I

IEEE TRANSACTIONS ON RELIABILITY, VOL. 37, NO. 2,1988 JUNE 159

Application of a Hazard & Operability Study to Hazard Evaluation of an Absorption Heat Pump

Ahmad Shafaghi

F. Bert Cook Rohm & Haas Company, Bristol

Columbia Gas Service Corp, Columbus

R& Ai& - Purpose: Tutorial, case history Special math needed for explanations: None Special math needed tO use resnlts: None Results useful to: Process engineers, Safety analysts

Abstruct - Hazard is evaluated for a doublesffect, absorp- tion heat pump. The primary technique for the hazard evaluation was a Hazard and Operability (HAZOP) study; this is a brain- storming approach condtxted by a multidisciplinary team. The approach stimulates creativity of the team members to generate new ideas. As a result of this study, numerous, qualitative recom- mendations have been made to design the hazards and operability problems out of the heat pump. Among the recommendations are suggestions on control strategy, materials of construction, process material releases, alternative design options, and maintenance of the heat pump.

1. INTRODUCTION

The Columbia Gas System Service Corporation and the Gas Research Institute have funded development of a unique, high efficiency, doubleeffect absorption heat pump for the residential market. Based on the demonstrated durability of the now-historic gas refrigerator and current residential absorption air condi- tioners, the reliability of absorption heat pumps will be higher than that of the engine and motor driven heat pumps. This is mainly because the absorption cycle incor- porates fewer moving parts owing to the elimination of the compressor.

Nevertheless, Columbia Gas and Gas Research In- stitute decided to launch a thorough safety analysis of the equipment at an early stage of development. The objective was to design potential hazards and reliability problems out of the equipment. The primary technique chosen for the hazard evaluation was a Hazard and Operability (HAZOP) study. HAZOP has been extensively applied to process units and plants and for both continuous and batch processes. The technique is considered as the most rigorous hazard identification approach for systems, especially those with subtle hazards.

The present study shows a novel application of HAZOP to a residential space conditioning equipment, and it incorporates a preliminary hazard identification using a checklist. The objective of the checklist, which preceded the

HAZOP study, was to identify the major areas that needed further consideration. Almost half of the questions raised during the safety checklist focused on those areas.

The study showed that the checklist is an inadequate approach to hazard identification for new or unique systems. However, it can precede a more rigorous tech- nique such as HAZOP to save effort and to focus on major areas of concern.

The HAZOP study was carried out by a multidisci- plinary team consisting of a HAZOP leader, the heat- pump project manager, a thermohydrologist, a corrosion specialist, a toxicologist, and a risk analyst. The majority of the team members were already involved in the design and analysis of the heat pump. Five 3 - 4 hours sessions were used to study the heat pump. The sessions were recorded on audio tapes and transcriptions were produced.

The results of the HAZOP study were in the form of design deviations, their causes and potential consequences. The HAZOP study was successful in identifying and ex- amining many types of risks, sources of non-optimum system reliability, and improvements in the heat pump design. The strongest contributions of the HAZOP study in system reliability were in control strategy, material pro- perties, material release, alternative design options, opera- tion, and maintenance.

2. DESCRIPTION OF THE HAZOP TECHNIQUE

The Hazard and Operability (HAZOP) technique was originated in the late 1960s and developed as a practical method for problem identificatipn in the process industries in the early 1970s at the ICI, UK [I, 21. The technique has been essentially the same since its conception and is simple to comprehend. The intriguing notion behind the tech- nique is the idea that “there is always a different (including a better) way” for tackling problems. The better way is on-- ly realized by brainstorming all potential ways.

As a brainstorming approach, HAZOP is a method for stimulating creativity and a procedure for generating ideas. The brainstorming approach to problem solving is based on two principles: deferment of judgment, and quantity breeds quality. The strength of the approach lies in the interfacing group process.

HAZOP is a multidisciplinary team approach. The team is normally composed of 5 - 7 people. The team is headed by a leader who is an expert in M O P . The com- position of the team varies in accordance with the nature of the problem. For instance, for a process involving new materials, a chemist or a chemical engineer should be a fun- damental team member. However, the key members should have knowledge on design, operation, and maintenance of

OO18-9529/88/0600-0159%01 .OOO 1988 IEEE

160 IEEE TRANSACTIONS ON RELIABILITY, VOL. 37, NO. 2,1988 JUNE

the system. The team may require supporting members, for example, an electrical engineer or a toxicologist, depending on the nature of the problem.

The team leader has a critical responsibility. The leader should not, by any means, compete with the group members. In -act, the leader should -

be a good listener not permit any member to be put on the defensive be alert to identify a team member uncommitted to

the study and challenge that member keep the energy level high and get everyone involved

in the study provide the team with a means (such as a section of

the process and instrument (P&I) diagram prepared for the session) to guide them through the study.

The M O P meetings must be planned ahead. The P&I, or flow, diagram must be divided into sections, one for each meeting session. The sessions must be performed in a relaxed atmosphere where everyone -

is involved is free in expressing ideas and viewpoints has an opportunity to contribute. One thing should

be avoided by all means: that is discouraging the members from expressing themselves; judgment must be deferred and criticism must be minimal. The quantity of comments made by the team members must be maximal, even though some of the comments may sound inappropriate or irrele- vant. This is because ideas breed ideas. The team leader must strive to maximize the number of comments within the time allotted for the study session.

The sessions should not provide an atmosphere that the members be afraid of being open. The team leader should not allow a single person to dominate the sessions and should not allow the members to jump from topic to topic or to digress from the main subjects. An extremely important point to consider is that the sessions should not dwell on solving problems, but rather on the identification.

A HAZOP session period should be limited to be- tween 2 and 3 hours. Below 2 hours, the sessions would not be very effective, and above 3 hours, the sessions could become exhaustive for the members. The number of ses- sions is identified based on several parameters including size of the plant (process or equipment), amount of replications, batch or continuous, and process complexity. However, the number of sessions should be restricted to no more than 4 per week.

3. THE HAZOP PROCEDURE

The objective is to identify deviations from design in- tent, and subsequently the causes, the consequences, and the remedies, if known. The tools for the study are a set of abstract concepts, called guide words. The guide words with their meanings are given in table 1.

The guide words are applied to process variables and parameters, such as temperature and flow rate. The results are process variable deviations. For example, the applica- tion of the guide word “part of” to the process variable “concentration” is the deviation “low concentration” (of a specific substance).

To conduct the study, the team examines the equip- ment (plant or process) model (for example, P&I diagram). Each model is divided into sections, usually lines (piping), and each section is studied in turn to identify what could go wrong with the equipment (plant or process) given the suggested deviation. An algorithm for the HAZOP study is shown in figure 1. Once all the possible deviations are ap- plied to all the sections (lines), the study is completed. The results of the study are recorded as the deviations; the con- sequences and the causes of the deviations; and the remedies, if known.

TABLE 1 The Guide Words

~~

Guide Words Meaning

No, None More Quantitative increase Less Quantitative decrease As Well As Qualitative increase Part of Qualitative decrease Reverse Other than Complete substitution

Negation of the design intent

Logical opposite of the intent

Divide P 8 I Oiagram Into Sections,

7 rating

Not Sure

Information

Fig. 1. Algorithm of the HAZOP Study

4. THE COLUMBIA GAS HEAT PUMP

The Columbia Gas System Service Corporation and the Gas Research Institute have funded development of a high efficiency, reversible absorption heat pump for the residential market. The heat pump concept is a double- effect generator absorption cycle using a unique solution pair.

II

SHAFAGHI/COOK: APPLICATION OF A HAZARD & OPERABILITY STUDY TO HAZARD EVALUATION

__

161

The Columbia Gas and its subcontractors have fabricated a pre-production prototype heat pump. They hope to have the heat pump in commercial production by the end of this decade. Table 2 shows some of the specific design targets.

TABLE 2 Some Specific Targets for the Columbia Double-Effect Heat Pump

Cooling Mode Heating Mode at 95°F at 47°F

Capacity 36000 BTU/hr 68 OOO BTU/hr Coefficient of

Performance (COP) 0.80 1.5 Seasonal COP 0.12 1.35

Heat pumps fall broadly into two categories: 1) engine or motor driven and 2) absorption. Heating efficiencies greater than I .O are possible in all heat pump systems, elec- tric motor driven, gas engine driven, or absorption. Heat pumps deliver greater heat energy to the conditioned space than that required to drive the pump. Gas heat pumps, ab- sorption or engine driven, can deliver more heat energy in the heating mode, for the same primary energy input, than electric heat pumps because they can recover a portion of the waste heat from cycle on-site. The recovered heat and the heat absorbed from the environment can then be transferred to the space to be heated (conditioned space). Table 3 compares the heating and cooling capacities of electric heat pumps and gas heat pumps.

TABLE 3 Comparison Between Heating and Cooling Capacity

of Gas and Electric Heat Pumps

Elecr ric Heat Pump Gas Heat Pump

Cooling mode capacity 36000. BTU/hr 36000* BTU/hr Heating mode capacity 38000 BTU/hr 63000 BTU/hr Fraction of heating

capacity at 10 "F ambient temperature with respect to that of 40°F 60% 15 - 90%

* Base Case

Reliability has been a serious problem throughout the history of electric heat pumps. Compressors which were originally designed to operate fewer than 1 000 hours per year in an air conditioning application were required to operate 3000 - 4000 hours per year in a heat pump. Gas- engine driven heat pumps face even more challenging reliability problems. In addition to the same compressor life requirements, the engine should operate over the entire life of the heat pump without major overhaul, 30000 to MOO0 hours. This is analogous to developing the engine of the approximate size and cost of a lawn mower engine with 100 times the service life.

Absorption heat pumps, on the other hand, can offer an important advantage over motor or engine driven heat pumps in terms of reliability. This has been demonstrated by the durability of the now-historic gas refrigerator and current residential absorption air conditioners. From a mechanical point of view, the only moving parts within the heat pump are the solution pump and its motor.

This is, however, not to suggest that absorption, gas air conditioners and heat pumps have been without reliability problems. The main reasons for these reliability problems can be traced to inadequate product design and quality control, and to a lack of adequate field testing of new product designs. This is exactly the reason behind an extensive safety analysis conducted on the Columbia Gas Heat Pump and parallel availability and reliability assessments.

Figure 2 depicts the basic double-effect heat pump showing the double-effect generators and waste-heat recovery heat exchangers. (The figure shows the cooling mode of the heat pump.) Preheated rich solution (solution with a high concentration of refrigerant) enters the primary generator where it is heated by an external gas flame. As the solution is heated, refrigerant is boiled off and exits through line 4 to the primary separator where the hot, high pressure vapor and the weakened (intermediate) solution are separated and leave the primary separator via lines 5 and 6, respectively.

The weakened solution preheats the rich solution in the high temperature solution heat exchanger. This in- termediate solution then enters the secondary generator via lines 8 and 10, through a pressure reducing valve (CV-I). Heat is applied to the secondary generator from two sources.

1. The high pressure vapor releases heat by condens- ing on the inside of the secondary generator

2. Additional heat can be obtained by passing the products of combustion leaving the primary generator over the outside of the secondary generator. This is achieved by laying out the generators appropriately.

These heat inputs boil off additional refrigerant vapor which leaves through line 11, to the secondary separator.

The weak solution (weak in refrigerant) leaves the secondary separator through line 13, heats the strong solu- tion in the low temperature heat exchanger, and passes into the absorber, after passing through another pressure reducer valve (CV-3). Just before entering the absorber, the low pressure, weak solution (line 17) i s combined with the low pressure refrigerant (line 21) entering via line 22. After absorbing the refrigerant, the strong solution enters the solution pump, via line 23, where the solution pressure is raised. After passing through the low temperature and high temperature heat exchangers via lines 1, 2, and 3, the solution re-enters the primary generator.

The refrigerant side of the heat pump is similar to all Rankine cycle refrigeration circuits, except that there are two incoming refrigerant streams and a refrigerant heat

162 IEEE TRANSACTIONS ON &LIABILITY, VOL. 37, NO. 2,1988 JUNE

4 , Cwllnd Mod!

1 L-

E:: q Double Effect IIedt Pump

J I

1

Fig. 2. Double Effect Heat Pump

exchanger, The condensed high pressure refrigerant stream passes through the pressure reducing valve (CV-2) (lines 5, 7, 9) and is mixed with the intermediate presstue vapor, from line 12. Although the high pressure refrigerant does produce some vapor upon pressure reduction and the iri- termediate pressure vapor is superheated, line 14 entering the condenser is a saturated mixture of liquid and vapor, generally less than 30% kiquid by weight,

The refrigerant is conderised in the condenser, giving up heat, and further subcooled in the refrigerant-to- refrigerant heat exchanger. The low pressure, superheated refrigerant vapor thus enters the absorber via line 21 and is absorbed into the solution.

5 . HAZARD EVALUATION This section presents the hazard evaluation carried out

for the Columbia Gas Heat Pump. The main technique used was HAZOP, but a preliminary analysis was con- ducted using a safety checklist.

5.1 The Safety Checklist

The safety checklist is a preliminary hazard study con- ducted before the HAZOP study began. The checklist was

compiled using experience and professional judgement. The objective was to identify major areas to be emphasized during the HAZOP study.

The 7 majdr areas, along with their subareas, are presented in table 4. The checklist consisted of more than 90 questions. Approximately half of these questions could riot be answered adequately due to their complex nature and were referred to the fotthcoming HAZOP study. Among the remaining questions, a few were referred to the other studies such as thermodynamic analysis and corro- sion analysis, Which were being conducted concurrently. However, there still were many grey areas that could not be answered clearly.

The checklist was reviewed only by the heat pump project manager, and the time spent was approximately three hours. The outcome of the checklist was twofold:

TABLE 4 Major Areas Covered itl the Checklist

1. Basic Considerations

Materials and reaction General process specification

2. Mechanical Design Specification 1

Operating limits Standards, codes, and further design considerations Valves and fittings

3. Operational Deviations

Startup and shutdown Maintenance

4. Reliability

Failure analysis Improving reliability Human and instrument error

5. Design Deviations

Specific deviations impurities

6. Major Hazards

Release Fire

7. Layout and Protection

Equipment layout Protection

1. The checklist is a coarse study and can be useful if

2. The checklist by no means is adequate for a situa- it precedes a rigorous study such as HAZOP

tion that has many unknown factors.

5.2 The HAZOP Study

Having completed the safety checklist, we prepared a plan for the HAZOP study. During the preliminary hazard analysis, in which the checklist was prepared, the project principal investigator kept enough contact with the

SHAFAGHIKOOK: APPLICATION OF A HAZARD & OPERABILITY STUDY TO HAZARD EVALUATION

heat pump project manager to reach an adequate level of understanding of the heat pump design.

In the plan, we divided the heat-pump flow diagram into 5 segments and anticipated 5 corresponding HAZOP sessions of 3 - 4 hours each. Each segment consisted of 4 - 6 lines. If the session number or duration was not ade- quate, we could have altered them, but this did not occur. The reason for allotting 3 - 4 hours for a session was the difficulty anticipated for assembling the group members.

The next step was to select the team for the HAZOP study:

1. The Columbia Gas Heat-Pump project manager 2. The HAZOP team leader, viz, The project prin-

3. A thermohydrologist 4. A corrosion specialist 5 . A toxicologist 6. A risk analyst

cipal investigator

The number of team members was limited to six, which is an optimal number for HAZOP studies. We chose the in- dividuals carefully, eg, the thermohydrologist was the design engineer for the heat-exchangers used in the heat pump. The corrosion specialist and toxicologist had already participated in the design and analysis of the heat pump; we used a mechanical engineer with expertise in material fracture and fatigue in two sessions. There was a need for a chemist, who was used outside the session.

In principle, the majority of the team members were somewhat familiar with the design, but the real expert in the heat pump was the Columbia Gas Heat Pump project manager.

The sessions were recorded on audio tape. The tapes were then immediately transcribed. Naturally, not all the conversations were understandable, or audible. The miss- ing spots of the transcripts were filled in as feasible, by listening to the tapes and referring to the brief notes taken during the sessions. We realized that if this tape listening and comparison was carried out even with a few days delay, we could not identify the missing spots. The transcripts were refined, edited, and typed again resulting in a few hundred page document. This document was fur- ther refined to the final document.

The HAZOP sessions were productive. However, there were cases when the discussions became entangled around a subject, and it was the HAZOP leader’s duty to guide the members to another subject. The experience gained during the sessions was very valuable. It was unanimous among the group that the learning experience was a major achievement of the HAZOP sessions.

The number and duration of sessions were enough to bring out the most of the expert’s creativity. The pace dur- ing the sessions varied, but generally was fast enough to proceed with the plan. The first and the last sessions were slower than the others. The first session was used to teach the members the techniques of HAZOP, enough to res- pond to the guide words. A portion of the last session was

163

used to review some of the findings obtained during the HAZOP sessions.

Although it was planned to study all the lines, some lines were not studied. This is common among HAZOP studies. However, different reasons exist for different cases. In our case, some lines, although with different numbers, served the same function. For example, line 20 was not studied because l i e s 21 and 20 are nearly iden- tical; hence, the same deviations, causes, and consequences were anticipated for both lines. Another example is line 22 which is in series with line 23, and in reality is very short, hence it was not studied. Table 5 presents the lines that were not studied.

Likewise, some deviations were not applied to specific lines because some lines, with respect to a particular devia- tion, function exactly the same. That is, the whole system responds to a specific deviation in the same way in the lines. For example, high flow results in the same causes and consequences in lines 16, 18, 19,20. Another example is line 24, for which high pressure and low pressure did not apply, because the main gas valve and ignition should shut off the line. Table 6 presents these deviations and the cor- responding lines.

TABLE 5 Lines Not Studied

~

Line Reason

1 1

21

22

Line 11 is in series with lines 6, 8, 10. Same deviations and responses apply as in the case of line 4 with line 8 corresponding to line 7, 13 to 6, and 12 to 5. Phase, mass flow rate, and concentration are comparable. Line 1 1 operates at a lower temperature and pressure than line 4, so deviations in these quantities incur analogous consequences but on a longer time scale.

Conditions in line 21 are very nearly identical with those of line 20. Apply same deviations, causes, and consequences.

Line 22 is in series with line 23. Line 22 is very short and hence not in the HAZOP analysis.

26, 27, 28, 29 All these lines were involved in the house-side heat exchanger, and are in series with line 25. No circuit or mechanical aspects of the heat pump or physical features of the flow in these l i e s justified treatment different from that of line 25. Apply same deviations and an- ticipated responses.

6. THERESULTS

The HAZOP sessions were recorded on tapes and transcribed into many pages. The transcript was refined and resulted in a 50-page document. Table 7 is a sample of the final result and represents the application of some deviations on Lines 1 and 23, collectively. As shown, a

164 IEEE TRANSACTIONS ON RELIABILITY, VOL. 37, NO. 2,1988 JUNE

TABLE 6 Deviations Not Applied to Specific Lines

Line Deviation Reason

4

6

7 & 9

8 & 10

12

14

18 & 19

20

24

25

high pressure

low flow

low temperature

high temperature

low pressure

high pressure

high flow low pressure high pressure

high flow

low pressure

high pressure

low temperature

high pressure

no flow

low flow

low temperature low pressure

high flow low flow high pressure low pressure

high flow high temperature low temperature law pressure

high pressure

low flow

high temperature low temperature

high pressure low pressure

high flow

high pressure low pressure

High temperature and superheated vapor state existing in this case make abnormally high pressures in this line unlikely. Relief valve located here and primary separator can act as a pressure sink in abnormal situations.

Same case as line 8.

Implies burner is off and system is shut down.

Same case as line 8.

Burner is off or entire system is shut down.

Implies CV-1 has failed and entire system is shut down.

Same case as line 5.

Same case as line 2.

Same case as line 1 & 23.

CV-2 has failed and entire system is shut down.

Burner is off or entire system is shut down.

Analogous to high pressure in line 5.

Implies system is shut down.

System is running at very low efficien- cy and will eventually shut down.

Same case as line 5 .

Same case as line 16.

Same case as line 16.

Unlikely.

Plugged orifice*.

Nonapplicable* .

Unlikely*.

Eventually implies high temperature as described in line 1 and 23.

Generally reduce efficiency.

Gas valve and ignition should shut off in all cases.

TABLE I Sample of the M O P Results Summary

(For Lines 1 and 23)

DEVIATION: NO FLOW

Cause I : Pump failure, electrical motor failure, or mechanical.

Consequences I: Region between lines 3 and 4 reaches temperature of approximately 2400°F. Boil-off of all refrigerant.

Remedies I : Install a sensor device that signals the burner to turn off when flow from the pump is critically low or the electric motor shaft speed is likewise critically low.

Cause 2: Particular plug in line.

Consequences 2: Particulate plug could block line (especially likely

Cause 3: Valve V-1 left open.

Consequences 3: Lose entire solution charge.

to occur at bends).

DEVIATION: LOW FLOW

Cuuse I : Restriction in line.

Consequences 1: System becomes energy unbalanced. Overheating occurs in the primary generator and anywhere downstream where there is low flow. As solution flows to overheated regions where there is low flow, flashing of refrigerant vapor could form par- ticulate plug in line.

Cause 2: Noncondensable gases present in line as well as associated corrosion in line and solution pump.

Consequences 2: Pump failure or line blockage.

Remedies 2: Guidelines for maximum permissable impurity levels for solvent-solute mixture. Introduce corrosion inhibitor into solvent-solute mixture.

Cause 3: Low temperature in the evaporator due to refrigerant leaks.

Consequences 3: Abnormally low pressures throughout most of the system. Low concentration of refrigerant in line 23 permits crystal formation at the pump inlet.

DEVIATION: HIGH FLOW

Cause I : Safety relief valves open partially and do not reseat, and

Consequences I: May have pure refrigerant solvent leaking through

Remedies I: Trip device which shuts the system down when any of

yet working fluid is still being pumped throughout the system.

the valves as well as particulate forms.

the relief valves open.

DEVIATION: LOW TEMPERATURE

Cause I : User inadvertently leaves temperature setting too low for heating mode during cold weather conditions.

Consequences I: Absorber experiences cold soak. Particulate plug may occur in line.

Remedies I : Thermostat control device which turns system on heat- ing mode for short periods of time in order to preserve minimum system temperature.

Cause 2: Power failure during cold weather.

Consequences 2: Absorber experiences prolonged cold soak. Solu-

Remedies 2: Install control device which disables system restart until

Cause 3: Flow reversal through strong solution pump.

tion freeze-up or large quantity particulate plug in line.

remedial action is taken from outside. ,

SHAFAGHI/COOK: APPLICATION OF A HAZARD & OPERABILITY STUDY TO HAZARD EVALUATION

~

165

Table 7 (Continued)

DEVIATION: LOW TEMPERATURE (Continued)

Consequences 3: Vapor content of absorber increases. Liquid ab- sorbent is forced backwards into the separator bottles.

Remedies 3: Control device shuts down system in response to high or rapidly changing level in separator bottles.

Cause 4: Failue of heating loop to the house.

Consequences 4: Heat is not being removed from the system.

Remedies 4: Control system senses a large level transient in sepa- rator, bottles and shuts down system. Override restart and signal homeowner.

DEVIATION: LOW PRESSURE!

Cause I : Control valves 1 through 3 (CV-1, CV-2, CV-3) are closed,

Consequences I : Low pressure control - generally system is run- ning at lower pressures which cannot be compensated.

Cause 2: A line break, restriction on entry side of pump, loss of charge in the system, or an unbalanced system. Also normal start-up and shutdown.

Consequences 2: No real problem while the flow rate is at proper levels. In the case of low flow in conjunction with low pressure, the consequences are the same as low flow alone.

but leak excessively due to wear or malfunction.

~~

DEVIATION: HIGH PRESSURE

Cause 1: Plug in lines 2, 3 , 4 or a plug in 6, 8, 10, or 1 1 in conjunc-

Consequences I : Pressure increases very rapidly.

Remedies I : Use a design for the strong solution pump which per-

tion with a plug in line 5 .

mits reverse flow.

deviation could generate several causes and subsequently several consequences. For some cases, remedies were not identified. The main reasons for this are:

the remedies were common among some cases the team postponed the identification of remedies to

outside the HAZOP sessions the team sometimes could not identify an ap-

propriate remedy. The HAZOP study resulted in many findings which

have been considered in the enhancement of the heat pump design. Some of the findings are presented here.

Continuous Operation: Continuous operation of the heat pump can reduce maintenance requirements over the heat pump life. A control system needs to be designed to modulate over a wider range of operation.

Prolonged Cold Soak: If the heat pump is shutdown for a prolonged period during very cold ambient condi- tions, it will be necessary to raise the working fluid temperature to nearly 0 “c before attempting to restart. (No mechanism was identified at the time.)

Cumulative Corrosion: The first week of operation will experience an initial high rate of corrosion. After the first week, corrosion rate will become constant. A filter should be placed in line 17.

Low Refrigerant Concentration: If, in the cooling mode, the house is very cool, or there is a limit on the abili- ty of the house to provide heat into the evaporator, the evaporator becomes cool leading to storing out liquid. (This could happen in the heating mode when the evaporator is experiencing very cold outdoor conditions.) In an effort to produce refrigerant vapor, the evaporator must reduce pressure. Since the evaporator and the ab- sorber are in series, this leads to low pressure in the ab- sorber resulting in an abnormally low quantity of refrigerant being absorbed and subsequently low refrigerant concentration in lines 23 and 1. Ultimately, particulate will appear either in the primary generator or in the heat exchangers, leading to their blockage as well as solution pump failure. The control system should sense a shutdown condition, stop operation, and indicate in some way that service is required.

Depressurization and Particular Formation: For a very large leak causing depressurization of a portion of the system, particulates can form. This poses hazards because pockets of high pressure can still exist in the lines and can spray solution during maintenance.

Reverse Flow: Reverse flow during normal startup and shutdown lasts a very short period of time. Ap- preciable duration of reverse flow implies either a catastrophic failure or the control system is malfunction- ing by jogging the system back and forth between the heating and cooling modes within a period of several seconds. This type of event could happen especially if elec- tronic controls are used. The system becomes imbalanced in terms of solution and refrigerant being in wrong places. Excess solution will appear in the condenser and evaporator leaving a shortage of solution in the rest of the system. This leads to cavitation in the pump inlet.

Level Sensors in the Separators: Among the process variables, level in the separators is the most important con- trol parameter. Direct level sensing is difficult, expensive, and unreliable due to the presence of foam and vapor in the separators. One of the most important features of the level sensors is their ability to sense the rate of change in the level. Rate information would enable the control system to determine which parameters need adjustment and which do not. With a proper algorithm, the control system should be able to infer which parts of the system are imbalanced and the remedial action to take.

Failure of Upper Level Sensing Device: A critical need of the control system is to sense and respond ap- propriately to many different system imbalances based solely on levels at the separators. For this reason, it would be prudent to install two switches. One would be the nor- mal high-level control, and the other would function as a high limit. The latter switch would shut down the pump and the flame in the primary generator. At this point, some control strategy must be considered in detail. If the control system is simply switched from normal high-level to abnor- mal high-level (the limit), the owner is not immediately aware of the fact that a failure has occurred. The failure is

166 IEEE TRANSACTIONS ON RELIABILITY, VOL. 37, NO. 2,1988 JUNE

masked if the control system is simply reset. In this scenario where the lower level-control has failed and the system is operating on the upper level, it will operate in a very poor performance regime and constantly push solu- tion out through the vapor line. Ultimately, when a failure ocurs, it will likely be a motor failure.

Generation of Complex Chemical Substances: The potential for the generation of complex substances, previously not evaluated in the toxicity study, has been identified by the HAZOP study. The substances could be generated as the result of the interaction of the burner flame and the working fluid released during an accident. Further evaluation of this interaction should be under- taken to determine the theoretical possibility of toxic releases. If toxic releases do appear possible, a toxicologic evaluation of these mixtures should be conducted in the laboratory.

7. CONCLUSIONS A safety analysis, consisting of a safety checklist and a

HAZOP study, was conducted on the Columbia Gas Ab- sorption heat pump. The checklist was a preliminary hazard analysis. As expected, the checklist was useful but inadequate. It was useful because it helped focus on major areas of concern. It was inadequate because it was limited to a certain set of questions and did not provide a mechanism for investigating problems. The HAZOP study was successful in identifying and examining many types of risks, sources of non-optimum system reliability, and im- provements in the heat pump design. The strongest con- tributions in terms of system reliability were:

Control Strategy: Examination of perturbations on the system in the context of the heat pump control strategy. Correlation of system response to a transient with the effectiveness of the control system in either returning the system to proper operation or else mitigating the conse- quences to the highest degree possible.

Materiaf Properfies: Investigation into the material properties of the heat pump components with respect to corrosion, fatigue cracking, scaling, and stress corrosion.

Material Release: Various material release scenarios were examined. Methods for mitigating the consequences of a potential release were studied. Research was recom- mended in the potential for the creation of complex mix- tures and species, previously not evaluated for toxicity.

Alternative Design Options: New design features for controlling the presence of corrosion products, im- purities, and noncondensable gases were presented.

Maintenance: Analysis of the present design in terms of accessibility of equipment and proper procedures for good maintenance.

The basic findings in the HAZOP study were:

New pump design which increases system reliability and offers more versatility in system control.

Advantages of a solution-pump design which per- mits reverse flow.

Proposal of a staggered louvre design for reducing the velocity of accidental sprays and directing them straight above the unit.

Select materials for indoor heat exchanger which are compatible with both heat exchange fluid, water, and ethylene glycol, for example, and the heat pump heat ex- changers.

Presence of nickel in filter accumulation implies that brazed joints might be deteriorating.

Numerous sections of tubing must be brazed or welded in order to achieve the necessary sharp bends. These brazed or welded joints are primary targets for fatigue cracking and stress corrosion.

The electric motor should be made most accessible for the purposes of repair. The heat exchanger package, pumps, and controller should all share the least accessibility.

If cracks are not detectable in factory final inspec- tion then every attempt should be made to reduce rate at which cracks occur and propagate - therefore, use softer tubing.

REFERENCES

[l]

[2]

M. G. Lawley, ‘‘Size up plant hazards this way”, Hydrocarbon Pro- cessing, vol 5 5 , no 4, 1976. Imperial Chemical Industries Ltd., Hazard and Operability Studies, Process Safety Report 2, 1974, London.

AUTHORS Dr. Ahmad Shafaghi; Rohm and Haas Company, Engineering Division; POBox 584; Bristol, Pennsylvania 19007 USA.

Ahmnd Shafaghi is a Hazard Analysis Engineer at Rohm and Haas Company in Bristol, Pennsylvania. Following a BS ChE degree from the University of Technology in Tehran, Iran in 1970, he worked for four years as a process engineer. He then moved to England and obtained a postgraduate diploma in ChE from Aston University in Birmingham. Later he received an MS in Plant Engineering and a PhD in ChE (Model- ing for Safety Analysis) from Loughborough University of Technology. He then moved to the USA and worked for Battelle for four years as a Research Scientist and Systems Analyst/Planner. Before joining Rohm and Haas, he worked for Technica as a Senior Engineer for 18 months.

Bert Cook; Columbia Gas System Service Corporation; POBox 2318; Columbus, Ohio 43216-2318 USA.

Bert Cook is a Senior Research Engineer at Columbus Gas System Service Corporation in Columbus. He obtained a BS ME from Ohio State University in 1964. Since then he has been working for Columbia Gas in various capacities. For the last 10 years, he was devoted to the develop- ment of natural-gas fueled heat-pumps. Primary responsibility during this period has been as the Project Manager of the double-effect absorption heat-pump. He is one of the inventors of the basic patent of this heat

The inclusion of a gas receiver for removing non- Pump, as well as several additional applications.

Manuscript 87-805 received 1987 June 20; revised 1988 January 3 condensable gases from the system working fluid. Alternate design using a filter for collecting corro-

sion products in solution. IEEE Log Number 20949 4TRF