the fact that your process was not designed properly, or one that I would go after if I were auditing would be to see if the Relief Valves are being changed after EACH time they are activated. Almost all RV manufacturers REQUIRE their RVs to be changed once activated. They do not provide exceptions for “slight activation” or “short duration,” merely that once the RV is activated, it be changed out at the earliest possible time, and this does not mean “next year when it is due for its five-year scheduled maintenance”!!! This means removing it from service and replacing it ASAP. So my finding would be the “employer is NOT following the “manufacturer’s recommended maintenance” on the RVs” rather than getting into a debate on what the MAWP of the pressure vessel should be. Once the employer/owner/operator has to start buying dozens of RVs and spending time changing them out, the costs of this design begin to shine through and become clearer to the powers to be. But rest assured that any process safety engineer worth his/her salt will find this design questionable, and merely pointing to an industry RAGAGEP that states the MINIMUM design shall be 250 psi is NOT going to get us where we want to be in either a compliance situation or a process safety design basis. So we have options, but one is NOT continuing to operate our pressure vessel with so small of margins that we lift our RV(s) and have a loss of primary containment of our HHC/EHS during “normal operations.”