8 Process Equipment Integrity

Transcription

1 8 Process Equipment Integrity 8.1. OVERVIEW Management systems are essential to a process safety program to ensure that all process equipment is fabricated and installed in accordance with design specifications. A documented file should be maintained for all equipment, including initial equipment and any new or replaced equipment. A significant number of losses in the chemical industry are partially attributable to improperly maintained or replaced equipment or to newly installed equipment that does not meet required codes or standards. The management system should include measures that train line managers to fully understand the equipment design specifications so that they can be sure it is properly operated and maintained. For example, line managers should be aware of areas that are electrically classified, the location of underground piping, and interlock systems; and, most importantly, they should know where in the plant to find this information Scope This chapter provides examples of plant management systems designed to make certain that plant employees who have direct responsibility take the necessary precautions so that design criteria and specifications are not compromised. The examples in these guidelines cover maintenance, testing, fabrication, and instrumentation pertaining to piping, vessels, and equipment in the handling of toxic, reactive, and combustible flammable materials.

2 Control of plant design modifications is important to prevent the accidental use of improper materials or equipment. Even with the intent to "replace in kind," replacement with something different may occur. This probably occurs most commonly with substitutions in material of construction in which the different material has essentially the same appearance as the original. Examples are bolts of different materials; some gaskets; O-rings; and instrumentation, such as a differential pressure transmitter, which must have specific materials within it. As a minimum, an effective system should identify those who must be involved, from the person who plans a maintenance job and orders materials through the warehouse where the materials are stored, to the maintenance personnel who request and install equipment. (See Chapter 7, "Management of Change," for other examples relating to control of equipment or facility changes.) Staffing or Resources Process and equipment integrity requires the commitment of management to ensure that individuals with the proper expertise are given the responsibility, authority, and time to prevent premature malfunction of equipment that could release hazardous materials. Specific resources and staffing needs will be covered in the following subsections of this chapter RELIABILITY ENGINEERING The objective of a reliability engineering program is to prevent occurrence of a safety incident by identifying equipment that is critical to process safety and to establish a management system that is capable of predicting failure or malfunction. Reliability engineering is essentially proactive management in its truest sense. Resources should include individuals with knowledge of operations, maintenance engineering, process safety, and plant stores MATERIALS OF CONSTRUCTION This section covers the choice of materials for new installations and for repair of existing equipment. A management system to track the materials from purchasing request through installation and testing is essential and is depicted in the flowchart below.

3 Construction Request Job Design Design Review Project/MCN Design Package (1) Initiator of work designates PMI in the title and/or description of the job. (2) Specify proper materials of construction and inspection requirements (verification). Document exceptions approved by area supervisor and metallurgist. The person responsible for each job must give vendors, fabricators, etc., all the appropriate information and specifications required at the start of the job. Special tests/procedures and tests reports, if needed, must be requested, and responsibility for each phase must be assigned. Special tests may include chemical composition with mill certifications, tensile and Charpy impact tests, radiographic tests, etc. A materials consultant should be contacted when needed. (3) Purchase orders designated PMI and state "no substitutes for specified material of construction 1 ': specify proper material of construction: and detail certifications, markings, color coding analytical verifications, special handling at receiving, etc., required. (4) Documentation checked. Analysis done as defined by area, and documented and tagged. Procurement of Equipment and Materials Work Orders Purchasing Fabrication Receiving Installation Storage Field Hazards Review Job Closing Job Flowchart for tracking material. ("Positive Material Identification" or "PMI")

4 For proper control of materials of construction, it is necessary to employ a management system that guarantees that critical equipment is subjected to proper selection and that documented inspections are maintained. Specialists may be needed, such as metallurgists, civil engineers, electrical engineers, etc. Appendix 8A is an example of a management system that reduces the possibility of using improper materials FABRICATION AND INSPECTION PROCEDURES Fabrication and installation of critical equipment handling hazardous materials can be accomplished by plant personnel or often by outside vendors or contractors. In either case, a management system should be implemented that includes a mechanism to verify that the work being performed meets the required specifications. Specifications may include dimensions, materials of construction, welding techniques, etc INSTALLATION PROCEDURES A management system should have a program to verify that the installation of critical equipment meets all the specifications. Qualified personnel must be assigned during installation stages to perform visual inspections to be sure that design criteria and specifications are not being compromised. A procedure should be established for the testing of installed equipment, verifying that it is ready for safe operation. A documented file should be permanently maintained with appropriate sign-offs PREVENTIVE MAINTENANCE Planned tests and inspections of critical equipment are essential to a sound process safety program. The primary objective of a preventive maintenance program is to minimize or avoid premature failure. Therefore, a management system should include a listing of critical equipment, frequency of inspection or testing, detailed maintenance procedures, and a documented file to assure the procedures are being implemented. See Appendix 8B for an example of one plant's procedures for testing and inspection of equipment.

5 8.7. PROCESS HARDWARE AND SYSTEMS INSPECTIONS AND TESTING A management system such as the plant example depicted in Appendix 8C is needed to verify by field inspection and/or testing that all items previously identified in hazard and design reviews are in operable condition. These verifications should be conducted prior to start-up and before hazardous materials are introduced into the process. They should also be conducted at periodic intervals to ensure proper functioning of critical items, such as interlocks, purges, etc. Resources to conduct these verifications should include personnel with expertise or knowledge of the following areas: the design criteria, operations or process emergency procedures, maintenance, construction, and other disciplines or resources as may be needed. (See Appendix 8G which is a table of contents of the Fixed Equipment Inspection Guide published by the Chemical Manufacturers Association MAINTENANCE PROCEDURES Written maintenance procedures as well as a training program (including skills training and knowledge of process) are needed for maintenance of equipment piping or vessels in which hazardous materials are being processed. These procedures must address two potentially serious conditions: Creation of a hazardous condition after start-up as a result of an improper repair or preventive maintenance procedure. Creation of a hazardous condition during the course of repair or preventive maintenance. In both cases, work permits that require special procedures to be followed are needed to be certain that all the hazards have been identified and proper precautions are taken to avoid them, as shown in Appendix 8D. A maintenance procedure or program requires that a management system be implemented, including accountability, documentation, and feedback mechanisms. An example of a management system pertaining to the testing and inspection of safety relief devices is shown in Appendix 8E. The same management principles covered in this program are applicable to all hazardous maintenance procedures ALARM AND INSTRUMENT MANAGEMENT Critical operating parameters are usually controlled through alarms and shutoff devices and systems. It is therefore essential that a management system

6 be in place to assure that catastrophic events are avoided. A well-defined set of definitions and rules must be established and communicated to all employees. Adequate training programs should be provided so that there is no confusion concerning maintenance of the integrity of alarms, interlocks, and shutdown systems. Appendix 8F is an example of a plant's management system for critical and unique safety features DECOMMISSIONING AND DEMOLITION PROCEDURES A management system is needed when equipment is "mothballed" in place for extended periods of time or is razed. In either event, procedures are necessary to ensure that all the hazardous materials have been safely removed. In some cases, decontamination procedures may be needed to restore safe operation of mothballed equipment or to decommission equipment. In all cases, a documented sign-off by knowledgeable individuals should be required to establish adequate accountability and to avoid any unsafe conditions.

7 Appendix 8A Example of Plant Management System for Materials of Construction (MOC) The purpose of this procedure is to prevent equipment failures resulting from the use of improper materials. The guidelines herein apply to all process systems in this plant where the materials of construction (MOC) are deemed critical to safe operation. L POLICIES A. Only specified materials shall be used in the fabrication and repair of critical MOC systems. B. The alloy and/or composition of material(s) (gaskets, o-rings, etc.) of all critical MOC shall be tested and/or visually inspected to verify composition prior to installation. C. Personnel performing tests and/or inspections to verify the composition of materials of construction shall be qualified to perform the work. D. Departments with primary responsibility for specifying, inspecting, and installing materials in critical MOC systems shall provide and maintain departmental procedures/guidelines in accordance with standards defined in Section II. II. STANDARDS A. Production Department 1. Critical MOC for all piping and equipment within the department are identified, documented, and the information made accessible to department personnel and service groups. 2. Procedures for verification testing and inspection of materials for all critical MOC within the department are accessible to personnel. 3. Components of critical MOC systems installed by production personnel are tested and/or visually checked to verify the proper alloy or composition of material prior to installation. 4. Work requests for repairs, revisions, and engineering projects identify critical MOC. 5. Instructions for testing are prepared for each requisition involving the purchase of critical MOC. B. Maintenance Department 1. Procedures for the verification testing and inspection of materials for all critical MOC are accessible to personnel. 2. Components of critical MOC systems are tested and/or visually checked to verify the proper alloy or composition of material prior to installation. 3. Critical MOC and testing procedures are provided for all repair work and fabricated items.

8 C. Engineering Department 1. Verification test procedures for all plant critical MOC alloys are provided and accessible to functional groups. 2. Critical MOC and verification test procedures are specified and documented on all engineering projects and are reviewed as part of the engineering design safety review. 3. Services for the testing of exotic metals are provided on request. D. Materials Department Stainless steel and special alloy pipe, pipe fittings, tubing, shapes, plates and valve trim are randomly checked and tagged for correct MOC when shipments are received. E. Construction Department Components of critical MOC systems are tested and/or visually checked to verify the proper alloy or composition of material prior to installation.

9 Appendix 8B Example of Test and Inspection of Equipment and Procedures The purpose of these procedures is to ensure the operational safety, protection of the environment, and integrity of plant equipment. These procedures are applicable to all classified equipment including rental equipment specified by the department manager. Classified equipment is defined as all equipment for which periodic test, inspection, and recordkeeping is mandatory. Classified equipment is identified within the plant's reliability maintenance listing of equipment, designated as RM-I and RM-2. (These lists are not reproduced in this book.) Priority field A consists of equipment identified in operational safety standards. (See Appendix A.) Priority field B consists of equipment in governmental regulations, plant policies, plant management directives and by the department manager. I. POLICIES A. Each item of classified equipment shall be permanently labeled with its engineering item number of otherwise identified if an engineering item number is not applicable, with the following exceptions: 1. Equipment such as hoses, ladders, etc., may be grouped by unit or area and identified only in the reliability maintenance list. 2. Individual components of instruments loops may be grouped under a single instrument loop identification. B. Each item (or grouping) of classified equipment shall be identified within the reliability maintenance list as either priority A, B, or C. C. Procedure guidelines for the testing and inspection of each type of classified equipment shall be maintained. D. All classified equipment shall be tested and inspected by qualified personnel in accordance with the minimum schedules listed in Appendices A and B. E. Records of testing and inspection performed and deficiencies noted shall be entered into the RM-2 system by the group performing the testing and inspection, with the following exception: For items that receive testing and inspection at intervals more frequent than 6 months, records may be retained for a minimum of one year on written logs or checksheets. F. Visual verification of testing and inspection performed shall be provided for equipment listed in Appendix C. G. Status and forward forecast reporting shall be provided according to the standards listed in Section II. IL STANDARDS A. Forward forecast reporting. 1. Issued monthly to the department manager.

10 2. Lists equipment due for preventive maintenance in the following month and equipment overdue for preventive maintenance. B. Status reporting. 1. Issued quarterly to the department manager and assistant plant manager. 2. Lists summary of items overdue for testing by more than 20% of scheduled interval. III. ACCOUNTABILITIES A. Owning Department identified under "minimum schedules" in Appendices A and B. 1. Permanent labeling of classified equipment. 2. Identification of classified equipment within the reliability maintenance lists. 3. Scheduling of equipment preventive maintenance and adjustment of preventive maintenance frequency within the reliability maintenance system. 4. Reporting to appropriate government agencies. B. Testing Department identified under "minimum testing and inspection required" in Appendices A and B. 1. Detailed procedures/guidelines are developed and maintained for testing and inspection of classified equipment. 2. Provides qualified personnel to perform testing and inspection. 3. Enters records of testing and inspections performed and deficiencies noted into RM-2 system for classified equipment tested. 4. Provides test and inspection reports identifying deficiencies noted to the appropriate department manager and maintenance or engineering group. C. Maintenance Department 1. Maintains RM-I and RM-2 systems. 2. Issues status and forward forecasting reporting. APPENDIX A Priority A Minimum Testing and Inspection Requirements Identified in Unit Operational Safety Standards Equipment 1. Critical Instruments and Alarms 2. Critical Safety Relief Devices 3. Critical Vessels, Corrosive Service 4. Critical Vessels, Minimum testing and inspection required (Accountability) Functional Check of Each Loop Standard Relief Device Inspection External Visual Inspection Internal Visual Inspection External Visual Inspection Minimum schedule (Accountability) 1 year (Operations) History or as specified in OSS (Operations) 5 years or 1/4 remaining life (Operations) 10 years or 1/2 remaining life (Operations) 5 years or 1/4

11 APPENDIX A. Continued. Equipment Noncorrosive Service 5. Critical Pumps or Motors 6. Critical Electrical Distribution Systems 7. Other Critical Equipment Minimum testing and inspection required (Accountability) Standard Pump or Motor Inspection Standard Electrical Inspection As Specified in OSS Minimum schedule (Accountability) remaining life (Operations) History or as specified in OSS (Operations) History or as specified in OSS (Operations) History or as specified in OSS (Operations) APPENDIX B Priority B Minimum Testing and Inspection Requirements Identified in Government Regulations or Company Policies Equipment 1. Portable O 2 /Flammable Gas Meters 2. Fixed Flammable and Toxic Gas Monitors 3. Safety Relief Devices 4. Serious Instruments and Alarms 5. Overspeed Trip Device 6. Vessels, Pipes, Tanks, Thermowells, Corrosive Service 7. Vessels, Pipes, Tanks, Thermowells, Noncorrosive Service 8. Portable Ladders 9. Testing and Inspection Test Equipment 10. Chain Operated Valves Minimum Testing and Inspection Required (Accountability) Test and Calibration Test and Calibration Standard Relief Device Inspection Functional Check of Each Loop Standard External Visual Inspection Internal Visual Inspection External Visual Inspection Standard Standard Standard Minimum Schedule (Accountability) Quarterly (Operations) Quarterly (Operations) History, not to exceed 5 years (Operations) Two years (Operations) 14 months (Operations) 5 years or 1/4 remaining life (Operations) 10 years or 1/2 remaining life (Operations) 5 years or 1/4 remaining life (Operations) 1 year (Operations) 1 year History, not to exceed 5 years (Operations)

12 APPENDIX B. Equipment Continued. 11. Utility, Fire, Marine Chemical Hoses 12. Temporary Service Chemical Hoses* 13. In Line Flex Hoses and Expansion Joints 14. Tank Vents and Vacuum Breakers 15. Chainfalls, Hoists and Slings 16. Monorails and OH Cranes 17. Impact Tool Accessories 18. Air Movers 19. Extension Cords, 12 Volts Lights, Flood Lights, Power Packs, Gang Plugs 20. Fall Protection Equipment 21. Fire and Safety Equipment Inside Process Units 22. Fire and Safety Equipment Outside Process Units 23. All Fire and Safety Equipment 24. Industrial Hygiene Equipment 25. Boilers 26. Industrial Lifting Equipment, includes Leased Equipment 27. Company Owned Cylinders** Minimum Testing and Inspection Required (Accountability) Standard Standard External Inspection Standard Standard Standard Standard Standard Standard Safety and Health Testing and Inspection Manual (Safety and Health Dept.) Safety and Health Testing and Inspection Manual (Shift) Safety and Health Testing and Inspection Manual (Owning Dept.) Safety and Health Testing and Inspection Manual (Safety and Health Dept.) Industrial Hygiene Manual (Safety and Health Dept.) Standards Standard Hydrotest (Stores Contract) Minimum Schedule (Accountability) 1 year (Operations) 6 months (Operations) 1 year (Operations) 1 year (Operations) 6 months (Materials) 6 months 1 year Before Issue (Materials) Before Issue Before Issue (Safety and Health) Weekly (Shift) Monthly (Owning Dept.) Per Procedure (Safety and Health Dept.) Per Procedure (Safety and Health Dept.) 1 year (Operations) Varies with Equipment (Owning Dept.) Varies by Type (Owning Dept.) "Hoses used in open dome loading are exempt if no connection exists on the open end. **Leased cylinders are hydrotested by the vendor. The using dept. has the responsibility to return the cylinder through the Material Dept. to the vendor prior to required hydrotest date.

13 APPENDIX C Priority C Testing and Inspection Requirements A. Visual verification, using the color code in B. below, is required on the following equipment: 1. Hoses tie wrap. 2. Ladders tie wrap. 3. Safety Relief Devices painted cap. B. Color codes used to visually confirm test/inspection: Color Year Green 1987 Purple 1988 White 1989 Black 1990 Blue 1991 Brown 1992 Orange 1993 C. Where six months testing is required, one tie wrap indicates first six months of the year, two tie wraps indicate second six months.

14 Appendix 8C Example of Field Inspection and Testing of Process Safety Systems SUBJECT: TO: FROM: Operators Prooftesting It is necessary to routinely prooftest critical instruments to be sure they will act in the manner required to prevent an unsafe condition in the department. These prooftests are set up for the operator to check these instruments, with the operations foreman being responsible for repairing any discrepancies and keeping records of the prooftests and repairs. The frequency of the prooftest is dependent on the frequency that the loop is called on to act and the failure rate of the device. The forms will be distributed as the prooftests are due, with the Maintenance Department being responsible for seeing that the prooftesting due dates are sent to the operations foreman. As these forms are given to the operators, they will do the prooftests according to the testing instructions in the operating manual, and return the forms to the operations foreman. The operations foreman will note any discrepancies and write appropriate work orders to repair and then date the form when the discrepancies are corrected. The form will then be filed in the operations foreman's office. These prooftests are set up to be simple and easily done during a normal shift, such as the equipment checksheets. No equipment should be shut down to run these tests. Should a prooftest be required on a piece of equipment that is running, and the test cannot be performed without shutting that equipment down, the test will be delayed until it is down. If any equipment requiring a prooftest is down for more than 24 hours, the test will be completed and discrepancies corrected before it is started up. PROOFTESTING STORAGE WATER RELATED SAFETY DEVICES DATE: OPERATOR: The purpose of this prooftest is to check the operation of the safety devices on the 110 storage tank used to prevent air from entering the tank. This test will check the operation of the safety valves, pump shutdown, pneumatic valve operation, N 2 valve operation, and all water related alarms.

15 1. There cannot be any loading or transferring of material from any storage tank. 2. Lift each cover on the two safety valves to assure free operation. They should lift smoothly and fall freely. 3. Put the air switch on the loading pneumatic valves in the open position. 4. Start the 110 storage tank circulating. 5. Close the H 2 O block valve at the H 2 O level control valve. This will shut off the H 2 O flow to the tank and trigger the shutdown switches. Did the: YES NO A. N 2 valve open? B. Pump shut down? C. Pump off alarm come on? D. Low H 2 O overflow alarm come on? E. Low H 2 O level alarm come on? F. Pneumatic valves close? G. Safety valves lift? 6. Open the H 2 O block valve slowly until the H 2 O controller starts controlling the level again, then open it wide. Did the: YES NO A. N 2 valve close? B. Low H 2 O level alarm clear? C. Low H 2 O overflow alarm clear? D. Safety valves reseat? E. Pneumatic valves reopen? 7. Restart the loading pump to circulate 110 storage. Did the: YES NO A. Loading pump restart? B. Load pump on alarm come on? 8. Return this form to the operations foreman. PROOFTESTING 106A AND 106B STORAGE TANK HIGH LEVEL ALARMS DATE: OPERATOR: TANK BEING PROOFTESTED: The purpose of this prooftest is to check the operation of the high level alarm on 106A or 106B storage tanks. 1. The level should be about 5 feet. 2. No product can be going into the tank and no transfers can be made from the tank during this test, except as noted. 3. Using gasoline indicator and a tank measuring tape, measure the level in the tank through the safety valve cover.

16 TAPE MEASUREMENT FLOAT READING COMPUTER READING A. Is the measurement within 6 inches of the float indicator? B. Is the measurement within 6 inches of the computer indication? 4. Pull the level indicator down about 1 foot and release it. It should return to the previous level indication within about 2 inches. 5. Pull the level indicator down to where the alarm switch is activated, then release it. Did the: YES NO A. High level alarm sound? B. High level alarm clear when the indicator was released? C. Indicator return to the previous measurement? 6. Reset the high level alarm on the computer to 1 foot above the actual level in the tank. Start product going into the tank. When the level increases 1 foot, did the computer alarm sound? 7. Reset the high level alarm on the computer to the original value. Normal alarm points are 3' for low level and 13' for high level. 8. Return this form to the operations foreman. PROOFTESTING THE TANK CAR HIGH LEVEL ALARM AND SHUTOFF VALVE This prooftest will check the operation of the safety devices at tank car loading. 1. There can be no loading or transferring operations being performed. 2. Open the drain on the collection tank and drain it completely empty. 3. Determine the pressure on the supply water being used for the test. 4. Install a pressure gauge on the float chamber inlet line. 5. Have the CS 2 purification operator start 110 storage tank circulation. 6. Hook up the H 2 O supply to the vent line and open slowly to fill the float chamber with H 2 O. 7. Note the pressure on the gauge. 8. While leaving the H 2 O supply on, check the following: A. Did the high level alarm sound? B. What was the H 2 O supply pressure? C. What was the pressure on the float chamber after 5 minutes? D. Did any H 2 O come out the drain at the collection tank? 9. Push the loading rack loading pump stop button. Did the: YES NO A. Loading pump shut down? B. Loading pump off alarm come on? C. Pneumatic valves close? 10. Disconnect the H 2 O supply and drain the lines and float chamber.

17 11. Hook up N 2 to the line and purge through the system and out the collection tank to clear out all H 2 O. 12. Close the drain line on the collection tank. 13. Notify the purification operator that the prooftest is complete. 14. Return this form to the operations foreman. PROOFTESTING FURNACE METHANE PRESSURE SWITCHES AND SHUTOFF VALVES DATE: OPERATOR: SHIFT: FURNACE BEING PROOFTESTED: This prooftest is designed to test the operation of the high and low methane pressure switches and the double block and bleed valves. 1. The furnace must be down with the fuel gas block valve shut at the header. 2. Bleed all pressure off the manifold and piping downstream of the header block valve by opening the bleed at each of the pressure switches. When completed close the two bleeds. 3. Hook up a N 2 supply hose from the plant N 2 Header to the 1" Durco cock just upstream of the Maxon valve and pressure the fuel gas line to 45 psig. Could you open the Maxon valve? 4. Slowly bleed the N 2 pressure off the fuel gas line at the low pressure switch bleed on the downstream side of the Maxon valve, until the Maxon valve closes. At what pressure did the Maxon valve trip? 5. Pressure up the fuel gas line again with N 2 to 45 psig. Open the Maxon valve. Increase the pressure until the Maxon valve closes. This will check the pressure switch on the upstream side of the Maxon valve. At what pressure did the Maxon valve trip? 6. Disconnect the N 2 supply hose, close and plug all three bleeds. 7. Open the fuel gas header block valve to repressurize the fuel gas line and put the fuel system back in service. 8. Return this form to the operations foreman.

18 Appendix 8D Example of a Hot Work Permit I. POLICY Hot work will be done only after evaluation and the issuing of a hot work permit. This permit is valid for only one shift and must be renewed at shift change if work extends beyond one shift, II. SCOPE This standard covers the responsibilities for planning, issuing a permit, and maintaining safe working conditions for jobs requiring hot work. III. DEFINITIONS Hot work is any work that may generate a source of ignition in areas where flammable or combustible materials may be present. Welding, flame cutting, use of pneumatic hammers, and spark-producing equipment are examples of this type of work. IV. RESPONSIBILITY A. The owner or designee in charge of the facility where hot work is to be done is responsible for: 1. Preparing the area for hot work. 2. Performing or requesting an explosimeter check if necessary. Operator of explosimeter must be certain that the meter is calibrated, that it functions properly, and must have a current certificate of training (3-year validation). 3. Issuing the hot work permit in duplicate. 4. Cosigning the hot work permit for work to be done along a plant right-of-way for reasons stated in Section V. 5. Notifying the supervisor or representative responsible for the performance of hot work of the nature of the hazards involved and precautions to follow for the safe execution of the work. 6. Maintaining the safe conditions on which the permit is based. 7. Suspending the permit if these conditions cannot be maintained. 8. Reissuing a permit when safe conditions are established following a suspended permit. 9. Establishing a fire watch if necessary. B. The person in charge of doing the work is responsible for: 1. Conferring with the owner or designee to be sure the area is prepared for the safe

19 performance of hot work. Considerations should be given to hazardous operations in the surrounding area. 2. Determining that a permit will be issued immediately before work begins. 3. Ensuring that the employee(s) who will do hot work has the protective equipment required and is aware of the possible hazards of the area. 4. Notifying the owner or designee when hot work is completed. C. Each person actually doing hot work is responsible for: 1. Reviewing the hazards of the work area with the owner or designee and/or the supervisor. 2. Cosigning the hot work permit. 3. Reporting any changes in conditions that affect the safety of the area. 4. Suspending all hot work during an "alert" signal. 5. Requesting that a hot work permit be reissued following work suspension due to an "alert" or changing conditions. 6. Notifying his or her representative when the hot work has been completed. V. ADMINISTRATIVE PROCEDURES 1. Plant Right-of-Ways The owner and/or designee shall survey the area of work prior to issuing each hot work permit. They should consider all overhead lines and sewers in the work area for potential hazards. They should also give consideration to hazardous operations in the surrounding area. They shall get the hot work permit cosigned by the "owner" of adjacent property. This cosigning (a) acknowledges the presence of the contractor or service unit in the cosigner's yard, and (b) certifies that the cosigner will not do anything to adversely affect the contractor or service unit and vice versa. The owner or designee shall notify all cosigners when the job has been completed or delayed so that production operations can proceed normally. 2. Permit Form Hot work permit books are available from stock. See the example hot work form printed on page Exceptions Supervision may authorize hot work in established shops without a hot work permit. However, previously used equipment brought into shops must be checked for flammable materials. Combustion engines may be operated on established plant roads and parking lots under normal working conditions without a hot work permit.

20 HOT WORK PERMIT TAG HOT WORK PERMIT REQUIRED FOR WELDING, CUTTING, BURNING OR OTHER HOT WORK IN ANY LOCATION OTHER THAN ESTABLISHED SHOPS. THIS PERMIT TO BE ISSUED ONLY AFTER WORK SITE HAS BEEN INSPECTED. THIS PERMIT IS SUSPENDED IN THE EVENT OF PLANT ALERT OR EVACUATION. DATE I FROM A.M. I TO AJIVl I WORK AREA P.M. P.M. JOB DESCRIPTION SITE PREPARATION 1. Equipment Preparation Steamed [ ] Washed [ ] Purged with 2. Has equipment been checked for linings, deposits, or pockets that could be flammable, corrosive, or toxic? [ ] Yes [ ] No 3. Explosimeter check performed? If yes: Time area was checked Name of person who made check 4. Have hazards of nearby areas been checked? Other Floor Levels [ ] Yes [ ] No Sewers [ ] Yes [ ] No Neighboring Bldgs. [ ] Yes [ ] No Other Equipment [ ] Yes [ ] No Radiation [ ] Yes [ ] No Welding Machines [ ] Yes [ ] No Properly Grounded SAFETY EQUIPMENT 5. Protective equipment needed Fire Protection [ ] Clothing [ ] Ventilation [ ] Respirator [ ] Ear [ ] Other WORK PROCEDURES 6. Will an operating representative or fire watch be present? [ ] Yes [ ] No 7. Is a Vessel Entry Permit required? [ ] Yes [ ] No 8. Special procedures ADDITIONAL SPACE ON BACK SIGNATURE OF PERSON AUTHORIZING PERMIT DEPARTMENT OR GROUP ASSIGNED JOB SIGNATURE OF EMPLOYEES ASSIGNED TO JOB Space for additional signatures on back SAFETY STANDARD

21 Appendix 8E Example of Criteria for Test and Inspection of Safety Relief Devices The following criteria were developed to provide a minimum standard for a test and inspection program, to assure that safety relief devices are maintained,in a reliable condition, in compliance with company standards and other applicable regulatory agencies. The criteria are intended to provide location personnel with procedural and guideline information sufficient for the development of local procedures and/or regulations and sufficient to do the work intended. The following safety relief devices are included in this criteria: Safety Valve Direct Spring Loaded Safety Valve Pilot Operated Rupture Disks Control Loop/Manual Actuated Emergency Vent Devices Weight Loaded Conservation and Emergency Vents Explosion Vents SAFETY VALVES-DIRECT SPRING LOADED I. Accountability The location test and inspection program identifies the ownership of the relief devices, specifies responsibilities for test and inspection, and provides for auditing of the program. IL Inspections A. Installation At installation or later rearrangement, an inspection is made to assure that the correct safety valve is installed and oriented properly. B. Monthly for Block Valves Approximately monthly, block valves isolating safety relief valves are inspected to assure that they are sealed in the open position. C. Six Weeks for Leak Monitoring Safety valves having pressure gauges or remote pressure indication systems (installed to monitor for leakage through the bellows, or to detect pressure buildup between the safety valve and a rupture disk at either its inlet or outlet) are inspected to ensure operability of the leakage detection system. Installations employing purge gas or liquid to protect the safety valve (or safety valve with rupture disk) from corrosion or pluggage are inspected to ensure integrity of the purge system.

22 D. Quarterly for Safety Valve Leakage Inspections are recommended to determine if installed safety valves give indication of leakage. Particular attention is paid to installations where the relief capacity could be disabled by leakage (such as plugging), and where vibration or pulsating loads create a high potential for leakage. III. Testing A. Reliability Maintenance Testing of the relief point of safety valves is to be performed using a test system which has been certified, and periodically rechecked, to be of satisfactory accuracy. B. Test Interval Selection Typical test frequencies are as follows: 1. Liquids: a. Significant exposure consequences 1 year or less b. Residue fouling 1 year or less c. Corrosive (depending on material of construction) 1-2 years d. Nonresidue clean 2 years e. Relief valve protected by rupture disk 1 With knife blade 1-2 years Without knife blade 3-5 years 2. Gases: a. Dirty or corrosive 1 year b. Moderately clean 2 years c. Clean, dry, and noncorrosive 3 years 3. Water and Steam (except as regulated by law 2 years) Initial test intervals will be chosen based on previous experience, or best judgment, considering safety valve type and service characteristics, but should not exceed 2 years. Safety valves that operate frequently may be subjected to mechanical damage and require short test intervals to reduce fluid loss. Safety valves with elastomeric seals should have a maximum interval of 2 years between seal replacement. Safety valves which are found to be plugged, frozen shut, corroded, or having drifted ±10% away from set pressure should have the interval between tests reduced. Conversely, valves which are found free of fouling and other functional problems can have the interval between tests extended, not to exceed 5 years. C. Identification All safety valves shall be stamped or tagged with a legible identifying code number, individual to each valve, to minimize the potential for error during handling and testing. Bellows type valves should be coded additionally to make them readily identifiable. 1 AIsO test when rupture disk is serviced.

23 D. Servicing Criteria 1. Bench Testing and Repair. Bench testing and repair servicing of safety valves shall include: a. Determine "as received" opening pressure (by bench test). Note: Slowdown settings must be changed to accommodate small volumes of test stands. b. Disassemble and clean as necessary. c. Inspect parts for wear, cracks, or other damage. d. Relap seat and disk as required. e. Reassemble with parts replacement as necessasry. f. "Lifting lever" operational check (at 75% of set pressure) for safety valves in air, steam, or hot water service. (Lifting lever stem packing required in hot water service.) g. Set pressure resetting and verification. Tolerance not to exceed ±2psi up to 70 psig setting and 3% above 70 psig. h. Reposition blowdown rings, when changed to accommodate bench testing, per manufacturers' specifications. i. "Bubble tight" leak test, dependent on criticality of service, j. Leak test the valve body and bellows on bellows equipped safety valves by applying pneumatic pressure via the discharge port. Valve body and bellows must be leak tight. k. Restamp nameplate, when capacity/set pressure change involving spring replacement is made. 1. Provide supplemental identification on bellows type valves, m. Color code serviced valves to indicate last service date, n. Apply seals to spring setting and blowdown mechanisms, o. Document "as received" condition of the valve and the service work done, p. Revise as necessary, with U/A of owning department, test and inspection frequency based on "as received" condition, q. Verify service, location, and process as shown on safety valve records. Note: Problem valve should be reported to the accountable operating department for investigation and corrective action. 2. Testing in Place. Safety valves may be tested in place (field tested) only every other time. They must be bench tested at least every other occasion on the test and inspection frequency cycle. Note: The elastometric and/or plastic parts are to be replaced at least every 2 years. When pilot operated valves are tested in place, the test arrangement should allow the relief valve to be blocked in during the test and the pilot and main vaive assemblies to be tested as an integral operating unit. E. Servicing Personnel Only qualified (trained) personnel shall be allowed to service safety valves when repair or resetting is deemed necessary following testing. Spring changes, or other actions that would change the performance of a valve, shall be performed or supervised by an individual certified by the manufacturer of the valve to repair and reset the model safety valve. Note: "Qualified" means trained to a level that satisfies standards established by individual

24 locations. ''Certified" means trained by the valve manufacturer and given a certificate for work on specific types of safety valves, per the ASME Boiler and Pressure Vessel Code. IV. Records A. Installation Records of safety valve installations shall be maintained, and may be part of the Test and Servicing Records. They shall include: 1. installation schematics or flow diagrams, 2. sizing basis and data (calculations), 3. dates of installation and/or rearrangements. B. Inspection Records verifying inspections should be maintained for a period of at least the two previous inspections (or a minimum of 6 months). C. Test and Servicing Safety valve service/test records shall be maintained for the life of the valve in complete and updated form. They shall include: 1. Process ID or other identifying number. 2. Service/equipment description. 3. Location description (or provide installation schematic). 4. Contacting fluid identify. 5. Manufacturer's name and shop no. or serial no. 6. Spring number and orifice size. 7. Size/model no./style/type/connection sizes, and service class. 8. Materials of construction. 9. Operating temperature and pressure. 10. Set pressure and considerations for back pressure and temperature compensation. 11. Data of installation in current service. 12. Service history: a. "As received" condition of safety valve. b. Work done on valve. c. Testing frequency changes recommended to owning department. 13. Last test and next test dates. 14. Testing frequency. D. Reports Periodic status reports of the safety valve testing program shall be provided to appropriate facility managers. Periodic exceptions reports shall be provided to appropriate facility and location managers. The reports will indicate the safety valves that are past due the scheduled test dates by time period, such as 6 months overdue; by frequency, such as past due two consecutive test dates; or by percent of normal test interval overdue.

25 SAFETY VALVES-PILOT OPERATED I. Accountability The location test and inspection program identifies the ownership of pilot operated relief devices, specifies responsibilities for test and inspection, and provides for auditing of the program. II. Inspections A. Installation At the initial installation, or later rearrangement, an inspection is made to assure that the correct pilot operated safety valve is installed and oriented properly. B. Monthly for Block Valves Approximately monthly, block valves isolating pilot operated safety valves are inspected to assure that they are sealed in the open position. C. Monthly for Safety Valve Leakage At the same time that isolating valves at pilot operated relief devices are inspected to ensure that they are sealed open, the safety valve is to be visually inspected for indications of leakage to the atmosphere. Particular attention should be paid to installations where vibration, pulsating loads, or other circumstances might subject the relief valve to a high potential for leakage. The pilot valve vent port is inspected to ensure that it is open to the atmosphere and protected by a vent screen from plugging. Also, the strainer or filter in the pressure sensing line, if used, is checked to ensure that it it not plugged. Installations employing purge gas or liquid to protect the pilot operated safety valve from corrosion or pluggage are inspected to ensure integrity of the purge system. III. Testing A. Reliability Maintenance Testing of the relief point of pilot operated safety valves is to be performed using a test system which has been certified, and periodically rechecked, to be of satisfactory accuracy. B. Test Interval Selection Typical test frequencies are as follows: 1. Chemicals: a. Significant exposure consequences 1 year or less b. Nonresidue clean 2 years 2. Gases: a. Moderately clean 1 year b. Clean, dry and noncorrosive 2 years Initial test intervals will be chosen based on previous experience, or best judgment, considering safety valve type and service characteristics, but should not exceed 2 years. Since pilot operated valves are limited to use in clean vapor or gas service, an initial test frequency interval of!5 to 2 years is typically selected.

26 Pilot operated valves that operate frequently may be subjected to mechanical damage and require short test intervals to reduce fluid loss. Pilot operated valves have elastomeric seats and seals, and should have a maximum interval of 2 years between parts replacement. Safety valves which are found to be plugged, frozen shut, corroded, or having drifted ±5% away from set pressure should have the interval between tests reduced. Conversely, valves which are found free of fouling and other functional problems can have the interval between tests extended, not to exceed 2 years. C. Identification All pilot operated safety valves shall be stamped or tagged with a legible identifying code number, individual to each valve, to minimize the potential for error during handling and testing. D. Servicing Criteria 1. Bench Testing and Repair. Bench testing and repair servicing of pilot operated safety valves shall include: a. Determine "as received" opening pressure (by bench test). Note: Slowdown adjustment must be changed to accommodate small volumes of test stands. b. Disassemble and clean as necessary. c. Inspect parts for wear, cracks, or other damage. d. Relap seat and disk as required. e. Reassemble with parts replacement as necessary. f. Set pressure resetting and verification. Tolerance not to exceed ±2 psi up to 70 psig setting and 3% above 70 psig. g. Reposition blowdown adjustments, when changed to accommodate bench or field testing, per manufacturers' specifications. h. "Bubble tight" leak test, dependent on criticality of service, i. Restamp nameplate, when capacity/set pressure change involving spring replacement is made. j. Color code serviced valves to indicate last service date. k. Apply seals to spring setting and blowdown mechanisms. 1. Document "as received" condition of the valve, including condition of elastomeric and/or plastic parts, and the service work done. m. Revise as necessary, with U/A of owning department, test and inspection frequency based on "as received" condition. n. Verify service, location, and process as shown on safety valve records. Note: Problem valves should be reported to the accountable operating department for investigation and corrective action. 2. Testing in Place. Pilot operated safety valves may be tested in place (field tested) only every other time. They must be bench tested at least every other occasion on the test and inspection frequency cycle. Note: The elastomeric and/or plastic parts are to be replaced at least every 2 years. E. Servicing Personnel Only qualified (trained) personnel shall be allowed to service pilot operated safety valves when repair or resetting is deemed necessary following testing. Spring changes, or other actions that would change the performance of a valve, shall be performed or supervised by

27 an individual certified by the manufacturer of the valve to repair and reset that model safety valve. Note: "Qualified" means trained to a level which satisfies standards established by individual locations. "Certified" means trained by the valve manufacturer and given a certificate for work on specific types of safety valves per the ASME Boiler and Pressure Vessel Code. IV. Records A. Installation Records of pilot operated safety valve installations shall be maintained, and may be part of the Test and Servicing Records. They shall include: 1. installation schematics or flow diagrams, 2. sizing basis and data (calculations), 3. dates of installation and/or rearrangements. B. Inspection Records verifying inspections should be maintained for a period of at least the two previous inspections (or a minimum of 6 months). C. Test and Servicing Pilot operated safety valve service/test records shall be maintained for the life of the valve in complete and updated form. They shall include: 1. Process LD. or other identifying number. 2. Service/equipment description. 3. Location description (or provide installation schematic). 4. Contacting fluid identity. 5. Manufacturer's name and shop no. or serial no. 6. Spring number, orifice size, main valve and pilot valve information. 7. Size/model no./style/type/connection sizes, and service class, 8. Materials of construction, including elastomeric or plastic parts. 9. Operating temperature and pressure. 10. Set pressure and considerations for back pressure and temperature compensation. 11. Date of installation in current service. 12. Service history: a. "As received" condition of valve, including condition of elastomeric and/or plastic parts. b. Work done on valve. c. Testing frequency changes recommended to owning department. 13. Last test and next test dates. 14. Testing frequency. D. Reports Periodic status reports of the safety valve testing program shall be provided to appropriate facility managers. Periodic exceptions reports shall be provided to appropriate facility and location managers. The reports will indicate the pilot operated safety valves that are past due the

28 scheduled test dates by time period, such as 6 months overdue; by frequency, such as past due two consecutive test dates; or by percent of normal test interval overdue. RUPTURE DISKS I. Accountability The location test and inspection program identifies the ownership of the relief devices, specifies responsibilities for test and inspection, and provides for auditing of the program. II. Inspections A. Installation At installation or later rearrangement, an inspection is made to assure that the correct rupture disk is installed and oriented properly. B. Monthly for Block Valves Approximately monthly, block valves isolating rupture disks are inspected to assure that they are sealed in the open position. C. Six Weeks for Leak Monitoring Installations having pressure gauges or remote pressure indication systems (installed to detect pressure buildup between the rupture disk and a safety valve at either its inlet or outlet) are inspected to ensure operability of the leakage detection system. Installations employing purge gas or liquid to protect the rupture disk from corrosion or pluggage are inspected to ensure integrity of the purge system. III. Servicing A. Reliability Maintenance Rupture disks do not have an infinite life. Even though the materials may not be attacked by the process fluid or by the atmosphere, they are affected by pressure and/or vacuum cycles. Disks that can release toxic or explosive vapors to the atmosphere should be replaced on a regular schedule to prevent opening at less than the specified bursting pressure. B. Servicing Interval Selection Typical servicing frequencies are as follows: 1. Residue fouling service 1 year or less 2. Pulsating service near 70% rating 1 year or less 3. Toxic explosive materials 1-2 years 4. Flammable vapor cloud release 1-2 years 5. Corrosive service 1-2 years 6. Critical service operation 1-2 years 7. Nonresidue Clean 2 years 8. RB-90 (reverse buckling w/knife edge) 2 years 9. Nonhazardous service 3 years 10. Noncritical service reliability not a major concern 5 years

29 Initial servicing intervals will be chosen based on previous experience, or best judgment, considering rupture disk type and service characteristics, but should not exceed 3 years (note 2-year limit for RB-90). Rupture disks which are found to be plugged or corroded should have the interval between servicing reduced. Conversely, disks which are found free of fouling and other functional problems can have the interval between servicing extended, not to exceed 5 years. C. Identification All rupture disk assemblies shall be stamped or tagged with a legible identifying code number, individual to each assembly, to minimize the potential for error during servicing. Reverse buckling disks with knife edges should be coded additionally to make them readily identifiable. D. Servicing Criteria Rupture disk servicing shall include: 1. Inspection a. Remove safety head assembly with disk (or other rupture disk holder) from mounting. b. Inspect upstream and downstream piping at mounting location for product buildup, corrosion, or physical damage. Correct as necessary. c. Inspect rupture disk in safety head or holder for: (1) Solidified product under the disk. (Could increase burst pressure.) (2) Signs of pitting or corrosion on metal disk or the penetration of product past the plastic liner. (3) Heat discoloration. (Especially evident on plastic liners.) (4) Physical damage on occasion, dimpling of reverse buckling disks occurs (for example, by being hit with a water stream during vessel cleaning; by pressure excursions close to disk bursting pressure). (5) If knife blades are required to assist in opening of the RB-90 type disk, these should be in place and sharp. d. Reinstall only BS&B "STA-SAFE" pretorqued disk and head assembly when inspection reveals no problem. In all other cases, install a new disk. 2. Disk Replacement a. After physical inspection, install a new, exact replacement disk. The reason is that the seat of the inspected disk has been weakened by the release of the load on it. The disk burst performance will be changed by reapplying the torque a second time. b. Proper handling and installation of rupture disks are critical to their performance. Improper handling and installation can drastically affect the burst point and/or service life of rupture disks. (1) Do not open shipping container until you are ready to,install the rupture disk.

30 (2) After opening, read installation instructions before touching rupture disk. (3) Handle rupture disk by edges only. Never touch domed area. (Perspiration could begin corrosion.) (4) Examine rupture disks for damage. Never install reverse buckling disks with any visible damage to dome or sweating area. c. Inspect safety heads. Mating surfaces must be clean and free of product buildup, dirt, corrosion, etc. Clean and polish surfaces with fine emery paper. d. Do not clean the base flange with emery cloth or other abrasives in such a fashion that will damage the surface. The use of a solvent to clean deposits is recommended. Be sure to thoroughly wash the solvent off the flange. Certain chlorinated solvents may cause corrosion problems. e. Inspect the knife blades in the hold-down flange in BS&B RB-90 assemblies. They must be clean and sharp. Sharpen with a mill file or stone if required. Inspect the welds at the end of the blades. (Disk ruptures have been known to crack the blade welds.) f. Place the disk between the safety head flanges squarely and evenly. Make up the disk in the safety head flanges with the tabs or Allen screws provided. Use no gasket or sealant compound above or below the rupture disk. The disk may be received with top and bottom protective shipping covers. These are not part of the disk assembly do not install them with the disk. (Reverse buckling disks are never supplied with vacuum supports.) g. Reverse-buckling type disks furnished by one manufacturer must not be used in safety head (holder) furnished by another manufacturer. Such interchanging can severely alter the operating characteristics of the disk. h. Prebulged (conventional) type disks furnished by one manufacturer may be used in a conventional-type safety head (holder) furnished by another manufacturer only until a convenient time when the correct disk can be installed. 3. Reinstallation a. Install safety head in companion flanges carefully, and inspect safety head flow arrows to assure "right side up" installation. b. Reverse-buckling type disk holders shall be installed with a spiral wound gasket(s) (Flexitallic or equal) between the base flange of the holder and the piping flange. Free-venting disks do not require a gasket on the top side of the assembly. (1) Prebulged (conventional) type disk holders must not be installed with spiral wound gaskets. (2) Graphite rupture disks must be installed with either elastomeric or Teflon encapsulated elastomeric gaskets. c. The condition of the bolt and nut threads is critical to the bolting operation. The values obtained with the torque wrench are to relate to bolting force not to friction on rusty, dirty, or scarred threads. Use a thread die to clean the threads of each bolt. Inspect the thread condition; discard damaged bolts or nuts. Lubricate threads with a good thread dope. d. Install bolts and tighten evenly, hand tight. (1) Release the top bolt on the assembly holder tab (if any). Let the tab fall

31 free, held by the bottom bolt, and leave the top bolt in the hold-down flange. (2) Tighten the flange bolts with a dial indicating torque wrench. Proper load is critical to performance. Installation instructions state load requirements in foot-pounds. (3) Use correct bolting procedures. Tighten opposite bolts, using at least four cycles to achieve recommended load, i.e., 25%, 50%, 75%, then 100% on load. e. Companion flange gasketing must be of a type which does not cold flow. Cold flowing relaxes load on all except pretorqued assemblies. f. Make final inspection of installation to assure: (1) Flow direction on disk tab and flow arrows on safety head assembly match product flow direction in case of burst. (2) Flanges of mating pipes holding safety head appear even and parallel. (Uneven flanges product stress on safety head, with improper loading to disk and unreliable burst point.) g. Provide a loose fitting, lightweight cover to protect the downstream side of the disk from atmospheric corrosion (for free venting to air installations). h. Document "as found" condition of rupture disk and the service work done. i. Revise as necessary, with U/A of owning department, servicing frequency based on "as found" condition. j. Verify service, location, and process as shown on rupture disk records. Note: Problem rupture disk installations should be reported to the responsible operating department for investigation and corrective action. E. Servicing Personnel Only qualified (trained) personnel shall be allowed to handle rupture disk assemblies, when removal, inspection and/or replacement, and reinstallation are necessary. Note: "Qualified" means trained to a level which satisfies standards established by individual locations. IV. Records A. Installation Records of rupture disk installations shall be maintained, and may be part of the servicing records. They shall include: 1. installation schematics or flow diagrams with discharge point (atmospheric, flare, header, knock-out pot); 2. sizing basis and data (calculations); 3. dates of installation and/or rearrangements. B. Inspection Records verifying inspections should be maintained for a period of at least the two previous inspections (or a minimum of 6 months). C. Servicing Rupture disk service records shall be maintained in complete and updated form. They shall include:

32 1. Process LD. or other identifying number. 2. Service/equipment description. 3. Location description (or provide installation schematic). 4. Contacting fluid identity. 5. Manufacturer's name and serial number. 6. Size/model no./style/type/companion flange size. 7. Materials of construction. 8. Operating temperature and pressure. 9. Set pressure and back pressure considerations. 10. Date of installation in current service. 11. Service history: a. "As received" condition of rupture disk. b. Work done. c. Servicing frequency changes recommended to owning dept. 12. Last inspection and next inspection dates. 13. Servicing frequency. D. Reports Periodic status reports of the rupture disk servicing program shall be provided to appropriate facility managers. Periodic exceptions reports shall be provided to appropriate facility and location managers. The reports will indicate the rupture disks that are past due the scheduled inspection dates by time period, such as 6 months overdue; by frequency, such as past due two consecutive test dates; or by percent of normal test interval overdue. CONTROL LOOP/MANUAL ACTUATED EMERGENCY VENT DEVICES I. Accountability The location test and inspection program provides mechanisms for identifying control loop/manual actuated emergency vent devices and their ownership, specifies responsibilities for test and inspection, and provides for auditing of the program. II. Definition Control loop/manual actuated emergency vent devices vent the pressure and/or discharge hazardous materials from process equipment when harmful or dangerous conditions occur. Activation may be automatic or manual. III. Inspections A. Orientation Control loop/manual actuated emergency vent device orientation should be visually inspected at installation and, therefore, during other regularly scheduled inspections. The inspection is made to assure that the vent device is installed and oriented consistent with good installation practices for the device type. Close attention should be given to discharge configuration, particularly when a discharge header is involved (for vapor delivery to a

33 flare, liquid delivery to a dump pit, etc.). The impact on personnel and equipment from a release should be considered. D. Weekly for Backup Drive Mechanism Integrity Particular attention should be given to the integrity of the drive mechanisms. Systems (cylinder air banks, inverter battery banks, etc.) provided as a backup to primary vent device drive mechanisms (instrument air, electrical) are inspected weekly as a minimum, to ensure that they will be functional, if needed. C. Monthly for Block Values Approximately monthly, the following categories of block valves isolating vent devices are inspected to assure that they are sealed in the open position: 1. Shutoff valves at the inlet and/or outlet of a relief device. 2. Isolation shutoff valves in vent device collection headers. 3. Shutoff valves isolating separate pieces of equipment sharing a vent device. D. Quarterly for Vent Device Leakage Quarterly, as a minimum, inspections are recommended to determine if installed vent devices are leaking to the atmosphere or give indication of leakage. Particular attention is given to installations where the relief capacity could be disabled by effects of leakage (such as plugging or corrosion) and where vibration, pulsating loads or other circumstances subject the vent device to a high potential for leakage. IV. Testing A. Test Interval Selection Testing shall be performed on a schedule consistent with the desired level of vent device integrity and the satisfactory service history of the device. Test interval shall not exceed one year. B. Test Methods Each installation will have to be evaluated as to the test method to be used. The objective is to obtain as good a test of the functionality of the relief system as is practical. 1. Manual Switch Actuated Vent Device. Actual operation of the vent device is the preferred method of testing. Should actual operation of the vent device be undesirable, a method of testing individual components for integrity should be developed. The devices which link these individual components must also be tested. 2. Control Loop Actuated Vent Devices. Automatic systems can be tested by any of the three methods listed below, the first two being preferred: a. If possible to do so without undue risk or difficulty, take the process activating variable to the activation point and activate the vent device. b. Simulate the process activating variable reaching the activation point and activate the vent device. c. Test individual components of the vent device activation control loop. Also

34 test devices linking individual components of the loop together. Test sensors which detect abnormal conditions. C. Malfunction Resolution Any malfunctioning element of the relief system should be repaired or replaced and a satisfactory retest of the system obtained. Repeated functional problems identified during testing should be reported to accountable unit management and problem resolution pursued until a satisfactory correction is attained. V. Records A. Installation A record of the original vent device and activation system installation along with records of any subsequent rearrangements shall be maintained. This documentation may be maintained in the test and inspection/service records as well as in the operating department. It shall include as a minimum: 1. installation schematics and loop sketches. 2. sizing basis and data (calculations). 3. dates of installation and/or rearrangements. B. Inspection Records verifying inspections should be maintained for a period of at least the two previous inspections (or a minimum of six months). C. Testing/Service Vent device testing/service records shall be maintained in complete and updated form, which include but are not limited to: 1. Process LD. or other identifying number. 2. Service/equipment description. 3. Location description (or provide installation schematic). 4. Contacting fluid identity. 5. Manufacturer's name and serial number for components. 6. Size/model no./style/type/connection flange size, etc., for components. 7. Materials of construction for components, where exposure to process or environment is a consideration. 8. Operating temperature and pressure. 9. Set pressure and back pressure considerations. 10. Date of installation in current service. 11. Testing/service history: a. Document "as found" condition of vent device components. b. Document work done. c. Recommended testing/servicing frequency changes. 12. Last inspection and next inspection dates. 13. Testing/servicing frequency.

35 D. Reports 1. Periodic status reports of the vent device servicing program shall be provided to appropriate facility managers. 2. Where appropriate, periodic exceptions reports shall be provided to appropriate facility and location managers. The reports will identify vent devices that are past due the scheduled testing/servicing dates. The reports will indicate the individual vent devices that are past due the scheduled test dates by time period, such as 6 months overdue; or by frequency, such as past due two consecutive test dates; or by percent of normal test interval overdue. E. Updating Mechanisms exist to assure the timely updating of records and include information on status or changes for existing vent devices, along with any additions or deletions. WEIGHT LOADED CONSERVATION AND EMERGENCY VENTS I. Accountability The location test and inspection program identifies the ownership of weight loaded conservation and emergency vents, specifies responsibilities for test and inspection, and provides for auditing of the program. II. Inspections A. Inspection I Servicing Criteria Weight loaded conservation and emergency vents should be inspected at installation and serviced, thereafter, at regular intervals, not to exceed 5 years. The work shall involve checks: 1. To ensure that the vent areas are open and separation is not restricted by frozen chemical deposits, packing materials, bird's nests, bee hives, deposits by mud daubers or other insects, etc. 2. To ensure that vent and vacuum breaker pallets and seating surfaces are clean and free of nicks and abrasions. 3. To identify and correct situations where corrosion of vent assembly parts is occurring and where elastomeric or plastic parts need to be replaced. 4. To ensure that the vent unit is functionally active. 5. To ensure that moving parts of the vent unit are properly lubricated. 6. To ensure that flame arresters, where provided, are not restricted and are in good repair. B. Inspection Interval Selection Typical inspection frequencies are as follows: 1. Residue fouling freezing potential 1 year or less 2. Corrosive service 1 year or less 3. History of obstructions 1 year or less 4. Nonresidue, noncorrosive 2 years

36 III. Testing Testing of weight loaded conservation and emergency vents is limited to those units considered to be problem vents. Testing normally involves: 1. Manometer checks on vessel pressure characteristics to determine if the vent problem resides in the vent unit or in the pressure regulation/control system for the vessel. 2. Removing the weight pallets from the vent unit and weighing them after cleaning. The weighing can be done under shop conditions or in the field using portable scales. IV. Records A. Service History Records Service history records for weight loaded conservation and emergency vents shall be maintained in complete and updated form, which include but are not limited to: 1. Process LD. or other identifying number 2. Service/equipment description 3. Location description 4. Contacting fluid identity 5. Manufacturer and model no. 6. Inlet size and flange rating/type 7. Pressure setting: standard/maximum 8. Vacuum setting: standard/maximum 9. Sizing basis and data (calculations) 10. Materials of construction 11. Operating temperature and pressure 12. Service history: a. Documents test dates and frequency changes b. Documents "as found" conditions of vent unit c. Documents work done on vent unit 13. Next inspection date B. Reports Periodic status reports of the weight loaded conservation and emergency vents testing program shall be provided to appropriate facility managers. Where appropriate, periodic exceptions reports shall be provided to appropriate facility and location managers. The reports will identify the vent units that are past due the scheduled test dates by time period, such as 6 months overdue; by frequency, such as past due two consecutive test dates; or by percent of normal test interval overdue. C. Updating Mechanisms exist to assume the timely updating of records, and include information on status or changes for existing vent units, along with any additions and deletions.

37 EXPLOSION VENTS I. Accountability The location test and inspection program identifies the ownership of explosion vents, specifies responsibilities for test and inspection, and provides for auditing of the program. II. Definition and Scope Explosion vents are relief devices designed to vent gases from deflagrations of dusts, gases, vapors or mists in equipment or buildings, to protect personnel and minimize property damage. Explosion vents are of two types: (1) rupture disks or large thin panels or (2) mechanical devices such as pivoted doors or spring-loaded inserts that deflect to vent. III. Inspections A. Installation I Replacement Visual inspection of explosion vents and vent panels shall be made at installation and at the time of panel replacement. 1. Verify that the explosion panel is the same as or meets the specifications of the original design. A change in panel material, thickness, or tensile strength may have a detrimental effect on the venting capability. 2. Verify that the design method of securement of the explosion vent has not been changed. Nylon bolts, intended to fail in tension, may have been replaced with steel bolts; or, panels designed to "pop out" may have been fastened in place. 3. Check for proper installation and position of vacuum support, when vent panel is so equipped. 4. Check the condition of gaskets, where applicable. Deteriorated gaskets can act like glue, impeding the opening of the panel. 5. Check the condition of spring fasteners and latches with adjustable tension, where applicable. Clean and lubricate, then check and adjust as necessary for proper operation. 6. Check the items listed for Annual inspection in Section III.B below. B. Annual Visual inspection of explosion vents and vent panels shall be made at least annually to assure that they will perform as designed. Replace vent panels found to be deteriorated or abnormal. 1. Make sure that no piping, wiring, or other equipment has been installed which would keep the explosion vent from opening fully. 2. Check to see that the discharge of the explosion vent is not pointed at nearby operations or at vent panels of adjacent equipment, to negate the potential for a chain reaction of explosions. 3. Check to see that the discharge of the explosion vent is positioned, or restrictive guard rails are provided, to minimize exposure of personnel to flame, gases, or flying material during a venting episode. 4. Look for possible obstruction of the explosion vent such as a buildup of process

38 materials or accumulation of ice and snow in winter, which might interfere with the designed operation. 5. Inspect the condition of explosion vent panels for mechanical damage, corrosion, erosion, stress hardening, and oxidation (a problem with lightweight aluminum panels). 6. Inspect large area thin aluminum panels for signs of fatigue failure from normal pressure fluctuations. 7. Check the condition of tethers (flexible restraints) on vent panels so equipped, and the condition of vent panel opening sensors where used. 8. Check hinged explosion relief doors for proper operation. Keep clean and lubricated, as they are susceptible to malfunction from rust, excessive paint, and ice or snow in winter. IV. Records A. Inspection Records verifying the inspections of explosion vents should be maintained per the accepted location practice. Records should include: 1. Process LD. or other identification. 2. Location and department. 3. Service and fluids contacted. 4. Pressure and temperature ratings. 5. Special features, such as nylon bolts. 6. Installation date. 7. Inspection date and frequency. 8. Inspection results and name of inspector. V. Reports Periodic status reports on the explosion vent inspection program shall be provided to appropriate facility managers. Where appropriate, periodic exception reports shall be provided to appropriate facility and location managers. The reports will indicate the explosion vents that are past due the scheduled inspection dates by time period, such as 6 months overdue; by frequency, such as past due two consecutive inspection dates; or by percent of normal inspection interval overdue.

39 Appendix 8F Example of Management System for Critical and Unique Safety Features UNIQUE SAFETY FEATURES This guide describes the concept of the unique safety feature (USF) program and offers a reference list to assist in setting up a formal system within the plant whereby the critical and more unusual safety design premises built into a project at the start-up and implementation stage are carried forward for the life of the facility. DEFINITIONS The unique safety feature of a project is a concept, a control, a system which if it failed to be maintained as originally provided would increase either the likelihood or severity of an unacceptable event. FOREWORD During the development of a project, many safety concerns are brought to the attention of the design team who in turn design features into the project to safely cope with each of the hazards. Some period of time after the project installation and start-up, the environment starts changing; people turnover begins; and the reasons for some of the more unusual or unique loss prevention concepts and controls for the project become obscure. Since the current management team may not be sensitive to or aware of the original need or purpose, an increasing number of loss prevention controls are no longer maintained; are forgotten about; are eliminated; until the unacceptable event occurs and the safety wheel must be reinvented. For example, the nitrogen inerting system on a maleic storage tank was turned off (someone in charge at the time felt that inerting was not necessary). When tank inventory became low enough that the electric induction heated coils were exposed to flammable vapors, rather than a flammable liquid, ignition occurred, and the tank ruptured. Of course, there were other problems, such as the coils had shifted and were arcing to the tank side walls and apertures. But if the unique safety feature (the critical safety devices) had been functioning if the system were properly inerted the explosion would not have occurred. In the manufacture of a chemical which was unstable from the initial reaction through the finished goods, the degree of stability was governed by the preciseness of and compliance to the process controls. A number generated by the Analytical Lab, called Rearrangement, determined whether or not the intermediate was stable enough to process to completion. In time, supervision would begin accepting material with lower and lower Rearrangement numbers (below that determined to be safe with 100% confidence) until an uncontrolled decomposition occurred. Among the many things that would come out of an accident

40 investigation is a rededication to the fact that if the Rearrangement is below x,y% the batch must be disposed of. Other "unique (to this project) safety features" might be: Redundant instrumentation on critical reactions Interlocks which stop or change flow directions of process streams A thermocouple installed in the relief line off the rupture disk to detect weepage Weep holes in the dip pipes to the flammable storage tank to prevent siphoning A tank with a weak seam roof Minimum controller mode settings for fast reactions or operations The building with a precisely calculated emergency ventilation system or overpressure protection High tensile strength bolts used on large piping systems which operate at very high temperatures Mushroom buttons for emergency shutdown of equipment These are very specific design features which are geared to preventing or limiting the consequences of an accident. Each process has a set of specific safety features which are important to its successful performance. For purposes of this document, these safety features are called unique. DISCUSSION Responsibility The manufacturing representative for each project has the charge to develop the original unique safety feature as part of the operation manual. Manufacturing line supervision is responsible to keep the unique safety feature visible and current via the standard manufacturing procedure. On existing processes manufacturing supervision is responsible for both the development and maintainance of the USF program. Relationship between the USF and CSD Program The Critical Safety Device is a back-up that comes into play when the process controls fail; that is, the temperature is much too low, the level dangerously high, an unsafe action is about to be taken. Special alarms, shutdowns, interlocks fall into this "back-up" category and identified as critical safety devices. Other important process safety devices that are normally included as CSDs are flame arresters, conservation vents, excess flow and check valves, a few other items, and possibly inerting systems. The unique safety feature goes a step further it includes all the CSDs plus additional items. Definition: The Unique Safety Feature of a project is a concept, a control, a system which if it failed to be maintained as originally provided would increase either the likelihood or severity of an unacceptable event. This definition can include the basic critical safety devices and systems common to

41 most processes like rupture disks or interlocks, but it would also include some special design innovation which makes the safety device more reliable such as monitoring the heating system on a conservation vent to ensure against sublination and blockage; utilizing plastic tubing in an air line at the valve so that the remote operated valve will automatically close under fire conditions: introducing process liquid under rupture disk on a tank nozzle to help ensure no buildup of material between the disk and the batch. Furthermore, the unique safety feature can include such periphery process items as: Blowdown tanks Explosion relief panels on buildings Flares and incinerators Flammable gas analyzers Emergency systems which become available on power outages Housekeeping Redundant instrumentation Special gasketing (Refer to Appendix for a partial listing of unique safety features.) For example, with respect to the previous list, as an original design team evaluated a project, they were sensitive to the following design and operational requirements. Blowdown Tank A 4000-gallon steel tank located in a curbed area 25 feet from ignition sources to receive an unstable batch from one of four 2000-gallon reactors. When the automatic dump valve is remotely opened by the operator, the water deluge system on the blowdown tank is concurrently activated to cool the tank and scrub the flammable vapors discharging from the tank. The area within the curb is sloped to one end and connected to plant storm sewer. An installed spare blowdown tank is provided so that production can continue while the first tank is isolated from the process and decontaminated. Building Pressure Relief The process contains a number of low flashpoint materials which would normally require open-air construction. Because of unfavorable climate conditions the 100,000ft building housing the solvent recovery area has been equipped with 2500 ft of explosion relief paneling; each panel weighing 1.81b/ft is fastened with eight 1/8-inch-thick aluminum, clips and restrained with 1 foot flexible steel cable. It is important that each panel is identified as an explosion relief panel; the panels are not used to mount or support equipment, and no obstacles are built outside to impede its emergency function. Suggested inspection frequency is once per year and should include such items as: condition of panels, obstructions, corrosion, cable condition, etc. Housekeeping The dried product is extremely dusty and a serious fire-explosion hazard. The project team has provided a building vacuum system with three stations on each floor tied to a collector

42 on the roof of the building. In addition, the equipment and building are designed so that frequent wet washdowns of the area can occur to prevent accumulation of dust and secondary explosion hazard. The Program Now that we are aware of what types of safety features on a project are considered unique and important to preserve and to circumvent the people changeover and changing priority problems, the following mechanism is offered to accomplish the objectives of developing and maintaining a USF program. Just as key items in the fire protection and personnel safety systems must be periodically tested and inspected, so must all unique safety features be addressed. The project safety inspection program is a bit more difficult to accomplish in that there is not as much standardization within the process system as compared to the fire and people protection systems. In addition, unique safety features many times are very subtle items which are not readily visible (and difficult to highlight) during a field inspection. To achieve an ongoing USF program in the plants, the following six steps should be taken: 1. Develop a list of the unique safety features. 2. Describe concisely the purpose or function or premise for each item on the list. 3. Determine how each unit is to be tested or inspected and with a suggested frequency. There are many loss prevention discussions held during the project design phase, but the important safety controls are the ones that have withstood the detailed process-safety economic evaluation and are included in the final design. The start-up team is very much attuned to the design premises of the project as installed, and in the best position to initiate the vehicle needed to preserve this information for future managers of the project (installation). Therefore, with regard to 1, 2, and 3 above, it is felt that the manufacturing representative and his start-up team are the ideal group to develop the unique safety feature list; describe the purpose of each system, together with some tips on inspection frequency and procedure. (On an existing installation a knowledgeable department supervisor or a process engineer might be assigned this responsibility.) Manufacturing supervision would be responsible for: 4. Having the information readily available for quick reference either as a section of the operating manual or a,special safety book. 5. Tailoring the inspection frequency and procedure to ongoing plant programs, like monthly checklists, daily batch sheets, preventive or safety maintenance programs. 6. Periodically reviewing and updating the USF list at least triennially during the indepth auditing of the process. Obsolescence, process changes, accident recommendations, S&PP and insurance recommendations, and company experience with the process all become reasons for periodically reviewing and updating the list.