PROCESS SAFETY2 (Conclusion): Examples illustrate

ISD concepts, common issues

06/03/2013

Brian Pack
BP America Production Co.
Houston
Aubry Shackelford
Inglenook Engineering Inc.

Sugar Land, Tex.

The first article in this two-part series (OGJ, May 6, 2013, p. 94) presented four process safety
examples of possible inadequate overpressure protection design in amine natural gas sweetening,
glycol dehydration, and molecular sieve dehydration. The examples reflect systematic design
problems in traditional gas-conditioning overpressure protection analysis and reveal ways to
improve future designs.
The examples emphasize the need to raise awareness that designs of gas-conditioning systems must
do more than simply meet process specification; they must consider robust process safety features
for dealing with hazardous materials and process conditions.
This concluding article discusses opportunities for embedding "inherently safer design" (ISD)
concepts and other details pertaining to the previously discussed examples. In addition, this article
provides a general overview of frequently encountered issues in the design of protective systems for
gas conditioning.
It should be noted that each conditioning installation may have unique aspects not considered in the
general overview, and that formal engineering design reviews and effective hazard analyses are
required during design of the protective systems for these units.
Nonetheless, the intent is to provide some additional considerations, based on experience and
review of varying configurations for gas conditioning, for those who conduct engineering design
reviews and hazard analyses on these units.
PSM
In 2006, the American Institute of Chemical Engineering's Center for Chemical Process Safety
(CCPS) published the second edition of an industry-wide study that identifies how a business
benefits from a vigorous process safety program and impresses upon various industries the value of
process safety. This applies even when a particular industry or operation is not specifically covered
under the US Occupational Safety & Health Administration's Process Safety Management (PSM)
Standard, such as many gas-conditioning units.1
Despite some gas-conditioning units not being covered under the PSM standard, owner-operators in
the US must still comply with the "general duty" requirements of the Occupation Safety & Health
Act of 1970.
One important element in a PSM program is the overpressure protection and effluent-handling
systems designed to protect equipment and personnel from catastrophic failures or releases of
materials resulting from abnormal pressures.
In the US Chemical Safety and Hazard Investigation Board's 1998 investigation of the explosion at
the Temple 22-1 Common Point separation facility in Pitkin, La., the final report recommended that
the elements of PSM are applicable to oil and gas production facilities.2
The findings of the investigation echo the importance the owner-operator should place on
embedding the sound process-safety design philosophy inherent in the PSM standard, even if the
processes in question are not specifically governed by the regulation.
Another important element in a PSM program, and for process safety in general, is the philosophy
of ISD, under which a process is made safer as part of the design itself, during the facility or
process's conceptual stage.
The four oft-cited tenets of ISD consistent with Kletz' original work3 and subsequent elaboration on
the topic by the CCPS4 are:
Substitution: replacing one material with another that is less hazardous.
Minimization: reducing the amount of hazardous material in the process.
Moderation: using less hazardous process conditions such as lower pressures.
Simplification: designing processes to be less complicated and less prone to failure as a
result.
Application of these principles has led to major improvements not only in the reduction in the
potential for process safety incidents, but also in the design and operation of these processes. It is
important, however, to recognize that these principles are better incorporated during design because
adding inherent safety features to an existing facility may not always be justified in terms of risk
and economic investment.4

Switching valve failure

Design data obtained during review did not consider the failure of the switching valve during
normal operations. Because review failed to turn up documentation that justified not considering
this a valid case for overpressure, any reason suggested here is conjecture.
Nevertheless, one of three reasons is likely:

1. The designers did not think failure of the switching valves was likely.
2. Designers considered only a steady-state rate during the failure rather than initial transient
flow.
3. Designers considered transient flow but decided the design would not be based on a
condition that resulted in possible hazardous conditions for a short time.

Whatever the actual reason, the potential for multiple explanations highlights that overpressure
protection design is not necessarily a black and white science; subjectivity and engineering
judgment often inform relief protection philosophy.
If the reason was either No. 2 or 3, the decision would be one the original designers took from a risk
position. Not considering the higher transient flows resulting from switching valve failure reflects
acceptance that a deviation from design can occur, but the likelihood and duration are sufficiently
low that it should not govern the basis for design of the flare.
While not considering higher initial transient flows may be acceptable to a given owner-operator,
the lack of documentation hinders a revalidation of design many years later.
This evaluation revealed an oversight in the fundamental design of the molecular sieve and
regeneration systems and serves to remind that all credible overpressure situations should be
considered and documented during design of the process unit and that a facility must consider due
diligence in full lifecycle maintenance of these records.
Where possible, ISD features should be considered (i.e., providing the same pressure rating for
drying and regeneration sections), or at a minimum design should allow for appropriate
overpressure protection systems.

Proximity to fired heater

No matter the situation, following ISD methodology early in project development helps the design
provide support through documented rationale for design features related to safety that are
invaluable to the lifecycle operation of the facility. This example further emphasizes the importance
of the initial design hazards identification review.
As stated, the design did not consider abnormal operations. Whether they were considered and
rejected is not apparent from the review of the incident. The investigation notes at a minimum do
not mention such documentation. The right peopleoperations, engineering, process safety, or
maintenance staffmust be involved during the early hazard reviews in projects, even in the
installation of somewhat simple gas-conditioning units such as glycol dehydration.

Overfilling

While there was no loss of containment resulting in a hazard as a result of this example (or other
previous liquid carryovers experienced), a few major concerns from carrying excessive liquids into
a flare system to consider are:
1. Quenching the flame.
2. Possible mixing of incompatible fluids.
3. Insufficient structural support of piping and effluent-handling equipment.
Where excessive liquids can carryover from the knockout (KO) drum and extinguish the flame,
environmental or safety hazards may result. During carryover, burning efficiency is likely reduced
and possible hazardous (flammable, toxic, or corrosive) fluid may spray from the stack.
The former can exceed environmental permitting, while the latter can result in fire, flammable or
toxic vapor cloud, or other adverse safety consequences, such as personnel burns from hot liquid or
acidic solution or damage to the environment. Further, this situation could be compounded by a
release from another part of the facility of flammable or heavier-than-air vapor that could lead to an
explosion.
In gas plants, amine systems may carry some of the largest liquid inventories in the facility. If the
flare KO drum cannot accommodate the overfilling that could occur from this system, overpressure
protection of the facility may be compromised. It is worth noting at this point that on more than one
occasion the authors have encountered flare designs that speak of "the" design basis. The facility
designer, however, must understand how each piece of engineered equipment fits into the overall
design scheme.
At some facilities, amine systems carry the largest potential liquid inventories that may enter the
flare system, and while design of the flare may be based on blocked outlet of the inlet-gas stream,
this overpressure case may only be the design basis for the flare tip itself. In reality, little liquid may
result from blocked outlet of the inlet-gas stream. Therefore, it should not inform the basis of design
of the flare KO drum's liquid retention capacity.
As a result, each piece of equipment in the flare system must be designed for the largest design
overpressure load (or overfilling) case. For this plant, the amine flash-tank carryover was the design
case for the flare KO drum's retention time, and it is clear the installed equipment did not reflect
that.
When liquids can be released into a flare, design of the header must be able to accommodate the
hazards of the liquids it receives. For this facility, there was no "wet" and "dry" flare system.
Overpressure (and overfilling) cases from both vapor and liquid sources were handled in a single
flare.
In such situations, the designer must understand the impact of possible simultaneous mixing of both
wet and dry streams to plan for possible problems. In some cases, the review of several facilities
that use a common header for wet and dry releases demonstrated the potential of mixing "water-
wet" streams (such as amine) and very cold gas (such as flashed NGL). This situation could result
in freezing during the release.
The releases do not have to be simultaneous, however. Several were noticed in which pocketing
existed in flare headers. In these low points, the wet sources may build up over time and the resident
liquid may freeze under release from a cold source into the header. While the ISD principle of
segregation prompts many facility designers today to build devoted flare headers for wet and dry
processes, many designs in upstream gas processing are not currently configured in this manner.
It is, therefore, incumbent on the engineering and operations staff for these facilities first to
understand whether the risk of freezing off the header exists and whether adequate measures are in
place to eliminate or mitigate the potential consequences.
It should also be noted that "water-wet" solutions are not the only source subject to freezing and
thus blocking the header. Some hydrocarbon releases can in fact be an even greater concern because
of potential hydrate formation.
Many hydrates form at higher temperatures and therefore do not require cryogenic conditions for
freezing and plugging to occur. Other possible hazards exist for mixing of incompatible fluids but to
a lesser extent in upstream processing. These could include mixing of volatiles or reactive fluids. It
is important for the designer and operator to understand the elements that inform all aspects of the
flare header design.
It is uncommon for piping supports and equipment supports (such as for the flare stack) in the flare
header to be designed for the weight imposed by a liquid-filled system. As a result, mechanical
stresses could compromise the integrity of the piping, equipment, and supports. The result could be
a loss of primary containment from failure of the support system within the flare header.
While we are not suggesting that the flare header be designed to operate as a liquid-filled system, it
is important to understand that the liquid handling in the flare system needs to be adequately
addressed, including identification of potential liquid releases to the flare header, even though these
needs may not control the design with respect to pressures and velocities.
It is important to recognize that ISD is a philosophy. A balance of risk, design feasibility, and
business concerns ultimately inform the decisions on ISD features in the design and evolution of
safety barriers at a facility over time and will vary from operator to operator. Further, and more
importantly for existing facilities, it is crucial to understand where interdependencies exist among
safeguards within the ISD framework.

Decisions of how and when to incorporate ISD principles must consider the full lifecycle of the ISD
tenets in practice at the facility. If these interdependencies are not recognized, decisions to promote
continuous risk reduction by use of ISD may in fact result in compromising other safeguards within
the ISD lifecycle, diluting or eliminating the desired risk reduction achieved at the facility.
General awareness

Fig. 1, an example process flow for a solid-desiccant dehydrator twin tower,5 Fig. 2, an example
process flow for glycol dehydration adapted,6 and Fig. 3, an example process flow for a typical
chemical reaction gas sweetening system,7 show several areas of emphasis:
Valve misalignment. As described in Part 1 of this series, valve misalignment can cause flow from
the adsorbing beds into the regenerating beds with a potentially high initial transient flow.

Depending on the design and state of the systems, overpressure of the downstream regeneration
system may occur. In addition, other effects are possible, including those associated with rapid
pressure or temperature changes.
Equivalent design pressure for the regeneration system. When feasible, the design pressure for the
mole-sieve towers is specified at or above the maximum inlet-gas pressure achievable. As suggested
in the case study, the equipment in the regeneration system should also be specified at or above the
maximum inlet-gas pressure, despite its operation at lower pressures. This ISD may prevent blocked
outlets or inadvertent lineups of the regeneration system from overpressuring the equipment from
the inlet gas.
 Regeneration compressor suction pressure. Should the regeneration gas compressor develop a
blocked outlet, the flow to the compressor and the pressure drop in the upstream mole-sieve towers
will decrease. This results in a potential increase in the suction pressure on the compressor, which
directly translates into a higher discharge pressure.
If ISD tactics are employed, the equipment between the compressor and potential sources of
blockage need to be designed to handle this potentially higher shut-in pressure.
Proximity of fired heater. The design should consider how near the fired heater is to discharges to
atmosphere that may contain flammable gas. The fired heater may act as an ignition source, and the
dispersion of the relief effluent should be sufficient to prevent a flammable atmosphere from
developing near the fired heater. As described in Part 1 of this series, this is particularly pertinent to
the product breakthrough case in which the discharge may be flammable instead of the normal
water vapor.
Hydrate formation. The potential for hydrate formation, especially at cooling locations with high
water content could lead to blockage.
Low-temperature discharge. The pressure relief or depressuring of product can result in low-
temperature discharges into the effluent-handling system.
Ice, hydrate formation in effluent. The rich glycol can contain a lot of water, which may entrain in
the flash gas. If the flash gas is discharged to a collection system (e.g., flare system), the conditions
for ice or hydrate formation may be present with the flow of free water, low-molecular-weight
hydrocarbons, and low temperature brought about by Joule-Thomson cooling or auto-refrigeration
of the discharged fluid from higher pressure within the separator to lower pressure in the collection
system.
Ice or hydrate formation can block the collection system's piping, which may compromise the
integrity of the system and associated equipment. In addition, the blockage is likely to be located
near the discharge of the pressure relief devices on equipment nearby the separator, thus
compromising the overpressure protection for that equipment as well. With a common blocked
outlet, several pieces of process equipment can experience overpressure with no available relief.
Product breakthrough. The potential exists for a breakthrough of product into downstream
equipment processing glycol or amine. It is common for product pressures to exceed design
pressures in downstream equipment, thus creating the potential for overpressure.
Product breakthrough may not have been considered in design because of the commonly
overlooked process upsets involving fluids that are not normally being handled.
 Liquid overfilling. As described in Part 1 of this series, some of the equipment in the glycol or
amine systems can be subject to overfilling, depending on relative volumes and supply pressures,
and the liquid volume may dictate the design of the KO drum in the effluent-handling system.
ISD approaches to prevent overfilling can include limiting liquid volumes, maximizing available
processing volumes, and minimizing the difference between supply pressures and design pressures
of the regeneration equipment.
Direct discharge to atmosphere. Direct discharge to atmosphere does not automatically equate
with adequate overpressure protection: The water vapor outlet on the still is commonly routed
directly to atmosphere, and the common assumption is that there is no need to provide overpressure
protection.
Depending on situations in which additional gas is supplied to the still, however, it is conceivable
for the pressure to accumulate within the still. For example, if a gas breaks through from the flash
tank, excess non-condensable gas flows to the still at the same time as some condensation of
reboiled vapors, resulting from the direct injection of the rich glycol, is lost. The combination of
this material accumulation may be more than the discharge line can pass, thus causing the pressure
within the still to exceed its rating.
The temperature of the heating medium at stripper reboiler. Ideally, the temperature of the heating
medium in the stripper reboiler will be cooler than the bubblepoint temperature of the stripper
bottoms at the maximum allowable working pressure (MAWP) of the system. This may result in a
large difference between the operating pressure and the design pressure, but it is an inherently safer
solution.
Stripper rated for full vacuum. Ideally, the stripper system would also be rated for full vacuum.
Condensable fluid collapse in the event of considerable rain can pull some vacuum within the
tower.
Though often viewed as simple processes that aid in a facility producing a quality product, these gas
conditioning units also play an important role in the overall process safety of the facility. By
applying the principles of ISD early in concept design, gas-conditioning systems can operate safer
and more reliably for the lifecycle of the facility, ultimately achieving greater plant availability.
References
1. "The Business Case for Process Safety"; 29 CFR 1910.119 Management of Highly
Hazardous Chemicals,http://www.aiche.org/ccps/about/business-case-process-safety-
pdf.
2. http://www.csb.gov/investigations/detail.aspx?SID=73&Type=2&pg=1&F_All=y
3. Kletz, T.A., Process Plants: A Handbook for Inherently Safer Design. Philadelphia: Taylor
& Francis, 1998.
4. Inherently Safer Chemical Processes (2nd Edition)A Lifecycle Approach. Center for
Chemical Process Safety, New York: John Wiley & Sons, 2009; pp. 11, 19, 27, 28.
5. Adapted from Figure 20-80 of GPSA Engineering Data Book, 12th Edition.
6. Adapted from Figure 20-67 of GPSA Engineering Data Book, 12th Edition.
7. Adapted from Figure 21-4 of GPSA Engineering Data Book, 12th Edition.