Hazard Identification Based on Plant Functional Modelling

Transcription

1 ^K*tS> 3t?>:b Risø-R-712^$ Hzrd Identifiction Bsed on Plnt Functionl odelling Birgitte Rsmussen, ris Whetton Risø Ntionl Lbortory, Roskilde, Denmrk October 1993

2 Hzid Identifiction Bsed on Plnt Functionl odelling»*«w> Birgitte Rsmussen, Gris Whetton* *The University of Sheffield, United Kingdom Risø Ntionl Lbortory, Roskilde, Denmfk October 1993

3 Abstrct A mjor objective of the present work is to provide mens for representing process plnt s socio-tcchnicl system, so s to llow hzrd identifiction t high level. The method includes technicl, humn nd orgnistionl spects nd is intended to be used for plnt-level hzrd identifiction so s to identify criticl res nd the need for further nlysis using existing methods. The first prt of the method is the preprtion of plnt functionl model where set of plnt functions link together hrdwre, softwre, opertions, work orgnistion nd other sfety relted spects of the plnt. The bsic principle of the functionl modelling is tht ny spect of the plnt cn be represented by n object (in the sense tht this term is used in computer science) bsed upon n Intent (or gol); ssocited with ech Intent re ethods, by which the Intent is relized, nd onstrints, which limit the Intent. The ethods nd onstrints cn themselves be treted s objects nd decomposed into lower-level Intents (hence the procedure is known s functionl decomposition) so giving rise to hierrchicl, object-oriented structure. The plnt level hzrd identifiction is crried out on the plnt functionl model using the oncept Hzrd Anlysis method. In this, users will be supported by checklists nd keywords nd the nlysis is structured by pre-defined worksheets. The preprtion of the plnt functionl model nd the performnce of the hzrd identifiction cn be crried out mnully or with computer support. The present report is the min deliverble of work pckge 3.1 of the project An Overll Knowledge-bsed ethodology for Hzrd Identifiction sponsored by the E STEP progrmme (contrct no. STEP-T9O-0O85). Windows is registered trdemrk of icrosoft orportion. ISBN ISSN Grfisk Service. Risø, 1993

4 ontents 1 ltroductio 5 2 OverH dcscrif*io of TOHID OverU TOHID procedure Outcome of the TOHID procedure 8 3 Priuciptesorfwti0lndeKBg9 3.1 Scope of the functionl model Functionl modelling Overll modelling principles Functionl description How to strt - where to stop // 3.3 Presenttion forms Tbulr form Grphicl form Plnt functionl objects Estblish the Intents of the plnt Estblish the ethods nd onstrints of die plnt Systems nd items with multiple functions Dynmic spects of processes Opertions nd mngement issues Opertions issues ngement issues Procedure for functionl decomposition of process plnt 19 4 Principles of HA pplied with functionl modelling HA on plnt functionl model Agree on set of HA keywords Prtition the plnt into sections Performing the HA HA without computer support HA with computer support nd with the plnt functionl model Supporting dtbses Supporting nlyses oncept Socio-technicl System Review (SSR) Preliminry onsequence Anlysis (PA) Short-ut Risk Assessment ethod (SRA) 27 5 onclusions Arising from the btch cse study Arising from the continuous cse study Generl 30 Acknowledgements 32 References 32

5 A se study ot btch rector pbntj.i A.1 Introduction 33 A.2 Short description of dw btch rector plnt 33 Informtion bout the involved chemicl substnces nd their combustion products 33 Quntities of chemici substnces involved in the different ctivities 34 Informtion bout processes nd chemicl rections 34 The overll structure of the PP plnt 35 Informtion relting to the orgnistion nd the mngement 35 Qulity ssurnce system 36 Emergency pln for hzrdous releses nd lrge fires t KVK 37 A.3 PP plnt functionl model J7 A.4 oncept Hzrd Anlysis 37 A.S Results J«Identified potentil hzrds 38 Identified sources of hzrds nd Ihe conditions under which n ccident could occur 38 Assessment of ccident consequences 38 Sfety mesures 38 B se study of section of continuous process plnt 53 B.l Introduction 53 B.2 A brief plnt section description 53 B.3 Plnt section functionl model 53 B.4 Hzrd nlysis of the functionl model 54 4 Risø-R-7I2(EN)

6 1 Introduction An importnt prt of sfety nlysis of chemicl process plnt is me identic nctkn of hzrds nd ds cn be crried ot t either unit or plnt level. ethods exist tor hzrd identifiction t nit level. eg. hzrd nd operbility stdy (HAZOP) nd filure mode nd effect nlysis (FEA). For lrge chemicl process punts die effort reojired by diese mediods cn be very extensive nd it cn be very difficult to estblish i risk srvey for die plnt. Furthermore, the emphsis of dse mediods is on identifiction of hzrds closely relted to dk technicl spects of dk plnt nd less on hzrds relted to die interction between die plnt equipment OK orgnistionl structure nd dk mngement fc tors. The present report is prt of die project entitled "An Overll Knowkdge-bsed ethodology for Hzrd Identifiction'' which is sponsored by dk B STEP reserch progrmme. The working tide of dk project is: TOtHD. It ws initiled in 1991 for durtion of dce yen. The project is crried ot by n intrrntionl consortium mctdmg dk following prtners: VTT (Technicl Reserch entre of Finlnd), The University of Sheffield (United Kingdom), SRD Division of AEA onsulting (United Kingdom), Tecs (Itly). IEAT (Spm), Joint Reserch entre (Ispr) nd Ris«Ntionl lbortory (Denmrk). The bsic ide of dk TOHID project is to develop n overll medndology which will provide ssistnce nd guidnce to dk user for hzrd identifiction purposes nd which follows dk course of n incident in ech stge of dk event chin. One of dk mjor objectives of dk project is to provide comprehensive frmework to represent process plnt s socio-lechnicl system. The medndotogy is to include technicl, humn nd orgnistionl spects nd is intended to be used s first stge in die hzrd identifiction process so s to identify criticl res nd dk need for further nlysis using existing mediods. The TOHID project consists of dk following work pckges: - WP1: Review of existing mediods nd models used for hzrd identifiction. - WP2: onceptul study of hzrd identifiction nd risk reducing medwds. - WP3.1: Link between the functionl model nd hzrd identifiction. - WP3.2: Development of method to investigte mngement fctors relted to cuses nd consequences of specific hzrds. - WP4: Specifiction of softwre. - WPS: Implementtion of softwre. The object of dk TOHID project is method which cn provide ssistnce nd guidnce to dk user for high level hzrd identifiction of different kind of chemicl process plnts (btch rector plnts, continuous plnts, mixed rector plnts). The finl method will consist of the following min elements: - functionl description of dk plnt s socio-technicl system - high level hzrd identifiction bsed on dk oncept Hzrd Anlysis method (HA) - plnt documenttion comprising the functionl plnt model nd the plnt level hzrd identifiction - evlution of the sfety impct of mngement fctors on the identified hzrds (to be developed in work pckge 3.2 of dk TOHID project) 5

7 - softwre specifiction mi impiementtion of the methods developed in work pckge 3.1 (to be developed in work pckges 4 nd S of the TOHID project). The present report hs been prepred by The University of Sheffield nd Risø Ntionl Lbortory- nd is the min deliverble of work pckge 3.1. hpter 3 contins description of the principles of functionl plnt decomposition nd chpter 4 presents the principles fur lush level hzrd identifiction bsed on the oncept Hzrd Anlysis method (HA) pplied to die functionl plnt model. In die ppendices two exmples ( btch rector plnt nd continuous process plnt) re presented illustrting die principles of functionl plnt decomposition nd oncept Hzrd Anlysis. The present work is bsed on die following working documents resulting from the first two work pckges of die TOHID project: - Users Need Report. Februry pp + ppendices (WP1). - Review on Hzrd Identifiction ethods nd Softwre Tools. April pp(wpl) - onceptul Study of Hzrd Identifiction nd Risk Reducing ethods. rch pp + ppendices (WP2). 6 Ri«vR-7l2(EN)

8 2 Overll description of TOHID The objective is to ciry D plnt level hzrd identifiction nlysis bsed on the plnt functionl model sms oncept Hzrd Anlyse (HA) in structured group session. The users in Ihc group sessiun will be supported by checklists nd keywords guiding nd structuring the nlysts. The nlysis will identify criticl res nd die need for further nlysis where well-estblished pproches cn be pplied. 2.1 Overll TOHID procedure The overll TOHID procedure is: Dt requirements nd composition of die tem re similr to those of n ordinry HAZOP: (Kiel/. 1992). b) Define die scope nd objectives of the study: The objectives will generlly be those of TOHID: identifiction of plnt hzrds nd res requiring more detiled study. Scope will slly be tht of the entire plnt, its mngement, nd environment. However, ll requirements my he chnged to reflect the needs of die stdy. c) Register Informtion: This consists of housekeeping ctivities such s die project nme, nme of die nlyst, nd reference documents: it is described in detil (Dvies A. Whetton. 1993). The most significnt procedurl decision mde here is whedier die nlysis is to be mnul or utomted, s this dicttes now some of die lter softwre is configured nd linked together. d) ompile Substnce List: This involves compiling list of dnse substnces present in die system. Uieir quntities, nd their loctions in terms of vessels, pipes etc. This is described in detil (Anon., section ) nd (Dvies A Whetlon. 1993). Regrdless of the selected mode, die Substnce List will lwys be vilble for consulttion by the user. This dt should be vilble from process engineering, who would be requested to supply it. nd will be used to guide die nlyst s to substnce properties t ech point in the model. e) ke Functionl odel: The functionl model is required in the utomted version of TOHID but is optionl in mnul mode. A consequence of this is dil, in uto mode die model nd die forms used for HA re linked logcdier so tht movement through die HA form is controlled by movement Uirough die model wheres in mnul mode die two forms re independent. onstruction of die model is described in detil in chpter 2 of diis report, while die softwre functions re detiled in (Dvies & Whetlon. 1993). f) oncept Hzrd Anlysis: Description of die HA procedure is presented in chpter 4; however, reference is mde to the originl description (Anon., section ) nd to die softwre description (Dvies & Whelton. 1993). 7

9 g) Other TOHID Anlyses: The otter nlyses re supplementry 10 HA nd re described in de references s: - oncept Socwtechnicl System Review (SSR) (Anon. section ). - lydimmry onsequence Anlysis (PA) (Anon., section ). - Short-nt Risk Assessment (SRA) (Anon.. Section ) h) ore Detiled Anlyses: Odirt nlyse methods my be used to explore prticulr hzrds identified by TOHID (Anon., section S. 1993). 12 Outcome of the TOHID procedure The overll outcome of the TOHID procedre will be doenment contining fonr dements: ) A plnt functionl model cinphsiiing the importnt prts of the plnt wim respect to sfety. The model wid be developed on me bss of the plnt documenttion nd on the principles of functionl deconmosition. b) A documented oncept Hzrd Anlysb comprising nlyses nd evlution of the objects contined in die plnt model. c) An identifiction of die plnt units (or pns of plnt mis) tht re criticl from sfety point of view. Recommendtions concerning frther nlyse where well-estblistied hzrd identifiction nd filnre nlysis methods cn be pplied. d) Suggestion of mesures which cn reduce the possibilities or limit the consequences of die identified hzrds. 8 Risø-R-7I2(EN)

10 3 Principles of functionl modelling 3.1 Scope of the functionl model The scope uf die functionl mnlel is: - k> provide generl frmework for representing chemicl process pint s sockechnicl system - it* support the oncept Hzrd Anlysis which will be the strling point lur the subsequent evlution of die sfety impct of fe mrugemenl fctors on die identified hzrds. The principles of die fictionl model re 'ended lo meet die fouowirg generl requirements: - omme tcness: The functionl model shll in principle be ble to cpture ll 0*e sfety relted nfnnuon nd spects of die socio technicl system (e.g. eqmpment. opertions, control systems, work orgnistion). ' Flexibility: It shll be possible to perform die functionl modelling nd decomposition of die suriu-technkl system to duterent degrees of detil or comprehensiveness. The nser nwst be ble to decide where die emphsis of die nlysis shll be lid. - Robustness: Dring functionl modelling of die plnt die nser shll be ble to extend die scope or die modelling level of detil without breking die internl consistency of die plnt model. This mens dm die fmctionl model cn he developed incrementlly. In ds chpter die bsic principles for functionl modelling nd decomposition re presented mi to illustrte these principles two exmples of functionl modelling hve been prepred nd cn he found in die ppendices. 32 Functionl modelling The overll gol of die functionl modelling nd decomposition is to prepre systemtic nd comprehensive description of process plnt widi reference to hzrd identifiction. The intention is to represent socio-technicl system s hierrchicl, object-oriented structure Overll modemng principles The plnt model follows generl frmework s indktcd in Figure 1. The bsk ide is dil set of plnt functions link togedier hrdwre, softwre, opertions, work orgnistion nd other sfety relted spects of die plnt. Widiin this frmework it will be possible to integrte informtion nd knowledge bout the technicl, physicl nd functionl configurtion of die plnt togedier widi reltions nd connections to die opertions nd its mngement spects. The bsic principle of functionl modelling is dil ny spect of die plnt cn he represented by n object bsed upon n Intent or gol nd dil ssocited widi ech Intent re edinds. by which the Intent is relized, nd onstrints, which limit die Intent. The ethods nd onstrints cn themselves be treted s objects nd decomposed into lowcr-lcvcl Intents (hence die procedure is known s funclioni decomposition), so giving rise lo die mediod's hierrchicl structure. 9

11 Development of the hierrchicl structure proceeds s follows: A strling point is chosen (here defined s PD). Usully dus will be the lop level of the plnt - its overll function - but cn be the function of plnt section, if so desired At the next level (level I) the lop function is decomposed into its min constituent elements, sy Fl. F2. F3. The funcipul decomposition is continued nd refined t die subsequent levels.».;. Fl into FI.I. FI.2. until n pproprite level of detils hs been chieved. This principle is illustrted in Figure I. R) Fl F2 F3 Fl.! F1.2 F2.1 F2.2 F2.3 F2.4 Figure I. Functionl decomposition of process plnt s hierrchy of functionl objects. 3.2*2 Functionl In die plnt functionl model, function is n object comprising n Intent, list of more thn one ethods, which re used lo stisfy tht Intent, nd list of zero or»norc onstrints, which imposerestrictionsupon the Intent. Ech element of the lists of ethods nd onstrints cn itself be treted s n object defining new Intent with its ssocited edmds nd onstrints. A simple semntic model is shown in Figure 2. <lntent> by <cthods> with <onstrinls> Figure 2. Semntic functionl model. Hence, the plnt model contins objects whose elements cn be clssified s follows: - Intents representing the functionl gols of the specific plnt ctivities in question. - ethods representing items (hrdwre, procedures, softwre, etc.) thi rc used lo crry out the Intent or opertions tht rc crried out using those items. 10 RI*VR-7I2(EN)

12 - unsttinis dil describe items (physicl lws, work orgnistion, cumrul systems etc.) dil exist lu supervise or restrict ;V Intent: onstrints cn cuntin informtion but die orgnistionl context in which die Intents rc fulfilled. A digrmmticl model is presented in figure i which snows die possibility of inc hlms Inputs nd Ompts linking needier die Intents in die function! plnt model. Inpts show die necessry conditions to perform die Intent nd die Ink to die previous Intent. Outputs show die outcome produced by die Intent nd die link to die subsequent Intent. onstrints 1 op«* ltent Outputs _ T ethods Fifurr 3. Interreltionships between objects t the sme functionl level. Finlly, in some cses it my he convenient to divide the functionl plnt model into environmentl or topologicl zones. These zones re linked to die functionl objects nd specify where n Intent is crried nut nd diey give informtion bout die locl sitution. 323 How to strt - wh*re to stop The modelling principle is hip-down pproch which ensures logic functionl model of die process plnt. One of die essentil prts of die functionl decomposition is to determine die strting point of die nlysis. To stte generl strting point which will he convenient for ll kind of hzrd identifiction nlyses is not possible, s n pproprite strting point will depend on the specific plnt configurtion nd die objective of die nlysis. The usul strting point will he process flowsheet for the plnt nd from this die nlyst will hve informtion on ll die chemicl substnces nd die chrcteristics of the min process strems. From dus strting point, the functionl decomposition is performed, ensuring dit ll relevnt ctivities re considered (processing, mintennce, controls, emergency systems etc.). The structurl decomposition of process plnt my follow die following hicrrchy: ft. 7. plnt (or section of die plnt) unit system subsystem ggregte component piece prt RIVR-7I2(EN) II

13 (Note, however, tht the nlyst my insert intermedite functions which do not correspond to the physicl elements if by so doing the clrity of the nlysis is enhnced). For prticulr plnt, there will be one plnt object, one or more unit objects, nd s mny objects of the lower levels s there re systems, subsystems etc. in the plnt. As for the strting point, it is not possible to offer generl rules for selection of n pproprite modelling level. The intention is to identify t ech level those prts of the plnt where further nlysis is required; mening tht the degree of detil will differ for the different prts of the plnt. Here it is importnt to keep in mind tht the min purpose of the functionl model is to provide frme for high level hzrd identifiction; consequently the model my be stopped t one of the top levels. Furthermore, it must be remembered tht one of the objectives of the high level hzrd identifiction is to identify criticl res nd the need for further nlysis. At some other stge existing hzrd identifiction nd filure nlysis methods e.g. Hzrd nd Operbility Studies, Filure ode nd Effects Anlysis, Action Error Anlysis, will be more suitble for the detiled nlysis work. 3.3 Presenttion forms The min objective of the plnt functionl model is to provide frme for the overll hzrd identifiction. In the following it is ssumed tht oncept Hzrd Anlysis will be crried out using the worksheets (or vrints hereof) presented in chpter 4. The plnt functionl model cn be developed nd presented in two different wys: tbulr or grphicl form. These two presenttion forms cn be used seprtely or they cn supplement ech other. For ech plnt or ctivity the nlyst cn choose the most convenient wy to develop the functionl decomposition nd present the plnt model. Applictions of the tbulr form nd exmples of the grphicl presenttion form cn be found in the ppendices. However, it must be noted tht, with regrd to the softwre specifiction developed under WP4, the grphicl method hs not been developed, except so fr s it is used in bbrevited form to llow the user to nvigte through the model, s described in section of this document Tbulr form hoosing tbulr presenttion form will mke it esier to develop frme for the overll hzrd identifiction s the worksheet from the functionl model cn esily be linked to the worksheet of the oncept Hzrd Anlysis. The functionl model cn be contined in three column worksheet s shown in Figure 4 where the "Ref" column is used for numericl reference s explined lter. The "T" column is used to indicte the type of the object by the letters I for Intent, for ethod nd for onstrint. The "description" column contins n impertive sttement which forms the Intent, ethod or onstrint. Risø-R-712(EN)

14 Function ReT T Sttement (oncept Hzrd Anlysis) Figure 4. Tbulr presenttion form. To mke the functionl model more redble column for comments or notes cn be included in the worksheet. The comments or notes re for explntion only nd do not form prt of the plnt functionl model. As indicted reference (numbering) system is used to clrify the functionl decomposition. A deciml numbering system is proposed, s follows: - the first Intent of the model is reference 0 - the first list of ethods is numbered sequentilly l...n - the numbering of the first list of onstrints strts t n+1. If ethod or onstrint is expnded, then it genertes new Intent which is numbered i.o which hs new list of ethods numbered from i.l to i.n nd? new list of onstrints strting t i.n+1. This presenttion form is unmbiguous but cn result in lengthy reference numbers ( problem which seems to be unvoidble). Finlly, it is recommended tht, in order to keep the clrity of the plnt functionl model, the numbering of ethods nd onstrints follow s much s possible the logicl sequentil order with respect to the processes nd ctivities t the plnt. One wy to illustrte the Input/Output reltions between the plnt objects in the tbulr plnt functionl model is to list the ethods in the sme sequentil order in which they re performed to fulfil the requirements of the Intent in question. (Note, tht ctivities in prllel cn be indicted either by use of logicl OR or by the imposition of suitble onstrint) Grphicl form In severl cses grphicl presenttion form cn be useful s supplement to the tbulr documenttion. In the grphicl presenttion form the functionl objects of the model follow the generl formt s illustrted in Figure 3 nd which follows the usul conventions of the SADT (Structured.Anlysis & Design Techniques) method of systems nlysis. The min benefit of using the grphicl presenttion form is tht it is possible in cler mnner to show the min strems nd the internl functionl reltions of the plnt. For ctivities where for instnce filure propgtion is considered to be n essentil sfety spect the preprtion of grphicl presenttion of the functionl decomposition might help to identify the incident course nd the criticl plnt res. If grphicl presenttion form is chosen the outcome of the functionl plnt decomposition will differ from the outcome bsed on the tbulr presenttion form. 13

15 In generl the sme objects cn be found in the two presenttion forms but different structure of the functionl model will often be convenient. The grphicl form hs the dvntge tht it will lmost lwys be possible in one digrm to contin more thn one Intent together with the respective ethods nd onstrints. A disdvntge with the grphicl presenttion is tht the development of the functionl digrms cn be rther time consuming nd they cn be more troublesome to updte nd correct. A good softwre editor will reduce this problem. Furthermore, to crry out the hzrd identifiction it is necessry to trnsfer the objects of the digrm onto tbulr form to which the HA worksheet cn be connected. For these resons, it is proposed tht the computerised version of TOHID will incorporte grphicl representtion tht shows only the model structure, content being given in the tbulr displys. 3.4 Plnt functionl objects The technicl configurtion of chemicl process plnts clerly differs from plnt to plnt mking it rther difficult to formulte explicit rules for crrying out functionl decomposition. It must be stressed, tht the decomposition of plnt or unit into its functionl elements is not well-defined exercise with only one outcome - it cn be done in different wys depending on the experience nd choices of the nlyst. On the other hnd, exmples nd guidelines my be useful nd it is to some extent possible to exemplify the kind of informtion tht is intended to be represented t the different functionl levels. Exmples of functionl objects cn be found in the following sections. Furthermore, some problems which my rise during functionl decomposition of process plnt re discussed. Detiled exmples nd ppliction of the principles of functionl decomposition cn be found in the ppendices. It must be stressed tht the bsic ide is to develop procedure which cn structure nd support plnt level hzrd identifiction by use of the functionl decomposition principles. It hs not been the intention to develop rel txonomy for representtion of functionl objects in plnt model Estblish the Intents of the plnt One question is how the different functionl objects re to be chrcterised. If, s n exmple, we consider chemicl btch rector equipped with temperture lrm, the question is whether the temperture lrm should be chrcterised s ethod (equipment used to relize the Intent) or s onstrint (equipment used to control the Intent). Since the reson for mking the plnt functionl model is eventully to perform plnt level hzrd identifiction, the importnt point is not how the object is chrcterised, but tht ll objects importnt to sfety pper in the functionl model of the plnt. The bsic principle of the functionl modelling in which ny spect of the plnt cn be represented s Intent by ethods with onstrints is vluble wy of thinking to ensure tht ll sfety spects hve been considered. It cnnot be over-emphsised tht it is more importnt to ensure tht ll those objects which ffect sfety re included, thn to be concerned s to whether or not thev re included exctly in the right plce. In ech cse it must be considered whether the choice of function nd the wy in which it is expressed Risø-R-712(EN)

16 will influence the performnce nd result of the subsequent plnt level hzrd identifiction. Determining the Intent of plnt nd distinguishing the Intent from onstrints (nd sometimes ethods) is mtter of some judgement s the following exmples show: Intent: ke liquid oxygen. This is clerly n Intent nd nothing but. Intent: ke liquid oxyviin by liquefction of ir. Here, the Intent hs been mixed with the ethod "by liquefction of ir". Intent: ke liquid oxygen t cost lower thn 101 tonne. Here the Intent hs been mixed up with the cost onstrint. Intent: ke liquid oxygen with noble gsses s by-product. This is vlid Intent which cn be split into two subsidiry ethods "ke liquid oxygen" nd "Extrct noble gses s by-products". The best wy to decide whether n Intent is correct is to exmine ech cluse of the sentence nd see if it is ethod or onstrint. If is either, then the cluse is removed from the Intent sttement nd replced in the ctegory it belongs. As generl principle, the top Intent should be kept s simple s possible, while still cpturing the essence of the plnt. Another spect relted to the determintion of plnt Intents is the identifiction of those production units nd ctivities which will be the principl prts of the plnt functionl model. The logicl strting point for the functionl decomposition will often be the specific Intent of the plnt. Here it is importnt to keep in mind tht this choice will often led to frgmented structure for uxiliry opertions highly integrted in severl Intents e.g. the control system, mintennce opertions, qulity ssurnce system, procedures for hndling chemicls, emergency system. These uxiliry systems will pper t those points in the functionl model where they re considered to be importnt from sfety point of view, while the structure of the entire systems my not pper clerly ny where. If the tsks of the uxiliry systems re seprted nd only included in the functionl model where relevnt it must be considered how to ensure complete nlysis covering ll relevnt tsks of the uxiliry systems. onsequently, there my be occsions when it is desirbly to decompose the system strting from the uxiliry system Intent. E.g. the sfety of mintennce opertions could be exmined by strting from intin the plnt s the top Intent Estblish the ethods nd onstrints of the plnt "ethods" nd "onstrints" re objects relted to specific Intent t specific plnt level. "onstrints" comprise ctivities, instlltion or systems tht restrict or control the Intent. Generlly speking "onstrints" cn be equipment, supervision nd/or mngement. "ethods" comprise hrdwre (i.e. equipment nd chemicls) used nd procedures or opertions crried out to relize the Intent. Hving estblished vlid Intent for the plnt the next step/tsk is to decide the ethods vilble to implement the Intent nd the conditions which restrict the Intent. It is impossible to prepre complete list of ethods nd onstrints relevnt to the plnt functionl model, but Tbles 1 nd 2 contin some high level stndrd ethods nd onstrints, respectively, which it is recommended lwys to consider during the development of the plnt functionl model. Risø-R-712(EN) 15

17 Tble I. Stndrd ethods. ethod nge the opertion Support the opertion Suggestions for expending the ethod Feedstock loding; Intermedites: Plnt coordintion; Production ctivities: Product unloding; Sfety culture. tlyst loding; lening: onstruction: ontrol process; Deployment; Firefighting; Loding; intennce; nge emergencies; odifiction; Pinting: Qulity control; Security; Shutdown; Strt-up; Storge; Testing; Trining; Trnsport; Unloding; Wste disposl. Tble 2. Stndrd onstrints. onstrint Protect environment from dmge by plnt Protect plnt from dmge by environment Suggestions for decomposition of the onstrint Avoid ccidentl releses ontin process fluids ontrol effluent disposl inimize coustic emissions inimize plnned releses Protect ginst incidents in djcent plnt Protect ginst mn-mde dissters Protect ginst nturl dissters Protect ginst unuthorized ccess to plnt The first stndrd ethod "mnge the opertion" presented in Tble 1 refers to production ctivities while the second "support the opertion" covers everything else. Supporting tsks re often not covered sufficiently in hzrd nlyses. Including these ethods t high level ensures n pproprite integrtion of these spects in the nlysis. Supporting tsks should be exmined t ech stge of the functionl decomposition to see whether prticulr ethod is pproprite for inclusion. urrently, two stndrd onstrints hve been identified for inclusion t level 0 in the plnt functionl model (Tble 2): "Protect environment from dmge by plnt" nd "Protect plnt from dmge by environment". These re clerly complementry nd it should be noted tht personnel re included in the concept of Environment. The lists of Tble 2 suggest some ethods into which these onstrints cn be decomposed Systems nd items with multiple functions It cn sometimes be difficult to decide where n object belongs, s the following two smll exmples show: - Het exchnger: is the primry purpose to het strem A or cool strem B? - Pump: is the primry purpose to empty tnk A or fill tnk B? These exmples re trivil, but they do illustrte n importnt point: where hrdwre item hs multiple functions, these functions my pper seprtely in the pproprite prts of the model. The modelling problem is biprtite: - A multiple function will pper frequently. Indicting ll reltions to nd impct on other functions cn esily diminish the clrity of functionl model. Risø-R-712(EN)

18 - If the tsks of multiple function re seprted nd only included in the functionl model where relevnt it must be considered how to ensure complete nlysis covering ll relevnt tsks of the multiple functions. In generl this presents no gret problem; however, if clerer reltionship between function nd equipment/hrdwre hierrchy is required then mens must be found to ccomplish this Dynmic spects of processes The principles for decomposition of the plnt functionl model hve been developed for ppliction to btch processes s well s continuous processes. In some cses the dynmics of the system cn be criticl sfety fctor: e.g. n importnt dynmic fctor for btch processes cn be time nd for continuous processes flow. In generl it is importnt to ssess the impct on plnt sfety of the dynmic behviour of system. Relevnt dynmic fctors cn e.g. be: time, flow, temperture. 3.5 Opertions nd mngement issues Opertions issues "ethods" nd "onstrints" identified s opertions cn be difficult to decompose in cler nd logicl mnner. In Tble 3 generl list of opertions is presented which cn support the functionl decomposition. The ide is to write down brod smple of ctions tht my pper t process plnt. In the content of functionl modelling, the intention is tht opertions re relted to specific Intent where it is considered importnt from sfety point of view. Observtion nd mnipultion cover the physicl interction with plnt nd equipment, while evlution is mentl tsk. ommuniction includes telephone clls, reding production schedules etc. ontrol is reserved for terms tht refer to higher level mnipultion or specil control concepts such s set points. The three first ctegories my be seen to form n observe - evlute - mnipulte loop, modelling the centrl opertor ctions, with the next two ctegories serving s tool fmilies. Plnts with high degrees of utomtion hve centrl control system operting the whole plnt with the opertor merely monitoring the needs of the control system. Plnt mintennce, which is n importnt but often overlooked spect of system sfety, lso involves the functions of observe, evlute etc. nd is lso included s one of the stndrd ethods of Tble 1. Tble 3 ttempts to present the tsks of n "opertor" ccording to the bsic verbl menings nd the lists re not reduced to minimum sets representing the necessry opertor tsks. The list is presented here s rough sketch of possible input prmeters to error lists nd to suggest bckground for wording the functionl model t the lower plnt levels. Risø-R-712(EN) 17

19 Tble 3. A generl list of opertor ctions. observe evlute mnipulte objects (goods, bodies, substnce) mnipulte equipment mnipulte tools nd instruments communicte control red (instrument, lbel, sign scheme, text); listen; feel (temperture, movement); smell; mesure (weight, count); check; inspect: look fter; mesure if compre (with reference, trget vlue, scle, pln): review (observtion, dt, experience); judge; decide; choose pln, strtegy or procedure tke; crry; return; lod/unlod object; fill/empty continer; dd/remove; dd substnce; tret substnce; move; lift/lower; turn; position; secure; lock/loosen estblish; cormecvdisconnect; ssemble/dissemble; instll; djust; reset; ctivte; dectivte; open/dose; select; fill/empty; clen press; push; turn; drw; modify/work on; vibrte; mesure; connect/disconnect remove; exchnge; reset sk; nswer; inform; contct; record; log; write initilize; prepre; observe stte; check stte; chnge stte; increse ttention; reset; steer 35.2 ngement issues As mentioned, one of the min objectives of the functionl model is to represent process plnt s socio-technicl system. One of the importnt elements in this connection is representtion nd integrtion of mngement issues nd work orgnistion in the functionl plnt model. In this prt of the project the nlysis of mngement fctors is limited to n identifiction nd integrtion in the plnt model of the mngement fctors. In work pckge 3.2 methods to investigte the impct of mngement fctors on plnt sfety will be further developed. ngement issues will usully be developed from stndrd ethods (Tble 1) or stndrd onstrints (Tble 2). If this pproch is followed, then the functionl sub-model of the mngement issues my not correspond to tht of the rest of the plnt - especilly to tht of its physicl sub-structure. Within the functionl model, there is no requirement for the structure of one sub-model to conespond with tht of nother. However, the lck of structurl correspondence my cuse confusion. One solution to this problem is to integrte mngement issues into the model by mens of bottom-up pproch. In this cse, the strting point for functionl decomposition is the low-level function nd the mngement issues re only integrted into the functionl model if they re considered to be importnt from the point of view of sfety. Tble 4 contins some exmples of mngement issues which cn support the functionl model. 18 Risø-R-712(EN)

20 Tble 4. Exmples of mngement issues. system climte orgnistion structure mngement structure informtion communiction technicl dsorption: legisltion: regultions; poeticl derte: economic climte; business fctors; pubic reltions corporte mission nd philosophy: resource provision: decision-mking hierrchy; sfety policy; corporte culture: interction with other sobo-technicl system resource Roclion; level ot stffing; competence: qulity control; commnd structure; ctivity monitoring; setting nd mintining stndrds; supervision; third prties reltions (contrctors): response to chnge; sfety responstoitws; ccident/incident investigtion dt processing; vilbly; interfces; operting procedure/mnul; tsk specifiction: qutty ssurnce mnul: emergency procedures chnnels; emphsis; interfce/exchnge medi; incident reporting; emergency bck-up 3.6 Procedure for functionl decomposition of process plnt The functionl model pproch proposed hs the dvntge tht it offers the possibility of representing ll fcets of the plnt description (ctivities, hrdwre, opertions, work orgnistion) in n integrted nd consistent wy. The procedure proposed to crry out the functionl decomposition of the plnt is the following: ) Discuss the overll gol of the functionl model. b) For lrge complex plnts it might be necessry to perform the functionl modelling of the plnt ctivities by subdividing the plnt into systems, subsystems etc. nd perform functionl decomposition for ech prt. c) Determine the principl prts of the plnt nd the strting point for the functionl model. d) hoose the documenttion form for the functionl model nd the hzrd identifiction. If performing mnul decomposition, then choose formt such s tht shown in Figure 4 or the grphicl form discussed in section Otherwise, the computer-ssisted TOHID tool cn be used, s described in section 4.2. e) Estblish the top Intent of the plnt. 0 Link the Intent with the ethods tht re used in crrying out the Intent. g) Identify onstrints nd link them to the Intent. h) List the ethods nd onstrints; if possible, in logicl sequentil order with respect to plnt design nd the opertions crried out. i) Discuss the identified ethods nd onstrints nd identify those which re going to be further decomposed, j) Prepre the new list of Intents nd proceed from point d. k) The functionl decomposition is finlized when n pproprite level of detil hs been chieved. Risø-R-7I2(EN) 19

21 4 Principles of HA pplied with functionl modelling The previous section described how process plnt my be modelled by the functionl method; this section describes how oncept Hzrd Anlysis (HA) my be performed on tht model. 4.1 HA on plnt functionl model A generl method for HA is described in (Anon, section 4, 1993), primrily in connection with the mnul version of TOHID nd without reference to the functionl model. Figure S shows the lia procedure which is identicl for utomted nd mnul modes, the only difference being the linkge between the nlysis font, nd the functionl model, s described in section 2.1. Agree set of keywords * Prtition plnt into sections -si ^1 Select section NI/ Anlyse ct All Annm 9 "=. *-^^^ /\ii done : -* Produce report Figure 5. Overll HA procedure Agree on set of HA keywords A Tsk-specific HA Keyword Dtbse (KD) must be ssembled for ech nlysis, in ccordnce with the procedure shown in Figure 6. A progrmme module Edit KD is used to dd (nd, delibertely with some difficulty, to delete) keywords to file known s the ore KD. This file will contin keywords which re pplicble to vriety of industries nd situtions nd from these dtbse, Tsk KD, must be ssembled, using tl.v Abstrct tool, contining only keywords pplicble to the nlysis (exmples of keywords cn be found in the ppendices nd in (Wells, Wrdmn & Whelton, 1993)). The detils of this dtbse (loction, filenme, etc.) re dded to the registrtion dt. Typiclly, ten to twenty keywords will be bstrcted from the ore KD to the Tsk KD. Once the Tsk KD hs been creted, the user hs ccess to it vi Browse fcility which displys one or more keywords nd llows the user to Risø-R-712(EN)

22 move bck nd forth in the fik t will; keywords cn be copied from the Tsk KD into the pproprite slot of the nlysis form, using the usul Windows copy nd pste commnds. Figure 6. Assembling keywords Prtition the plnt into sections The detils of this ction vry ccording to which operting mode hs been set ected; there re. in fct, three possibilities: ) Automted mode. Here, cretion of the plnt functionl model hs in effect prtitioned the plnt into sections. The first level of decomposition will usully provide sufficient prtitioning; however, if this proves to be too brod or corse, functions cn be selected from the next level of decomposition. Prtitions cn be selected from ny mix of levels of decomposition of the model, provided tht it is ensured tht the full bredth of the model is covered. E.g. in Figure 7(), the selected functions provide full coverge, wheres in Figure 7(b) they do not. b) nul mode, using functionl model. Here, prtitioning is gin provided by the functionl decomposition nd this my be used if so desired. c) nul mode, not using functionl model. In this cse, no help or guidnce is vilble from the model nd the user must prtition the plnt ccording to the tem's needs. In generl, prtitions should be such s to be comprehensible nd to llow resonble mount of time for the tem to discuss. Note tht is not recommended tht ny mixture of mnul nd model-bsed prtitioning be used s this is sure recipe for confusion. Once the plnt hs been prtitioned, nlysis proceeds section by section until ll hve been covered. Forms for the documenttion of substnce properties nd the HA re given in (Anon, section 4, 1993); modified HA forms, derived with the objective of computer bsed system, re given in (he following sections of this document nd demonstrted in the ppendices. Risø-R-712(EN) 21

23 fissl. ; nn rå«bjbé ii Q fibbbi fut5t3 [555^ <> <b) FtfHrv 7. Vlid pvriripjunj. (tø /nv/irfpmtnun. 42 Performing the HA Severl formts rc im Bed tor Ae nlysis; ffigfe 8 shows dht sggested for pmdy mnul nlysis. WHhot connci spport, nd my be dplrii lo wold piucewji or lo pried form. Function ReT T Sttement k Keyword in vrince onse- ingtion Notes Figure 8. Simple HA frm. For the TOHID softwre, two forms re proposed: one for the plnt functionl model nd the other for the nlysis. Figure 9 shows the fonnt proposed for the functionl model. With the scheme of Figure 9, References would be ssigned utomticlly; one grid is ssigned to the Intent sttement (of which there cn only be one) nd n unlimited number of grids ech re ssigned to the ethods nd onstrints, though only three re displyed ovement mongst the ethods nd onstrints, when there re more thn three, is controlled by the scroll-br:, shown to the right of ech ock. ovement mongst the functions is controlled either by horizontl nd verticl scroll brs (not shown in the Figure) or by the model nvigtor (similr to Figure 7()), which is the preferred method. As noted bove, in the utomted mode the nlysis form is linked to the model disply so tht whtever functionl sttement is highlighted on the model, the Risø-R-712(EN)

24 Ref T pe Sttmnt onefc : : ; : \ : ; c c i c i : 1! i 1 t I t Figure 9. The Function window. nlyse form shows the corresponding nlysis. In this cse, the Ref. field of the model form provides the primry reference to the nlysis, second reference being provided by die keyword, since more thn one keyword cn be pplied to functionl sttement. However, in die mnul mode, dus linkge does not exist nd reference numbers re supplied by the user. This requires composite formt to ccommodte the two modes; Figure 10 shows the formt proposed. Ref Stem Keyword k-tef i i i in i j n Vrince onsequences PfOt;flion7luT)]rjtjn omments 1 Figure 10. The HA window. In the utomtic mode, the Ref field merely mimics wht ' lredy displyed in the Ref field of the model nd the verticl scroll br (right) is greyed-out. In mnul mode, the Ref field is utomticlly incremented whenever new strem is selected nd the verticl scroll br is ctivted nd used to move up nd down mongst the records, which re orgnised sequentilly. Since multiple keywords rc llowed, this field is provided with drop-down box, so tht the keywords cn be seen nd selected. The fields of the three formts re summrised s follows: - Ref field provides < reference to the record. In the functionl model, references rc llocted utomticlly, using the scheme s explined in prgrph of this document. Alterntively, in mnul mode, the sme scheme is pplied to the model (if used) but the Ref. field of the nlysis is numbered sequentilly s records re dded. Ri«vR-7l2(EN) 23

25 - T. An entry in dus fieki indictes the Type of die touowing sttement, win dk convention: I-flmenu itdwd: nd -*onstrinl If using d* form of Figure 8. dus b supplied by dk user unvrwuc. it b llocted utomticlly since seprte fields re llocted to Intents. ednds. nd onstrints. - Strem, dtb hs been included in die computer-bsed medtod s n option; it need not be used bt it b fell dtt it cn be nsefnl to nve cross reference lo - Sttement describes die Intent. ethod, or onstrint to which it refers. Since no opertions re ctully performed on die sttements, dieir formt nd content b unlimited, dmugh users will be encourged to be brief nd to phrse dor sttements in certin stndrdised wys. To fcilitte this, sttements cn be collected nd ssigned to function dictionry where diey cn be exmined nd re-used so s to promote consistent style. - k or k-ref b n index to the keyword, widn die functionl sttement reference. There my be multiple keywords pplied to die sttement; these re referenced by tellers. b. c~z. - Keyword, flås b me keyword, selected from die tsk HA keyword dtbse s described m bove. Applying die Wht if...? principle by negtion of Intents nd onstrints s described in (Amu section ) suggests dm die first keyword in diese two ctegories should lwys be die word 'NOT'. - m vrince, dns detib die mm effects inferred from pplying die keyword to die function sttement. - onsequences. UK mjor consequences which could rise from die mm vrince. - itigtion, ny fctors which exist to mitigte die identified consequences. If fctors re identified which should exist (but re bsent) diese should lso be recorded. - Notes nd omments, ny comments entered during construction of die model re crried forwrd into dus section. Fnner notes re dded s required. With die forms nd toob described bove, severl options re vilble for performing die ctul HA HA without computer support ) Keywords re tken from prepred lot nd pplied to ech selected plnt section in turn. By discussion mongst die tem, dus b used to generte in Vrince on die nlysis form. b) Ech item of equipment b checked ginst die Equipment Dt Bse (EDB) for known hzrds. Using die item nme s keyword, vrinces re recorded from die dtbse. c) Identify die consequences of ech min vrince. Risr»-R-7I2(EN)

26 d) Determine il k hzrd cn be dtiigtd-ot or if BK hzrd cn be otherwise reduced or ctuinkd. e) Drirrmiw ny rntmlr nr måif.irin 0 Determine ny rn cnu nd ctions. 4ui2 HA win* cntr srt nd with the plnt fnrtl model ) Perform Wht if..? nlysis by negting ech ltent. eud. nd onstrint of dk model I.e. by sking: Wht if ds InK (eted or onstrint) is not stisfied? l docribu* dk mnul nwdxl (Anon, section ) sggests dm Wht tf..? nlysis cn be pufuind t ds time. Adpting ds ide to ok fenes offered by dk functionl model, similr effect cn obtined by negting dk verb i te Intent nd onstrints sttement? See (Anmu section 6-2. I993K UK OK resufes of dås step lo gcnerk in Vrince on the nlysis form. (Note dm lo idkk d«ds step hs been pplied. dk word NOT' shohf be werted in dk Keyword to limn). b) Apply die HA keywords to ech Hfct. edud. nd onstrint in dk model. Keywords re tken bom the Tsk-KD nd ppbed to ech stjfcnnt in trn. This is lso sed to generte in Vrince on DK nlysis form. c) heck ech item of equipment ginst ok Equipment Dt Bse for known hzrds. Using dk kern nme s keyword, record ny vrinces. d) Identify OK onsequences ech m Vrince. e) Determine if the hzrd cn be designed-ot or if UK hzrd cm be odkrwise reduced or eliminted. 0 Determine ny controls or mitigtion. g) Determine ny comments nd ctions. (Note dil if ny comments were generted dring UK construction of the functionl model, these will be brought forwrd into tik finl report form uwugh during the nlysis they will be displyed t the«point of origin.) 4 J Supporting dtbses In dk following UK dtbses required for TOHTD HA - long with the functions supported - is presented. These functions re detiled in (Dvies & Wbetton. 1993) nd the softwre will be further developed in WP4 nd WPS nd ukrcfore. the discussion here is limited to uk usge nd contents of ok dtbses. Dtbses listed in regulr type re required for TOHID HA, those in itlic type re optionl. - ore Key Words: The ore Keyword Dtbse (KDB) will consist of primry nd secondry keywords. Ar initil set of keywords is given in the report on WP2, (Anon.,1993) nd otikr keywords will no doubt be dded s the project progresses. In rough, round figures, storge will be provided for mximum of primry keywords, with n verge of 5 secondry keywords nd mximum of 20 secondry keywords per primry. I.e. 5,000 records tout. These Ris#-R-7I2(EN) 25

27 keywords re used to generte the Tsk Keyword Dtbse; consequently it hs been decided tht mteril cnnot be deleted from this dtbse without gret difficulty, though keywords cn be dded t ny time. Thus, with use, the dtbse will become ever richer. - Tsk Key Words: The Tsk Keyword Dtbse (TKDB) will lwys be subset of the LKDB. As such, it seems unlikely tht TKDB would ever contin more thn 100 keywords; therefore typicl TKDB will hve, s mximum, 500 records. These keywords re used directly in the nlysis nd, lthough it is possible to hve up to hundred such keywords, it is unlikely tht typicl nlysis will use more thn twenty. - Equipment: The equipment dtbse contins detils of common process equipment, including ppliction digrms nd known chrcteristics nd hzrds. It is plnned tht this dtbse will contin mixture of text nd grphics but tht only hzrd informtion in text form cn be psted to the in Vrince nd onsequences fields of the nlysis form. - Opertions: This optionl fcility would be dtbse of bsic opertions such s fill, empty, lift, observe, etc. s described in section ngement Issues: This optionl fcility would be dtbse of mngement issues such s system climte, orgnistionl structure, etc. s described in section Functions: Eventully, s one of the benefits of the functionl method, dtbse of functions would be developed. This would consist of functionl models contining the generic portions of models which hd previously been creted. - Scenrio: This is envisged s being similr to the dtbse of functions, but concentrting on generic portions of mngement nd opertionl models. - ethod Dictionry: From the functions dtbse, dictionry of stndrd methods cn be extrcted nd then used to promote greter consistency in the nlyses. - onstrint dictionry: From the functions dtbse, dictionry of stndrd constrints cn be extrcted nd then used to promote greter consistency in the nlyses. 4.4 Supporting nlyses Three supporting nlyses re plnned for TOHID : oncept Sociotechnicl System Review (SSR), Preliminry onsequence Anlysis (PA), nd Short-ut Risk Assessment ethod (SRA); these re outlined in the following prgrphs, further detils being given in Ref. (Anon., 1993) oncept Socio-technicl System Review (SSR) The oncept Sfety Review needs to consider both the Sociotechnicl System of which the plnt is to be prt nd the hzrds presented by the plnt. Suggested keywords for use during the initil stge of this socio-technicl system review Risø-R-712(EN)

28 which re specificlly directed t sfety fctors re listed in the Tbles of (Anon., section 4.2, 1993). It is emphsised tht this is review stge nd consequently it is importnt not to get involved in detiled discussion but to highlight possible problem res. The im is to generte mjor vrinces cused by the new plnt t prticulr loction for further study. If the review is to be crried out for n expnsion of n existing plnt it my be good time to highlight res giving problems possibly with the im of getting the topic ccepted for the ompny's Sfety Improvement Progrmme Preliminry onsequence Anlysis (PA) A Preliminry onsequence Anlysis of jor Incidents exmines the impct of wht might occur on prticulr process plnt. It is usully crried out s soon s description of the process flow digrm is vilble. If the site is to be selected it my be done very erly nd such study my well only consider pipe breks nd common leks. The nlysis cn be crried out following riticl Exmintion before decision is mde to proceed with more extensive design. Although here the emphsis is on plnt it is necessry to do similr studies on the trnsport of rw mterils nd products. In order to scertin the problems, it is necessry to identify the proposed site nd effect n pproximte lyout of the plnt. The bsic informtion required is listed in (Anon., section 4.3, 1993) nd some of this informtion is subsequently trnsmitted to Regultory nd Plnning Authorities when required. The Preliminry onsequence Anlysis of jor Hzrds will not give n ccurte ssessment of the frequency of ny incident nor the mesures used to control or void the relese. It should however consider wys of deling with the resulting emergency nd instigting the emergency response. The report should t this stge concentrte on the response to the emergency rther thp countermesures to specific relese. However due ttention must be given to the possible escltion of the incident, including escltion s result of mitigting efforts such sfightingfires Short-ut Risk Assessment ethod (SRA) Risk is here defined s the Likelihood, L, of specific undesired event occurring within given period or in prticulr circumstnces. The likelihood is mesured s frequency per yer. The Severity, S, is mesure of the expected consequence of n incident outcome. The Trget Risk is defined by the eqution TARGET RISK = log.olo tog^lo 8 = L + S where L is the exponent of likelihood s mesured by frequency ( negtive vlue) nd S is the severity rnking. The trget risk is only cceptble when its vlue is equl to or less thn rero. To reduce the risk, tke mesures to: ) reduce the likelihood of occurrence, which is mesure of the expected probbility or frequency of occurrence of n event. 27

29 or b) meliorte the severity of the consequences of its occurrence by pproprite mesures, for exmple the exposure of n individul to hzrdous substnce which my not be eliminted by other mens might involve mesures imed t prevention of exposure, reduction of emission or exposure nd provision of mens for deling with residul risk. 28 Risø-R-712(EN)

30 5 onclusions From the theoreticl work nd the two cse studies some specific nd generl experiences nd recommendtions cn be drwn which re summrized below. In this connection it must be remembered tht the TOHID project continues until 1. August 1994 nd tht the method will be further improved during the work pckges 3.2,4 nd Arising from the btch cse study From the cse study of the btch rector plnt (ppendix A) the following points cn be noted: - Functionl decomposition: "ethods" nd "onstrints" identified s hrdwre (equipment, chemicls, etc.) re much esier to decompose in cogent wy thn objects identified s softwre (opertions, mngement etc.). Especilly "6.0 nge the opertion" nd "7.0 Support the opertion" cuse trouble with respect to selection of n pproprite modelling structure. The structure chosen is to lrge extent close to the orgnistionl working structure t the plnt nd the hierrchicl structure of the qulity ssurnce system. (The impct of mngement nd orgnistionl fctors on plnt sfety will be further investigted in work pckge 3.2). - Grphicl form: Two exmples ("1.5.0: Provide TI" nd "7.3.0: lening of TI/F feedsystem") hve been worked out to illustrte the ppliction of the grphicl form. The numbers in the two forms correspond to the sme numbers in the tbulr forms. With respect to the grphicl presenttion form it is importnt to notice tht these forms provide the possibility of clerly showing the interreltions between the different ethods nd onstrints relted to specific Intent. - Level of detil: The btch rector plnt selected s test cse is rther smll chemicl process plnt wht concerns the size of the plnt, the quntity of chemicl substnces hndled nd the number of opertors directly involved in the production. In the plnt functionl model the level of detil is high nd probbly too high for plnt level hzrd identifiction purpose. Therefore it is expected tht the degree of detil of plnt functionl models will be less extensive for other nd bigger chemicl process plnts. 5.2 Arising from the continuous cse study Severl useful conclusions cn be drwn from this exercise (ppendix B); they re summrized below, ccording to subject. - Overll efficcitv: Producing the model, top-down, to the required level of detil nd then performing the hzrd nlysis in bottom-up fshion worked s intended. No gret difficulties were encountered nd the results seem comprble to HAZOP to the sme level of detil. In fct, hzrds such s those ssocited with security nd ctlyst hndling would probbly not hve been identified by other methods t this level. 29

31 -Keywords: In generl, the existing keywords performed well. However, it is cler tht keywords such s EXTREE_WEATHER my be too generl to gurntee meningful results without extr imgintion on the prt of the nlysis. onsidertion must therefore be given to expnding some of the existing keywords into sub-ctegories. Similrly, s noted for Functions 3.1.5, nd in the exmple, new keywords re likely to be required to cope with some situtions, especilly those tht concern functions such s mintennce nd trnsport which re outside the immedite domin of the process. It is worth stressing tht the development of keywords pproprite to these res is most importnt; existing methods of hzrd identifiction do not dequtely ddress these res nd TOHID offers n opportunity to improve upon this sitution. Stndrd ethods nd onstrints: The existing stndrd ethods nd onstrints performed well, llowing identifiction of problems which existing methods might not hve focused upon so redily. However, some revision is clerly necessry, in prticulr the need to distinguish clerly between ethods such s Protect from mn-mde dissters nd Protect from incidents in djcent plnt. Duplicte hzrd sttements: Performing the hzrd nlysis 'bottom-up' llowed more rtionl tretment of duplicte hzrds thn when it is performed 'top-down' nd is clerly the preferble procedure. Two generl types of duplicte sttement hve been identified: hzrds which re repetitive cross functions; nd those which re repetitive within function. As lredy noted in WP4 (Dvies & Whetton, 1993), the use of Hzrd Librry, stting hzrds in stndrd form, would llow duplictes to be redily identified by the softwre so tht, where duplictes occur within function, they cn be collected nd moved up to the function's Intent nd where duplictes occur cross functions, they cn be tied to the most pproprite plce nd then cross-referenced t the other plces where they occur. Developing from this is the concept of Specific Hzrd Dictionry, dt-bse which would be specific to the nlysis nd would list the identified hzrds ginst where they occur in the nlysis. The opposite concept, collecting hzrd sttements nd moving them up to the higher levels, ws demonstrted in Functions 5 nd 6 of the exmple, where it ppers to be dequte but inconvenient; the proposed solution of Specific Hzrd Dictionry my well hve dvntges. Substnces list: Although substnce list ws not prepred s prt of this exercise, it becme pprent tht in prepring such list considertion must be given to the 'before nd fter' sttes of mterils such s ctlysts. Other work (Whetton, 1993), (Whetton & Armstrong) suggests tht mterils of construction should lso be dded to the substnces list. 5.3 Generl - Tbulr form: The tbulr presenttion form in which the oncept Hzrd Anlysis is linked to the plnt functionl model gives good overview of the hzrds nd sfety spects of the different prts of the chemicl process plnt. - Stndrd ethods nd onstrints: The use of stndrd ethods nd stndrd onstrints t high plnt functionl level ensures tht these importnt sfety spects re considered nd integrted in the nlysis. However, experience Risø-R-7I2(EN)

32 shows tht further development of these concepts is required, before they cn be relibly used s generic TOHID objects. Work is under development to improve the model fix mintennce nd this will he reported shortly; further refinements will follow. - Duplicte hzrd sttements: The functionl bsed oncept Hzrd Anlysis hs tendency to throw up the sme problems severl times in different plces. While such redundncy is not detrimentl, some mens will hve to be found to keep this problem within bounds. In ppendix B. two possible pproches to the problem hve been demonstrted: collecting hzrds to higher level nd recording them only t the lowest levels. Neither method seems stisfctory on its own nd it seems probble tht d-hoc use of both methods is preferble. Risø-R-712(EN) 31

33 Acknowledgements The uthors wish to thnk the work performed in the frme of the TOH1D project by our prtners t VTT (Technicl Reserch entre of Finlnd), Tecs (Itly), Joint Reserch entre (Ispr), SRD Division of AEA onsulting (United Kingdom) nd IEAT (Spin). Furthermore, we wish to cknowledge the E progrmme jor Industril Hzrds for sponsoring the TOHID project. References Anon. (1993). onceptul Study of Hzrd Identifiction nd Risk Reducing ethods. Finl WP2 report. IEAT, JR, Risø, SRD, Sheffield University (editor) & VTT (deliverer). 284 pp. Dvies, J. & Whetton.P. (1993). TOHID Softwre Design Document: Softwre Specifiction. 22 pp. Kletz, T.A. (1992). Hzop nd Hzn. Rugby, IhemE, ISBN lmen, Y., Nissil,, Rsmussen, B. & Rouhiinen, V. (1992). Nordic Experiences nd Future Trends for the Preprtion of Sfety Reports. Nordic ouncil of inisters. Nord 1992: pp. Wells,, Wrdmn,. & Whetton,.P. (1993). Preliminry sfety nlysis. J.Loss Prev. Process Ind., 6, Whetton,.P. (1993). Snek Anlysis of Process Systems. Trns IhemE, Vol 71, Prt B, August pp Whetton,.P., nd W. Armstrong. Snek Anlysis Applied to Btch Processes. Journl of Hzrdous terils. Publiction detils to be nnounced. 32 Risø-R-712(EN)

34 A se study of btch rector plnt A.l Introduction This ppendix contins one btch rector exmple performed on the principles of the TOHID tool described in the min report. The intention is to illustrte nd discuss how the concept nd the principles cn work in prctice. First, the technicl plnt configurtion is shortly described together with remrks nd results on the prcticl implementtion of the functionl modelling principles nd the oncept Hzrd Anlysis on the btch rector plnt. Second, enclosed to the ppendix the tbulr forms nd few grphicl exmples cn be found contining the functionl plnt decomposition nd the hzrd identifiction. The min conclusions nd recommendtions from this exmple re summrized in chpter S of the min report together with the corresponding results from the continuous process plnt exmple. A.2 Short description of the btch rector plnt The selected btch rector exmple is the previous production of the herbicide PP (Phenmediphm) t the Dnish compny Kemisk Værk Køge A/S (KVK). The production of PP t KVK ws bndoned in 1989, the consequence of production reorgnistion t KVK. Thus, due to this reorgnistion is must be emphsized tht the ctivities t KVK no longer involve quntities of hzrdous substnces which ccording to the Seveso Directive my led to mjor-ccident hzrds. The following plnt description is very short. A more detiled nd comprehensive sfety report cn be found in lmen et l (1992). Informtion bout the involved chemicl substnces nd their combustion products For the production in question the finl product is Herbphene. The chemicl composition of Herbphene is PP nd uxiliry substnces dissolved in isophoron. In the production the following chemicl substnces re involved: m-minophenol (AP), methyl chloroformte (F), m-tolyl isocynte (TI), 28% NOH solution nd 30% HI solution. The formultion process further involves isophoron nd for clening of equipment solvesso (trimethylbenzene) nd vrsol (solvent nphth) re used. From sfety point of View the most essentil chemicl substnces re: - F: (Formul: IOOH,). olourless or light yellow voltile liquid (b.p. 71 nd high vpour pressure t 20 ) with vpours extremely irritting to eyes. F is clssified s "poisonous" (TLV: 0.2 mg/m 3 ). Even reltively low concentrtions of F cn be highly toxic to humn beings upon inhltion (pulmonry edem). F is inflmmble nd explosion hzrds rise when F vpours re mixed with ir. Vpours my trvel to source of ignition nd flsh bck. Wter nd humid ir cn hydrolyse F under the formtion of toxic nd corrosive fumes. F is very dngerous when exposed to het sour- 33

35 ces, sprks, flmes or oxidizers. ombustion products: Phosgene (O1,) nd toxic fumes of I. - TI: (Formul: ON. 6 H 4.H,). olourless or light yellow nd flmmble liquid with chrcteristic smell. TI hs reltively high boiling point, 189. T1 vpours hve high density, 3.7. TI is clssified s "extremely poisonous" (TLV: mg/m 3 ) nd it is irritting to eyes, skin nd respirtory orgns. ombustion products: Oxides of nitrogen (NO,). - AP: (Formul: HO. 6 H 4.NH 2 ). AP is solid substnce which smells like phenol (b.p. 164, m.p ). AP is soluble in wter. AP is clssified s "injurious to helth". ombustion products: Oxides of nitrogen (NOJ. - PP: (Formul:, 6 H, 6 N ). Pure PP forms colourless crystls (m.p ). No fire or explosions hzrds exist. PP is not clssified. ombustion products: Fumes re injurious to helth. Quntities of chemicl substnces involved in the different ctivities The PP synthesis is crried out s btch process. The process time is 8 hours per btch nd the cpcity is 590 kg PP per btch. F nd TI re stored in 200 litre drums inside covered by plstic coting. The mximum storge size is limited to 6 tons of ech substnce. Isophoron is stored in 20 tons continer. AP is stored in scks nd the verge size of the AP storge is 5 tons. Informtion bout processes nd chemicl rections The PP plnt consists of two stirred btch rectors (tnk A nd B). The rw mterils F nd TI re utomticlly dded to tnk A through specil piping instlltion. A thin lyer evportor is instlled between tnk A nd B. A holding tnk for the finl product (tnk ) is connected to tnk B. Furthermore, there is tnk for collection of wste wter (tnk D). The Herbphene mnufcturing cn be divided into four steps: - PP synthesis: Initilly wter nd AP re mixed. F is dded nd the intermedite product methyl-n-(3-hydroxyphenyl)-crbmte (HP) is formed. This step of the synthesis is crried out t fixed ph nd by ddition of ice the temperture is kept t fixed level. This rection step is exothermic nd if the ddition of ice is omitted temperture increse of 16 will pper. In the second step PP is formed by rection between TI nd HP. In the second step ph is fixed while the temperture will increse slowly. F nd TI re dded through the specil piping instlltion from the storge drums plced in smll room seprted from the rest of the plnt. The chemicl rections re: HjOOl + 6 H 4 (OH)-NH 2 > QH^OHJ-NHOOH, (P) (AP) (HP) 6 H 4 (OH)-NHOOH H 4 (H 3 )-NO -> (HP) (TI) 6 H 4 (H 3 )-NHæ- 6 H 4 -NHOOH 3 (PP) - Isophoron formultion: When the synthesis is finlized ph is lowered nd PP is dissolved in isophoron. - Drying of the isophoron phse: The isophoron is pumped through the thin lyer evportor nd by contct with hot ir die wter content of the isophoron phse is lowered. Risø-R-712(EN)

36 - Addition of uxiliry substnces: Auxiliry substnces re dded to the isophoron solution nd isophoron is dded djusting the mixture to the Herbphene requirements. Finlly, the Herbphene drums re filled with the product. The overll structure of the PP plnt The overll structure of the PP is presented in tble Al nd in figure Al the flow digrm of the PP production cn be found. Tble Al. Overll structure of the PP plnt Provide rw mterils Pre tretment Recting Post tretment Storge Auxiliry ctivities * Provide AP, F, HI. NOH, TI, isophoron. NI. uxiliry substnces * The btch rector is filled with wter. * Addition of AP. * onditioning of ph (HI); conditioning of temperture (ice). * Addition of F. * Recting AP nd F to HP in wter; conditioning of ph (NOH); conditioning of temperture (ice). * Increse of ph (NOH). * Addition of TI. * Recting TI nd HP to PP in wter; conditioning of ph (HI, NOH). * Decrese of ph (HI). * Addition of isophoron nd NI. * Seprtion of wter nd isophoron phses. * Drying of the isophoron phse (thin lyer evportor). * Addition of uxiliry substnces (xylene, emulsifiers, dispersnts); djustment of product to Herbphene requirements. ' Pcking nd storge of the product Herbphene. * intennce, repir nd clening of process equipment. * Tretment of solid wste, wste wter nd exhusted ir. * PP control systems (including sequence control, lrm systems etc.). * PP emergency system. Informtion relting to the orgnistion nd the mngement The orgnistion of the PP ctivities t KVK is split up into three levels. Strtegic level: - nging director responsible for performnce of the primry sfety nd qulity gols for the enterprise. - Technicl director responsible for performnce of the sfety nd qulity gols for tiie PP production. - Hed of qulity ssurnce deprtment responsible for: * development nd implementtion of the qulity ssurnce system * performnce of qulity ssurnce tests * nlysis of devitions from expected qulity * informtion to the bord of directors bout the implementtion of the qulity ssurnce progrmme. Risø-R-712(EN) 35

37 Provide ice Provide Provide F Provide K1 Provide NOH Provide TI Provide isophoron Provide N»I Provide xibuies 1 i 1, ^ i i i ' Rcctip Rectw r- fint Kef ~~! jecood - rl Wme vråler H Dryinj Fon- rluvt Stone«Figure Al. Flow digrm - PP production. - Sfety officer responsible for promoting sfety t KVK. The sfety orgnistion comprises: * the sfety officer * sfety, helth nd welfre committee with S members * 33 sfety groups. Furthermore, n industril doctor is employed. Tcticl level: At the tcticl level there re three mngers: Hed of production, hed of mintennce nd n engineer responsible for the electricl instlltions. Ech of these is responsible for working out procedures, instructions nd mnuls necessry to meet the sfety nd qulity gols in ccordnce with the principles lid down in the strtegic pln. Opertionl level: For ech of the three working res (production, mintennce nd electricl fcilities) 2 mnging engineers re responsible for: - tht ll employees in his group re informed bout instructions nd procedures - tht mnuls nd instructions re obeyed - tht the necessry revisions of technicl nd dministrtive instructions nd informtion re initited nd implemented - tht ll employees possess sufficient trining nd experience tht the ctivities in his re re coordinted with the other ctivities t KVK - tht tests initited by the qulity ssurnce deprtment re ccomplished. Qulity ssurnce system A qulity ssurnce system hs been developed in reltion to the PP production. The QA hndbook contins description of the primry principles for qulity ssurnce t KVK. Routines for construction, control, opertion, mintennce, repir, emergency etc. re described in mnuls. Finlly, series of instructions contin detiled descriptions of the specific job functions. Risø-R-712(EN)

38 Emergency pln for hzrdous rtfcm d lrge fires t KV" Incidents involving F or TI hve been integrted in the generl emergency progrmme of KVK. It must be stressed tht the generl emergency pln comprises incidents nd ccidents dil might occur in connection wim other KVK ctivities. The following incidents nd lrms re covered by the emergency pln: 1. Locl emergency: inor incidents limited to production unit. 2. Internl emergency: jor incidents cusing inconveniences outside production re but without effects outside die re of KVK. 3. Externl emergency: jor hzrds. A.3 PP plnt functionl model As mentioned erlier die functionl modelling of die PP plnt hs been crried out by use of die tbulr form. To illustrte the ppliction of die grphicl form two exmples hve been prepred. The overll plnt Intent hs been defined s Produce PP. The ethods nd onstrints relted to die overll Intent hs been defined on bsis of die overll plnt structure (tble Al) nd die lists of stndrd meduds nd stndrd constrints (tble 1 nd 2 of uie min report). This hs resulted in die following first level objects in die functionl model of the PP plnt: Intent Produce PP by ethod Provide rw mterils ethod Pre-tretmenl ethod Recting ethod Post-tretment ethod Store finl product ethod nge die opertion ethod Support the opertion with onstrint Protect die environment from die plnt onstrint Protect die plnt from die environment Ech of these ethods or onstrints hve been further decomposed until n pproprite level of detils hs been chieved. During die functionl modelling it is importnt to keep in mind dit die min reson for crrying out uie functionl modelling is uie subsequent hzrd identifiction nd uierefore die functionl modelling hs to end up with methods nd constrints suitble for die keywords of die oncept Hzrd Anlysis. A.4 oncept Hzrd Anlysis The relevnt keywords considered in reltion to die PP plnt re listed below. These kevwords hve been selected on bsis of our knowledge bout uie technicl configurtion of uie PP plnt nd the generl list of keywords (Wells, Wrdmn & Whctton. 1992) nd (Anon. 1993). Risø-R-7I2(EN) 37

39 The oncept Hzrd Anlysis of Be btch rector pint hs bec erned ot s described in section 4.2.1; Le. HA widuut computer snpporl Selected keywords: - flmmbles: ignition; foe - chemicls: toxic; highly toxic; extremely poisonons; corrosion - hekh hzids: chemicl contct; exposre - rections: mikly exouterrk - process condiuocg: temperture; ph mor; evportor, formtbon - mode of opertion: lest nd mintennce; - opertor performnce: working discipline; supervision nd support; qnlifktttk 300 dtfuutlob^ VtVBy JfdSBS «tw ttnww - piotcdures: working prctice - HWTgffff* TYP^flt' fufffy ft5w'<* c #llttt > Tr h #*"g ftwf fwptfft A.5 Results The most essentil hzrd is dispersion nd combustion of die extremely poisonous substnce TI. Helth hzrds my lso exist in reltion to otfter chemicl substnces nd here specil emphsis mst be lid on dispersion nd combstion ofr Idcntrfied sources of hzrds nd the coéwbons under which n ccident could occur During hndling or internl trnsport drms contining the toxic chemicl substnces my be dmged, nd ds my cuse lek of toxic chemicl. Toxic chemicls my be relesed during repir, mintennce nd clening, e.g. if drm is not fully empiied or the feed system is drined insufficiently. A fire m one of the chemicl storges my be initiled if highly mflmmble substnces re erroneously plced in die storge. Furthermore, releses nd spills during processing my be considered cused by ruptures, lekges nd overfilling. Assessment of ccident consequences This my include dose/concentrtion ssessment covering die following scenrios: - evportion of toxic gses from pool - emission of toxic fumes from pool Tire - emission of toxic fumes from lrge Tire in chemicl storge. Sfety mesures The sfely level t the PP plnt is high, both techniclly nd orgnistionlly. Severl sfety mesures hve been implemented nd instlled, thus reducing the incident frequencies nd dw incident consequences. The precutions cover ll c- Risø-R-7I2(EN)

40 liviiies when; fcitl nd F re involved. Lc. hndbg, storge, trnsport nd processing. The most importnt sfety mesnrcs re: - impfc menttion of the qolity ssrncc system - implementlinn of the PP emergency pln. The wnptemewliiw of me emergency pln hs resulted in very good possibilities nd cundwuns for efficient prevention nd hndbg of incidents. The estblished lrm system b considered lo be svflicient to ensue tht neighbours re wrned efficiently in cse of mjor ccident hzrd t die enterprise. Ris#-R-7I2(EN) 39

41 FUNTION HAZARDOUS PROESS HARATERISTIS PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES,# '! 1 * \ : JlWiKSfclSH* Provide rw mterils See Pre-tretment See Recting See Post-tretment See Store finl product See nge the opertion See Support the opertion See Protect the environment from the plnt See Protect the plnt from the environment See 9.0 t -i * ^ftwwti swwt Krtwfcrti.. ' ;.. / l.i Provide AP hemicls: Toxic Relese -» ignition Emission of NO,, AP Hndling nd storge procedures heck helth effects 1.2 Provide F b Flmmbles hemicls: Highly toxic Relese» fire Relese -* evportion Emission of Ol 2, I". F Emission of F Hndling/clening/storge procedures Emergency system QA-system heck helth effects 1.3 Provide H1 hemicls: orrosion Relese orrosion Hndling nd storge procedures 1.4 Provide NOH hemicls: orrosion Relese orrosion Hndling nd storge procedures 1.5 Provide T1 hemicls: Extremely poisonous Relese > ignition Emission of TI, NO, Hndling/clening/storge procedures Emergency system QA-system heck entrinment of TI in cse of fire heck helth effects 1.6 Provide isophoron Flmmbles Relese» fire Fire, domino effects Segregtion by distnce Fire hzrd moderte

42 ' ' ' ' / FUNTION HAZARDOUS PROESS HARATERISTIS PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES 1.7 Provide Nl No hzrds 1.8 Provide xylene Flmmbles Relese -»ignition or explosion Fire, domino effects Segregtion by distnce Xylene gs detector Xylene ignition source I.1A i t ftwto*w& ' t *, l.l.l Wrehouse opertions hemicls: Toxic Relese during storge Emission of NO,, AP Regulr inspection of storge Lod AP drum onto truck Relese during hndling Hndling procedures U3 Trnsport by truck to locl storge Relese during trnsport Trnsporttion procedures Unlod from truck into locl storge Relese during hndling Hndling procedures 1.13 Opertion mnul Working prctice Procedures not followed % & ]!i : PwWe* Wrehouse opertions b Flmmbles hemicls: Highly toxic Relese during storge Emission of F, I', O1, Regulr inspection of storge, logbook H1 gs lrm system To be investigted 1.2J2 Lod F onto truck b Flmmbles hemicls: Highly toxic Relese during hndling Hndling procedures See 1.2.7; 1.2.8; To be investigted 1.23 Trnsport by truck to locl storge b Flmmbles hemicls: Highly toxic Relese during trnsport Trnsporttion procedures See 1.2.6; 1.2.7; 1.2.8; ; To be investigted Unlod from truck into locl storge b Flmmbles hemicls: Highly toxic Relese during hndling Hndling procedures See 1.2.7; To be investigted 1.23 Procedures for F hndling Working prctice Procedures not followed To be investigted

43 FUNTION HAZARDOUS PROESS HARATERISTIS PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES Estblishrestrictedroutefor trnsport of F Working discipline Route not estblished properly To be investigted lose supervision of ll movements of F is required Supervision nd support Not performed properly To be investigted IJut \ c c c It ': Rdiotelephone must be vilble during the F trnsport H1 gs lrm system in centrl storge Absorbing mteril, slked lime nd extinguisher vilble t centrl storge Fire lrm nd gs lrm system t locl storge (PP control system) - ' Supervision nd support Test nd mintennce Avilbility Test nd mintennce " Not performed properly lfunction of lrm system Not vilble lfunction of lrm systems Undetected fire or relese Escltion of consequences in cse of n ccident Undetected fire or relese -, To be investigted heck mintennce procedures heck routine inspection of ccident protective mesures heck mintennce procedures ' '*, y * ' s s'a* Wrehouse opertions hemicls: orrosion Relese during storge hemicl exposure, corrosion Regulr inspection of storge 1.32 Lod H1 drum onto truck Relese during hndling Hndling procedures 133 Trnsport by truck to locl storge Relese during trnsport Trnsporttion procedures Unlod from truck into locl storge Relese during hndling Hndling procedures Opertion mnul Working prctice Procedures not followed * * 1 \ Pwti*StoOH * Wrehouse opertions hemicls: orrosion Relese during storge hemicl exposure, corrosion Regulr inspection of storge Lod NOH drum onto truck Relese during trnsport Hndling procedures 1.43 Trnsport by truck to locl storge Relese during hndling Trnsporttion procedures

44 FUNTION HAZARDOUS PROESS HARATERISTIS PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES Unlod from truck into locl storge Relese during hndling Hndling procedures 1.43 HH (ill Opertion mnul liihéiiiiiiiiiiii Wrehouse opertions Working prctice hemicls: Extremely poisonous Procedures not followed Relese during storge ^^^^^^^X^^^ ^^^W^^Sf^^^^^k Emission of NO,, TI Regulr inspection of storge, logbook :$:* 8v:8&^^ To be investigted Lod TI onto truck Relese during hndling Hndling procedures See To be investigted 1.53 Trnsport by truck to locl storge Relese during trnsport Trnsporttion procedures See To be investigted Unlod from truck into locl storge Relese during hndling Hndling procedures See 1.5.7; To be investigted 1.53 Procedures for TI hndling Working prctice Procedures not followed To be investigted Estblish restricted route for trnsport of TI Working discipline Route not estblished properly To be investigted J É c c c t lose supervision of ll movements of TI is required Rdiotelephone must be vilble during the TI trnsport Absorbing mteril, slked lime nd extinguisher vilble t centrl storge Fire lrm nd gs lrm system t locl storge (PP control system) pfrøltfe iiltørølt Supervision nd support Supervision nd support Avilbility Test ind mintennce Not performed properly Not performed properly Not vilble lfunction of lrm systems Escltion of consequences in cse of n ccident Undetected fire or relese To be investigted To be investigted heck routine inspection of ccident protective mesures heck mintennce procedures Trnsport by lorry to locl storge Flmmble Lekge -* relese -» ignition Fire, domino effects Fire hzrd moderte 1.62 Unlod isophoron continer

45 REF T FUNTION DESRIPTION k KEYWORD HAZARDOUS PROESS HARATERISTIS - PP PLANT AIN VARIANE ONSEQUENES ITIGATION NOTES Spill bsin Flmmble Ignition Fire, domino effects b pcity OK * 1 Opertion mnul Working prctice Procedures not followed Wrehouse opertions Flmmbles Relese during storge Fire, domino effects Regulr inspection of storge Fire lrm (see 1.8.6) Lod xylene drum onto truck Relese during hndling Hndling procedures Trnsport by truck to locl storge Relese during trnsport Trnsporttion procedures Unlodfiromtruck into locl storge Relese during hndling Hndling procedures Xylene ignition source 1.83 Opertion mnul Working prctice Procedures not followed Fire lrm in centrl storge Test nd mintennce lfunction of lrm system Undetected fire or relese heck mintennce procedures m. I Xylene gs detector in locl storge yf^iwpiwi* lfunction of gs detector -''// 2.1 Add wter to btch rector Pipeline, below, drum Lekge, spill Relese of toxic chemicls Swmp instlled 2.2 Add AP Rection Wrong ddition Useless product Sequence control 2.3 onditioning of ph Rection Wrong ph Useless product Sequence control 2.4 onditioning of temperture Rection No hzrds i»o i» 3.1 I Add F vi feedsystem Pipeline, feedsystem Lekge, spill Relese of toxic chemicls Swmp instlled ' /

46 FUNTION HAZARDOUS PROESS HARATERISTIS - PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES 3.2 Recting AP nd F to HP Rection: mildly exothermic Filure of temperture control nd omission of ddition of ice Temperture cn rech boiling point Temperture lrm t 30* insulled b hemicls: HP HP not hzrdous 3.3 onditioning of ph Rection See onditioning of temperture Rection See Add TI vi fcedsyslem Pipeline, feedsystem Lekge, spill Relese of toxic chemicls Swmp instlled 3.6 Recting HP nd TI to PP Rection: ildly exothermic See 3.2 b hemicls: PP No hzrds PP is not clssified 3.7 Sequence control (PP control system) Rection Wrong sequence Useless product 3.8 Process condition control (PP control system) Rection Wrong process conditions Useless product ,. _ c 1 Process unit control (PP control system) Opertion mnul K^fetiÉt^^É^É^ÉStifc * Equipment Working prctice Filure in process units or components Procedures not followed Leks, spills, stop of process Alrm system instlled V"'' '/'>', % -^I'l 4.1 Decrese ph Seprtion Wrong ph Bd seprtion 4.2 Add isophoron vi isophoron subsystem nd NI to the rector Pipeline, isophoron subsystem Lekge Bd connection from subsystem to rector Relese contining wter, isophoron nd chemicls Swmp instlled 4.3 Seprtion of wter nd isophoron phses Pipeline Lekge Relese contining wter, isophoron nd chemicls Swmp instlled 4.4 Pump isophoron phse from rector Pump

47 FUNTION HAZARDOUS PROESS HARATERISTIS - PP PLANT REF T DESRIPTION k KEYWORD ATS VARIANE ONSEQUENES ITIGATION NOTES 4.5 Dry the isophoron phse in thin lyer evportor Evportor: hot ir Lekge -»ignition Fire Fire fighting system instlled 4.6 Pump isophoron phse to the formultion tnk. Pump 4.7 Add uxiliry substnces, xylene (product Herbphene) b Formultion Flmmbles Wrong ddition Relese during ddition Useless product Fire, domino effect Sequence control Xylene ignition source 4.8 Sequence control (PP control system) See Process condition control (PP control system) See Process unit control (PP control system) See Opertion mnul Working prctice Procedures not followed ^W t i v^^w ^^*^^^T JP^^^BWI'S t ' " f ' * * / / 5.1 Wrehouse opertions hemicls: PP No hzrds PP not clssified 5.2 *ft \ 1 Opertion mnul ibmie^te Htt Working prctice r No hzrds 6.1 limte nd cultures Public reltions Discussions with locl society From time to time discussions with locl politicins nd orgnistions bout hzrdous ctivities t the plnt b orporte culture Lck of shred vlues S.2 Orgnistion structure Decision-mking hierrchy Informl decision structure Discuss if structure is too complex

48 FUNTION HAZARDOUS PROESS HARATERISTIS - PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES 6.3 ngement structure Sfety responsibilities Some res not specified OK b Hndling emergencies Deficiencies in emergency pln OK 6.4 Informtion Informtion qulity Lck of informtion 6.5 ommunictions Incident reporting nd investigtions Some relevnt events not included No incidents reported 6.6 Qulity ssurnce system See «*ft f ; Opertion mnul onstruction mnul Working prctice Working prctice nuls not followed nd updted nuls not followed nd updted Essentil with respect to hndling of F ndti 6.63 Repir nd mintennce mnul Working prctice nuls not followed nd updted Emergency pln Emergency exercises nd trining Personnel not cpble in cse of n emergency?<# \ * i!jwj»ni '^w ^ywvrtiwt y; 7.1 PP control system See len plnt re Orderly, tidy Disorder 7.3 len process equipment See Emergency system See Wste disposl See Trining of personnel Qulifictions nd eduction Personnel not qulified 7.7 Qulity ssurnce system *2L* i hi \ : SPWP ^( ^i-^pswéi., Sequence control See Rection Wrong sequence Useless product ' ^ '; ''

49 FUNTION HAZARDOUS PROESS HARATERISTIS - PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES 7.12 Process condition control Temperture Wrong temperture Temperture cn rech boiling point Temperture lrm t 30 instlled b PH Wrong ph Useless product Process unit control Equipment Filure in process units or components Leks, spills, stop of process Alrm system instlled Fire lrm system Test nd mintennce lfunction of fire lrm system Undetected fire heck mintennce procedures Gs lrm system Test nd mintennce lfunction of gs lrm system Undetected relese of gs heck mintennce procedures QA-sysiem See Set-points, lrm levels, psswords etc.) Equipment lfunction of lrms nd controls riticl conditions not detected heck mintennce procedures b Softwre Softwre errors To be investigted %&0 I to*»proc««i*j«jpwetrt (tori Remove ll drums Helth hzrd: hemicl contct hemicl protective clothing in bd conditions or not used hemicl exposure (smll mounts relesed) 7.32 Purifiction nd dringe of feedsystem Helth hzrd: hemicl contct lening opertions not performed properly hemicl exposure (smll mounts relesed) b Supervision nd support Not performed properly Tke down of feedsystem Helth hzrd: hemicl contct Low hzrd, smll mounts of chemicls lening of components Helth hzrd: hemicl contct Low hzrd, smll mounts of chemicls hemicl protective clothing Helth hzrd hemicl protective clothing in bd conditions or not vilble hemicl exposure (smll mounts relesed)

50 I w z REF T FUNTION DESRIPTION Inspection Opertion nd mintennce mnuls k KEYWORD Supervision nd support Working prctice HAZARDOUS PROESS HARATERISTIS - PP PLANT AIN VARIANE ONSEQUENES ITIGATION Not performed properly nuls not followed NOTES "^^^F "" i ^ ^^^^ f^^ijp ^jf^p^^^ PP unit lrms Test nd mintennce lfunction of lrms Relese/fire not detected heck lest procedures Generl emergency system t the enterprise (locl, internl nd externl) b Test nd mintennce Emergency communiction lfunction of lrms To be investigted 7.43 Gs lrm system Test nd mintennce lfunction of gs lrms Relese of gs not detected heck test procedures Fire lrm system Test nd mintennce Fire not detected heck test procedures Emergency pln See ISA * i Ytjjjit fliill ollect solid wste, empty drums (AP. F, T1. xylene etc.) Helth hzrds Drums not hndled properly Exposure Destruction of chemicls Helth hzrds Drums nd destruction chemicls not hndled properly Exposure ollection of wste wter (from seprtion, see 4.3) Equipment Lekge, spills Relese to sewer or swmp of wter contining chemicls To locl wste wter tretment plnt, problem? Exhusted ir from PP production building Equipment: pipeline Leks Relese of ir contining smll mounts of chemicls -fc Ventiltion system, combustion (power plnt or smokestck) Equipment Flmmble gses not detected Explosion? To be investigted QA-system See 6.6.0

51 FUNTION HAZARDOUS PROESS HARATERISTIS PP PLANT REF T DESRIPTION k KEYWORD AIN VARIANE ONSEQUENES ITIGATION NOTES Gs detector in ventiltion system Test nd mintennce lfunction of gs detector Explosion? To be investigted ontrol nd supervision ommuniction Boiler tender not contcted before strt of production «* i 8.1 ontin process fluids Equipment Overfilling Pipe lekge Relese to drin/sewer Relese to se Very unlikely 8.2 Avoid ccidentl releses Equipment lfunction of scrubber system Toxic relese (smll mounts of chemicls) b Equipment lfunction of ventiltion system Toxic relese (smll mounts of chemicls) 8.3 ontrol wste disposl See 8.1 nd 8.2 ;* 1 ^^^ ^."1^W^^^^^ * *, -" / 9.1 Protect ginst nturl dissters b Erthquke Flood No hzrds No hzrds

52 $ m Proctduros for T1 hndlini QA'iyim Opertion mnul Sioty officer EiUbliih restricted rou Rdiotelephone t luperviuøn Opertion Itdtr 1.3,6, I.S. PP control system Br fl hiin ryitom Oi lrm lyitm Fimdewcler AOUI lrm Ouo*«tor ontin«? T1 drms Absorbing ml. Slked lim«extinguisher tony ^"^ Trnsbon box Truck Select/control rry LodTI _^1 onto truck JBBJL Trnsport by truck lo locl storge u 1.3.) Driv«rry Dolivor Juk. Unlod from truck into locl orl«* W«Empty drumi Provide TI (1.5.0) u»

53 52 Ris*-R-712(EN)

54 B se study of section of continuous process plnt B.1 Introduction The section of plnt chosen for study b methnmr nd compressor, shown in Figure BI. This exmple hs been extensively studied nd reported upon elsewhere (Anon Wefts et i. 1993) nd only brief description b {hen here, in B.2. below. The min conclusions nd recommendtions from the exmple re p-dnrized i chpter 5 of me mm report logedter with the corresponding results from the btch rector exmple. B.2 A brief plnt section description The plnt section b shown in Figure BI. A mixture of hydrogen nd methne gs. continmg oxides of crbon s O nd O>, enters from the upstrem bsorber D The mixture psses dvougn bet exchnger E-IOI. where it b heled before pssing over pltinum ctlyst in rector R-IOI. In R-IOI. oxides of crbon rect with hydrogen nd re convened to methne nd wter, liberting considerble bet; the rection b unstble. The gs exits the rector nd b cooled in E-101 by exchnging bet with the incoming gs strem. Bccse the rection b exothermic nd nste. trip system b provided which, when triggered, bypsses the flow of gs round the rector. The gs b fnner cooled in het exchnger E-102 nd then psses to knockout pot. D-102. where entrined wter b removed by grvity. Wste wter from D-102. which contins dissolved hydrogen nd methne nd some dissolved slts from the upstrem process, b relesed to the sewer drins by level controller which mintins wter sel. Downstrem of D-102. some of the gs b bled off s fuel nd relief vlve b provided to cope with overpressure conditions. The remining gs b compressed in reciprocting compressor nd psses to the downstrem process. The compressor b provided with its own trip system, which opertes upon either low lubricting oil in die compressor or upon high wter level in D-102. In the event of compressor trip, the relief vlve. RV1. b expected to lift. It must he noted dil die P&l digrm, while bsed upon rel plnt, b intended to he prelirninrv digrm, to he used s n undergrdule nd postgrdute exercise in hzrd identifiction. It b therefore cknowledged tht Figure BI. s drwn, contins mny omissions nd b not intended to be representtive of good prctice. B3 Plnt section functionl model The plnt-section functionl model ws developed ccording to the methods described in (he text, strting with the Intent of die plnt s: From hydroxen A methne gs mixture with O/O, content of nominlly 2% (mx l(r%) nd t pressure of20br. produce gs mixture with OlOj content loppm nd t pressure of 40hr. The model ws produced on the ssumption (ht the plnt-section ws not yet fully designed nd (ht less informtion ws vilble (hn is ctully given in (he 53

55 P&I digrm of Figure Bl. Since the section flls roughly into two stges: ethntion nd ompression, these were chosen s the two initil ethods. Alterntively, three ethods could hve been chosen: ethntion; Wter removl; nd ompression. To these two ethods, two more stndrd ethods were dded: Support the opertion nd nge the opertion, nd two stndrd onstrints: Protect the plntfromthe environment nd Protect the environmentfromthe plnt. The model ws then expnded, item by item, to level tht ws felt to be resonble for n erly stge of plnt design. Note tht, though it ppers s ethod 4, nge the opertion hs not been expnded; this decision ws mde for two resons: Firstly, this is section of plnt nd no informtion is vilble s to the overll mngement structure. ertinly, one could hve been creted but it ws felt tht this would be rther rtificil exercise. Secondly, the exmple in Appendix A trets this spect t some length nd, since it ws difficult to imgine tht the mngement of continuous plnt would be rdiclly different from one devoted to btch processes, n elborte tretment of mngement would be repetitious. It hs lredy been remrked (prgrph 5.3, bove) tht substntil repetition of the sme hzrds occurs during this kind of nlysis; it is interesting to note tht there is evidence for this in the construction of the model, even before hzrd identifiction hs begun. For exmple, ethod 3, Support the opertion, includes the sub-ethod 3.6, Security, s prt of the suggested stndrd expnsion; however, onstrint 6, Protect plnt from the environment, contins the sub-ethod 6.4, Protect ginst unuthorised ccess to plnt. lerly these requirements overlp nd it is probble tht other res of overlp could be identified. While the nturl tendency is to eliminte such dupliction, it is felt tht things should be left s they re for the moment until more experience hs been gined. lerly, however, the existence of such duplictes offers useful cross-check ginst ccidentlly omitting function. Note tht in the subsequent nlysis, the sub-ethod 3.6, Security, hs not been developed becuse the necessry informtion occurs lower down t sub-ethod 6.4, Protect ginst unuthorised ccess to plnt; this ws done merely to sve spce. B.4 Hzrd nlysis of the functionl model As recommended in the description of the method (prgrph 4, bove) the HA process of hzrd identifiction ws pplied bouom-up; i.e. strting, literlly, t Intent 12.0 on the nlysis form. Keywords were tken from the list given in n erlier report [Anon., 1993], supplemented by the keywords NOT, for every stge of the model, nd TOO UH, nd TOO LITTLE where this ws felt to be pproprite. The following discussion follows the bottom-up pproch of the originl nlysis; only points of interest re elborted in detil. Functions , nd 12.0: these hve not been developed. The flowsheet does not hve sufficient informtion to nlyse these functios for hzrds; consequently they hve been left with the note: Process engineering to dvise. Function 8.0: hs been given the keyword NOT. It is known tht the purpose of this section of the plnt is to remove the oxides of cirbon which will cuse problems for the downstrem plnt. The rest of the nlysis follows from this premise. Function 7.0: n increse in oxide level leds to n increse in the exothermic rection in R-101; clerly such conr'i'.ion is hzrdous nd should be lrmed nd integrted with the existing meditor trip. Function 6.4: This shows the utility of the keywords nd of the proposed stndrd ethods. It is interesting to not tht, s well s the obvious problems of Risø-R-712(EN)

56 sbotge nd theft, the method revels the possibility of 'well-intentioned* intruders, such s the medi nd fmily members, gining ccess to the site during emergencies nd interfering with the ctivities of the emergency services. Function 6.3: hs four occurrences of the keyword EXTREE_WEATHER nd required the nlyst's imgintion to pply this keyword in such wy s to obtin useful results; suggesting tht this keyword would benefit from sub-ctegories. Functions 6.2 nd 6.1: these two stndrd ethods pper to be complementry; it my be necessry to revise them or mke very precise distinction between 'mn-mde disster' nd n 'incident in djcent plnt'. At present, the only difference seems to be one of scle. Function 6.0: s n Intent, nything recorded here would merely repet the results of the lower-level expnsions nd so it hs been left blnk. Function 5.3: it is evident tht the keyword TOXIITY ought to be pplied to the disposl of effluent; however, the P&I digrm hs no informtion on the toxicity or otherwise of spent pltinum ctlyst. In prctice, this would hve been resolved in the Substnces List, before the nlysis ws begun but constrints of time nd spce hve precluded this. However, it does underline the necessity for complete substnce list to be prepred before the nlysis is undertken nd rises the question of the scope of such list: some substnces my need to be listed in 'before nd fter' sttes. Functions nd 3.1.8: ech of these functions refers to mintennce of trip system, which, since it opertes on demnd, must be tested t frequent intervls. At this level of decomposition, none of the existing keywords would led to considertion of such test problems. However, further decomposition would (should) introduce trip system testing s sub-ethod; in which cse, keywords such s NOT nd TOO UH would revel the potentil problem. Agin, some modifiction to the keyword list seems to be indicted. In the exmple, the keyword TEST ws used, though this my not be generlly pplicble nd my be too specific to these circumstnces. The question to be resolved is, bering in mind tht TOHID is high-level nlysis method: do we expect the keyword list to led to problems t this level of detil or not? Function nd 3.1.4: gin, new keyword hs been introduced. Functions 3.1.3, -.2, -.1, nd -.0: here, by wy of illustrtion, the opposite procedure hs been dopted to tht used in Function 6.0. Becuse nlysis suggests tht, t this level of detil, Functions 3,1.1, 3.1.2, nd ll shre common hzrds, which they lso shre with through 3.1.8, it mkes sense to consolidte these hzrds into single set of sttements under the Intent, Function This highlights one spect of problem lredy identified in previous nlyses: the repetitive nture of mny of the hzrds found by this method. In this cse, the hzrds re not repetitive cross different functions (E.g. s between Functions 3.6 nd 6.4) but within Function. One wy to resolve this spect of the problem (lredy proposed in WP4, softwre specifiction) is by the use of hzrd librry which, by stting hzrds in stndrd form would llow duplictes to be redily identified by the softwre. Tht done, the user cn tke pproprite ction: where duplictes occur within function, they cn be collected nd moved up to the function's Intent; where duplictes occur cross functions, they cn be tied to the most pproprite plce nd then cross-referenced t the other plces where they occur. This leds nturlly to the concept of Specific Hzrd Dictionry, dt-bse which, nlogously to dt dictionry in softwre engineering, would list the identified hzrds ginst where they occur in the nlysis. Function 3.7: while it is known tht strt-up, nd the presence of process lines which re used only for tht purpose, constitute source of hzrds for this sys- 55

57 tern it ws felt tht the P&I digrm, s t present given, offers no informtion to llow this spect of opertion to be nlysed. onsequently, it hs been left unresolved. Function 3.6: s lredy noted, this duplictes Function 6.4 nd requires no further nlysis. Function 3.4: hs not been developed becuse no informtion yet exists s to n emergency pln for the plnt. Function 3.3: hs not been developed becuse the system is not under centrlised control nd the trip systems themselves re treted throughout the nlysis. Function nd its expnsions: these clerly form duplicte of the nlysis under onstrint 2.2 nd so hve been referenced to it, illustrting the scheme proposed bove. Functions 6 nd 5: here, the hzrds identified by the sub-functions hve been collected nd listed under ech prent functions 'onsequences'. ertinly, doing so offers person reding the nlysis the opportunity to view the hzrds without hving to red further nd s such this pproch my be dvntgeous. However, to do so in every cse would clerly result in n enormous mount of duplicted informtion. It seems possible tht the Specific Hzrd Dictionry, proposed bove under Functions nd 3.1.4, might be better solution to the problem. 56 Risø-R-712(EN)

58 (Tj) turn* OW.T R-101 ETHANATOR TRIP HK«TmmtATUU 1 - B-102 -<S> i- ø-f t <?nn - o S D-102 V / / / / sr T -»/. ATIUIIUW»V-l **- X co.cn,< r OPRESSOR TRIP LOW LUBE HL DESSU OH LEVEL IN D-I01 Di ^ srin -er >«*t IUT Qj] THOOBH WW QT] OOOUNOWAIERSUntV» ooourwa-munjin ITtNUlIR TITLX or. TOT *c or. rus wr R-101 ZTHANATOR D-102 KOKT E-IOI É-IOJ -1«BTHrREKEAT ETH.0OLER H2 OEOR I* 40 XYZDEERINO JDUOU HVDROOEN flant D-IO RfvA

59 FUNTION HAZARD IDENTIFIATION Ref T Description k Keyword in vrince onsequences itigtion Notes 0 I From hydrogen & methne gs mixture with O/0 2 content of nominlly 2% (mx 10%) nd t pressure of 20br, produce gs mixture with O/O, content loppm nd t pressure of 40br. 1 Remove O/O, 2 ompress gs to 40br 3 Support opertion 4 nge the opertion 5 Protect environment from plnt. See See Possible fire nd explosion through loss of continment. Excess flring will cuse unnecessry loss of energy, bright lights t night, etc. Risks in disposl of used ctlyst. Risk of explosion from hydrogen nd/or methne in the sewers. Noise, giving risk of disturbnce to locl popultion nd longterm hering dmge to plnt personnel. See See

60 FUNTION HAZARD IDENTIFIATION Ret T Description k Keyword in vrince onsequences itigtion Notes 6 Protect plnt from environment See See Impct from vehicles, leding to relese of flmmbles. Externl threts from explosion, Tire, toxic relese, nd contminting mteril. Environmentl threts from high winds, freezing of entrpped wter, brittle frcture of metls, etc. Plnt t risk from deliberte or ccidentl intruders. tlyst is vluble nd theft of ctlyst is possible during (un)loding opertions or when ctlyst is stored t site which my encourge intruders. See See Inlet O/O, content <, 10% 8 9 c Outlet O/Oj content loppm Inlet pressure 20 br

61 FUNTION HAZARD IDENTIFIATION ReT T Description k Keyword in vrince onsequences itigtion Notes 10 Outlet pressure 40 br 11 Inlet temperture tbd 12 Outlet temperture tbd 1.0 I Remove O/Oj 1.1 onversion of O/O, to methne nd wter by ctlytic rection. See See See See See Remove liquid wter (s entrined droplets) See See See See See onvert O/O s to methne nd wter by ctlytic rection Het inlet strem by het-exchnger E-101 See See See See See 1.1, Rect over ctlyst in rector R-101 b NOT TOO UH No rection. Runwy rection. See 8.0 See See 8.0 See See 8.0 See ool outlet strem by het-exchnger E-101 b NOT NOT Overheted gs, exit R- 101 Under heted gs, inlet R-101 Extr duty required of E-102 nd D-102. Rection in R-101 my not tke plce or proceed to completion, leding to off-spec product to down-strem plnt. See 8.0 Process engineering to dvise.

62 FUNTION HAZARD IDENTIFIATION Rcf T Description k Keyword in vrince onsequences itigtion Notes Prevent runwy of exothermic rection in R-101 NOT Runwy exothermic rection in R-101. tstrophic filure of rector vessel, leding to relese of flmmbles nd probble explosion. ethntor trip system. Evidence suggests tht monitoring the rector outlet temperture will not provide rpid enough response for trip, nor will it detect hot-spots in the ctlyst beds. Suggest trip system is revised to mesure individul bed temps I Remove wter ool inlet strem by het exchnger E-102 NOT See 2.2. See 2.2. See 2.2. See Seprte wter from gs by grvity in KOpotD-102 NOT See 2.2. See 2.2. See 2.2. See Dischrge wter to sewer b NOT TOO UH See 2.2. See 5.3. See 2.2. See 5.3.c See 2.2. See 5.3.c See 2.2. See intin wter sel in D-102 to prevent gs entering sewer. NOT Loss of wter sel. See 5.3.c See 5.3.c See ompress gs to 40br 2.1 ompress gs in reciprocting compressor b NOT TOO UH Low pressure t exit. High pressure t exit. Possible dmge to down-strem plnt. Pressure relief vlve fitted. Process engineering to dvise. onsider dding highpressure to comp. trip. 22 Gs to be compressed must be dry NOT Wet gs enters compressor. Severe dmge to compressor, leding to possible relese of flmmbles.

63 FUNTION HAZARD IDENTIFIATION Ref T Description k Keyword in vrince onsequences itigtion Notes Support opertion 3.1 intin process equipment See See See See See Disposl of wste b c d NOT NOT NOT NOT Fil sfely to dispose of wste gsses. Fil to sfely dispose of effluent from D-102 Fil sfely to dispose of spent ctlyst from R- 101 Fil sfely to dispose of lubricting oil from compressor Possible fire or explosion. Possible pollution nd fire or explosion from dissolved gsses. Insufficient informtion vilble on ctlyst nd its chrcteristics. 3.3 ontrol the process 3.4 nge emergencies 3.5 tlyst loding b c TOXIITY ONTAI NATION DROP tlyst my present toxic hzrd. ontminted ctlyst my cuse dverse or runwy rections. tlyst loding my involve mnipulting hevy lods t elevted sites nd in difficult conditions. Possible hrm to personnel. Possible injury to personnel. Need to review ctlyst loding/unloding procedures. Z

64 f FUNTION HAZARD IDENTIFIATION ReT T Description k Keyword in vrince onsequences itigtion Notes 3.6 Security 3.7 Strt-up the system sfely I intin process equipment b c FLAABLES TEPERATURE PRESSURE Relese of flmmbles during mintennce. Personnel fil to observe procedures for working on high temp, equipment. Personnel fil to observe procedures for working on high press, equipment. Fire, explosion. Burns to personnel. Kinetic injuries to personnel. See lso 3.5, ctlyst loding intin R-101 See intin het exchnger E-101 See intin het exchnger E-102 See intin KO-pot D- 102 b c See PROEDURE PROEDURE Filure to observe procedures leds to loss of wter sel in D-102. Filure to observe procedure leds to wter crry-over from D-102. Relese of flmmbles, fire, explosion. Dmge to downstrem compressor.

65 FUNTION HAZARD IDENTIFIATION Rer k Description k Keyword in vrince onsequences itigtion Notes intin compressor -102 b See PROEDURES Filure to observe procedures. Dmge to compressor: poss, dmge to or loss of feed to downstrem plnt. Possible injury to personnel from rotting equipment, high voltges, etc intin instrumenttion nd control systems. NOT Filure to mintin. Loss of control leding to relese of flmmbles or off-spec product intin methntor trip system b c NOT TEST TEST Filure to mintin methntor trip system Fil to test trip system t prescribed intervls. Test trip system more often thn prescribed. Premture filure of trip system, with either spurious shutdown or loss of protection. Possibility of dormnt filures. Incresed exposure to rel trip during test intin compressor trip system b c NOT TEST TEST Filure to mintin compressor trip system Fil to test trip system t prescribed intervls. Test trip system more often thn prescribed. Premture filure Of trip system, with either spurious shutdown or loss of protection. Possibility of dormnt filures. Incresed exposure to rel trip during test. None.

66 * FUNTION HAZARD IDENTIFIATION i? tn Z Rer 5.0 T I Description Protect environment from plnt. k Keyword in vrince onsequences itigtion Notts BH 5.1 ontin process fluids NOT Flmmble gs relesed to tmosphere. Possible fire nd explosion. intin stndrds of construction by regulr inspections nd preventive mintennce. onsider gs detectors nd wter sprys t criticl loctions. 5.2 Avoid relese of process mterils. NOT Relese flmmble mterils to flre, where they re burned. Unnecessry loss of energy, bright lights t night, etc. onsider use of offspec gs s fuel. 5.3 Ensure sfe effluent disposl b c NOT TOXIITY FLAABLES Fil to ensure sfe disposl of effluent which my be toxic or flmmble. Fil to ensure sfe disposl of liquid drining from D-102 which will contin dissolved hydrogen nd methne. Hydrogen nd/or methne will be liberted in the sewers, where it my be trnsported considerble distnces before reching source of ignition. Instll gs detectors nd forced ventiltion system with sfe disposl of liberted gsses, Need to determine whether spent ctlyst or mterils crried forwrd from upstrem plnt re toxic. onsider second vessel t ner tmospheric pressure, where gsses my be sfely liberted nd disposed of before effluent is trnsferred to the sewer.» m