The Process Safety Engineer's Role in Ammonia Plant Design and HAZOP

Facilitation Process Safety Engineers have many roles on a p roject beyond running the HAZOP. This paper

explains the various reviews and activities, and presents ways to make a HAZOP more engaging and effective Jor all participants.

Glenn W. Parizot, P.E.

Introduction

Process Safety Engineers (PSEs) provide many essential inputs to ammonia plant design. Besides running the primary safety review for the project, the Process Hazards

Analysis (PHA), PSEs participate in reviewing the initia l conceptual process design, perform consequence modeling for leaks, fires, and blasts, and ensure all safety related actions are properly answered and accounted for. In addition to the above roles, a skilled PSE needs to know how to keep a team engaged and thinking in reviews in order to get the best possible product. This paper describes details of the above activities, and pre-sents ways to get the most out of the often chal-lenging safety reviews.

Roles of the PSE

For a typical engineering contractor, a PSE is in-volved in the following activities on any technol-ogy project (although this paper will concentrate on the aspects relating to ammonia):

• Process Hazards Review (PHR)

2015

KBR

187

• Piping and Instrumentation Diagram (P&ID) Review

• Plot Plan Review • Consequence Modeling • Process Hazards Analysis (PHA) • Safety Integrity Level (SIL) Review • Quantitative Risk Analysis (QRA) • 3D Model Review • Management of Change (MOC) and fo llow-

up, tracking of PHA Action Items

Depending on where you work, the above listed activities may have different names.

The Process Hazards Review (PHR)

The first step in any ammonia plant design is to find out feedstock, desired plant capacity, loca-tion, desired process technology, and a host of other details. Together, these activities fonn the des ign bas is. The Process Design group takes all the design information and puts together a Basic Engineering Design Package (BED) which in-cludes Process Flow Diagrams (PFDs) and a Heat and Materia l Balance (HMB). The PHR can also be a place to discuss the metallurgical de-sign, using the "metallurgy mark-up" of the

AMMONIA TECHNICAL MANUAL

PFDs provided by the Chief Metallurgist. These documents need to be reviewed for consistency, compliance to the original design intent, and in-clusion of any necessary details needed by the downstream engineering disciplines (even from other contractors). This "consistency check" is performed during the first Process Safety activity on a project, The Process Hazards Review is also sometimes referred to as a "Hazard Identifica-tion" or "HAZID".

The PHR is often a checklist based review, where questions are asked to Process Design to ensure de liverable documents contain necessary information for the design to continue. As many ammonia plant designs are similar, this is a good check on making sure the project specific re-quirements are covered, and any unusual, new, or otherwise note-worthy information is passed along to the downstream disciplines. For a new or revamp ammonia plant design, this review usually takes less than a day. It only covers broader topics, but may highlight any required further studies. The PSE conducts the review along with team members from Process Design, Plant Operations, Project Engineering, and some-times client representation. Actions from the PHR may carry over to the PHA described be-low.

Piping and Instrumentation Diagram (P&ID) Review

Although Process Design considers the initial re-view of P&IDs somewhat of a consistency check, the PSE can use this review as a " Pre-PHA". The ammonia process for anyone project within any contractor is often similar to other projects, but project specific details need to be considered in P&ID development.

Most P&ID reviews are led by Process Design, with participation from the instrumentation, Plant Operations, Project Engineering, Process Safety, and other groups as required. Client par-ticipation is recommended, as the review is a good introduction to the details of the process.

AMMONIA TECHNICAL MANUAL 188

In the P&ID Review, the PSE can review the drawings as if in a PHA, and look for proper con-trols, instrumentation and alarms, and other con-siderations that might be discussed later in the PHA. The more comments that can be consid-ered at an earlier time in the design development, the less work (and rework) that needs to occur later on.

Plot Plan Review

Process Safety participates in the Plot Plan Re-views, looking for safe distances between equipment based on industry guidelines, location of vents, and placement of fired equipment to be downwind of other process equipment. The PSE will also work with the Fire Protection engineer in ass isting with location of firefighting equip-ment and establishing electrical area classifica-tion. This is an ongoing, iterative process as the design continues to develop. Some work done during the Plot Plan Review is later checked dur-ing the 3D model review.

Consequence Modeling

A caveat first: although Fire Protection is a nec-essary consideration in any process design, at KBR this activity is handled by a separate disci-pline. So many Fire Protection activities aren't covered in this paper.

Depending on national, local, client, or other re-quirements, there may be the need to perform consequence modeling for parts of an ammonia complex. The PSE uses tools such as PHAST by DNV to provide information on vapor dispersion, fire, and blast.

Vapor Modeling

Ammonia plants only have a few continuous sources of atmospheric release, and they need to be modeled for environmental and safety con-cerns. The largest relt::ase is usually C02 vapor exiting the C02 Stripper column. As a heavier than air asphyxiant, C02 can present safety is-

2015

sues for plant workers at grade or elevated in platfonns. as well as concerns for areas neigh-boring the ammonia facility. The exposure limit of concern is 5000 ppm, as set by OSHA. A va-por dispersion model is set up considering all pertinent aspects of the gas being released, In-cluding: • Flow rate (including tum-down rates) • Vent diameter • Process conditions • Atmospheric/ambient conditions • Height of release, height of nearby struc-

tureslplatfonns After inputting all the necessary infonnation to the computer model, the PSE runs variations in weather, process flow, vent height, etc. in order to find an optimal result where vented streams do not negatively affect plant personnel or neighbor-ing areas. See figure I below, which shows that for a turndown release, the C02 plume does not dip below the release elevation, and as long as there are no nearby columns or structures that are at this elevation, the modeled release should be safe in regards to exposure. The C02 vent is typ-ically at the top of the C02 Stripper column, which is also thc highest clevation in the ammo-nia plant. Consequentially, this modeling not on-ly sets the required elevation for the C02 release, but it also tends to set the required height and as-sociated structure of the Stripper column.

5.ueI" """""', - ""wn"", D . _ _ •• k>o. s ..... " ". ",-",,,. N .. .,.,. . ., ... """"" CO" .... n ... . ..... """'n ~ ,"-, ...... ,

'" [,C ~"7~~. C ... _.,...,., "' ..... "'" ... "" .. . ~. co:> V...-. . ... .. '. """" ....... "" ~-~-" ... "' ..... ""', ." .",; .. , .0 00' .... 0 "''''''' . ", Cone .............. -r,,,___ 26'" ~ --" » _ "",.

s ,u, .... f'OOOor" 5 8..,_ Radia t io n v s D istan c .. ror .J .. t F ir .. 0 ... 1'

"Hazards and Operability" and is the most com-mon fonn for conducting PHA reviews.

The PHA is the most time consuming and in-volved activity for Process Safety. Running a successful PHA can be challenging, both for the facilitator and the participants. That is why it is so important to get the details right.

Set-up

Every PHA needs to start with proper planning. That means having a written plan. A PHA Plan is a document which spells out the rules to be fol-lowed for the PHA and follow-up. The plan should provide a schedule, methodology, and risk matrices. The plan should spell out which disciplines are to participate in the review, from both the contractor and client sides. It should set which issue of the P&IDs is to be reviewed, and provide a plan for follow-up and Management of Change to be implemented after the reviews have been conducted, All of this should be approved early, weeks or months before the first review.

Risk Matrices

A PHA Risk Matrix is a graphical means of cor-relating the severity and likelihood of any partic-ular scenario discussed into a quantifiable risk. Most matrices take a similar fonn to Figure 4 be-low, For PHA and especially for SIL (below), the risk matrix must address consequences in tenns of personnel (inside and outside of plant) safety, as well as environmental impact. Most clients al-so choose to evaluate risk in regards to equip-ment damage, production loss, and sometimes public perception/awareness.

It is imperative that the client provide the risk criteria for the PHA review, as it is their plant. The engineering contractor should not (and legal-ly cannot) tell the client what their risk ac-ceptance is. But some clients do need help in es-tablishing how to set up these criteria, and the PSE often plays a role in this.

2015 191

Along with Risk Matrices, the PSE and client need to establish scenario rules for the review. Rules would include what items do or do not count as safeguards and what scenarios are to be discussed (typically "double jeopardy" scenarios are not). The agreed upon rules should be printed as a guide to use during the PHA.

RISK MATRIX

Increasing Severity

Figure 4. A sample Risk Matrix

Meeting Rules

Before the PHA begins, it is good to agree how long the meetings wi ll last each day, whether lunch is provided, etc. Some sore points in many meetings is people coming and going during the review, seemingly holding their own meeting while the facilitator is trying to lead, or showing up late after breaks and forcing everyone else to wait. This is probably the hardest part of being a facilitator. You need patience. You need to listen. You need to try to decide if the group in the back corner is talking about your heat exchanger or discussing dinner plans. Sometimes, you have to cut people off and tell them to pay attention to you. You are not there to make friends, but you still have to guide your team members, and continually push them along.

One idea to keep the meeting from getting over-whelming is to not run the daily sessions for more than six hours. People get burned out to-wards the end of the day, and the value of the PHA notes suffers because of this. The Proj ect team will tell you there is a schedule to be met,

AMMONIA TECHNICAL MANUAL

but the harder you push, the less you actually get done. It is a balance.

Meeting Notes

My practice is to run a PHA with t.he meeting notes projected on a wall. Everyone has their own personal preferences on software, and some commercial packages can handle a lot of the cler-ical details. I prefer to run a PHA using an Excel spreadsheet, as it allows "on the fly" change of formatting and is easily distributed to meeting participants and action item responders after the meeting. Custom software usually doesn't allow this in its native format unless everyone else also has a copy of the program.

One thing to make clear to everyone in a PHA -The notes as projected are the official documen-tation of the meeting, and everyone in the room is party to them. So, with the exception of minor grammar or spelling errors to be cleaned up later, everyone in the meeting needs to agree with what's being said, and especially make sure that whatever is said is expressed clearly enough so that someone who wasn't in the meeting can later read and understand what was discussed.

Noded P&IDs

The best way (and industry practice) to attack a PHA is by dividing the process into "nodes", or manageable sections of the process that allow for a reasonable discussion length where most caus-es and consequences occur within the node being reviewed. There is no «rule" as to node creation, but best practice is generally to start at one major piece of equipment (a column or drum, for ex-ample) and then follow the node through, stop-ping at the next major piece of equipment. Nodes should be determined before the PHA meeting begins. And although we live in a high-tech world with large screen computer displays and projectors, marked-up P&IDs are still ideally done by hand on paper copies. This is for several reasons: • Any P&ID may have multiple nodes, and you

may be coming back to a drawing you have

AMMONIA TECHNICAL MANUAL 192

already reviewed earlier. It is easier to hang multiple drawings up on a wall "on the fly" as you need them.

• Nodes typically cross multiple P&IDs, and it is much easier to have a discussion when the review team can see the entire node at one time.

• Large size P&IDs (ideally "D" [- ISO AI] sized or larger) allow for everyone in the room to actually see the drawings, even if they need to stand up and walk over to them during the meeting.

• Although it is best to mark up the nodes ahead of time, the paper copies allow the meeting participants to revise the scope of the node during the discussion.

My practice tends to be to color mark-up the drawing set that hangs on the wall, but not the smaller sets that are handed out for the partici-pants to follow along with. My thinking is this forces the participants to look up at what I am currently pointing at so I actually have their at-tention.

Figure 5. Typical Noded P&ID

2015

The Review Itself

As mentioned, there are many different method-ologies to the PHA Review. The HAZOP meth-odology generally uses a "guideword" approach where the team works through a node based on a set of deviations from Donnal operation, such as "low flow, high flow, high pressure, etc." For each deviation, the specific cause within the node is detennined. Specific causes can be pre-populated within the notes-taking software and others will be added and modified during the ac-tual meeting.

For each specific cause (for example, under "no flow", you may have "control valve FV-XXX fail s closed when it should be controlling"), the team lists the consequences of the deviation based on the categories defined in the risk ma-trix. Next, the team detennines what safeguards are in place to protect either against the conse-quence occurring or mitigating the severity. The deviation/consequence pair is then ri sk ranked in tenns of severity and likelihood (of the conse-quence), based on the safeguards determined. If the risk ranking is deemed insufficiently protec-tive, action items are assigned to further mitigate the ri sk.

From there, it is a step by step process to go through all the guide words and specific causes within a node. And when done, it is on to the next node. Sometimes, portions of a node cannot be discussed due to lack of infonnation, such as vendor details that have not arrived yet. This gets noted so that there' s a clear reminder to come back and review those portions of the process at some later date.

The first node of any PHA Review usually takes discouragingly long. No matter how much time has been allocated for the review, everything seems worse after the first node. But do not lose fa ith. PHA reviews take on a momentum. Things you took forever to decide in node I are now fig-ured out. When the same scenario is seen again, the answer is already known. Some nodes just happen to look a lot like other nodes and can be

2015 193

copied and pasted and then "cleaned up ' to re-fl ect the particulars of the later node. It is im-portant to know you're in for a long haul , but it does get easier as you go along.

After discussing all these technical details, it is also important to note the human element of long reviews. People get tired. The reviews can get monotonous. It is important to know when to call a break or call it quits for the day. Even some-thing as silly as having a "late jar" to force team members to pay a fine for returning late to the review, and then periodically using the proceeds to buy donuts for the next day adds some variety and entertainment. And even though the review should be treated seriously, it is important to have a sense of humor and rapport with the re-view group. A typical ammonia plant PHAISIL review can last six weeks or more. You are all in this together, it is important to get along.

Action Items

There are many important things to consider when assigning action items: • Someone outside the meeting is likely to be

assigned to carry out the action, so the dis-cussion and the reasoning for the action needs to be clear

•

•

•

Proper documentation and approvals are re-quired for all action items. Do not assign ac-tion items "for the sake of assigning action items". "Provide operator training" does not address an overpressure concern, for exam-ple. The action requested needs to be clear and actually address the concern. Somebody will have to track and collect all the action items. Have a system in place. Close-out of the actions will take time, and the project team wi ll want to know progress. Have a means of measuring and reporting it. Define clearly in written instructions to the action responders what is expected in their response. Answers should be clear and in full sentences. A standardized fonn should be agreed upon before the PHA, along with as-

AMMONIA TECHNICAL MANUAL

sociated documentation to prove the action will be carried forward (see fi gure 6).

I>roj.ct ...... a ..... _R ___ r_ ~ .... _=---- --- " ..

.::::; ' ''00"" --:::; ~oc'" _ .. --- -= .• _ .. = .... -I

..

~ ,

1--

•

, , ,

-- -,- ~ -"_. -~

~

Figure 6. TYPical PHA Actfon Item Response form

Safety Integrity Level (SIL) Review

As with the PHA, there are multiple methodolo-gies towards reviewing the need for a safety shutdown system for an ammonia plant. ISA 84.00.QI or EIC 61511 are good guides of the

AMMONIA TECHNICAL MANUAL 194

accepted practices. For most ammonia plant re-views I have facilitated, we have used a SIL re-view approach. We also have run the SIL Review concurrently to the PHA, as both reviews are very similar in nature. (This isn ' t always the case for other process technologies.) The main differ-ence in methodologies between the PHA and SlL portions of the main safety review is in the con-siderations of safeguards, or more appropriately to SIL, Independent Protection Layers (IPLs). In-itial risk for SIL is considered without taking IPLs into consideration. Once the initial SIL lev-el is determined, the review team then takes the significance of the various IPLs into account and subtracts from the initial SIL. For example, if an overpressure scenario based on the fai lure of a control loop is being reviewed and the initial SIL is rated as SIL2, if the system has an independent pressure alarm and overpressure protection via relief valve, neither of those protections is related to the control loop that fai led. Each item's opera-tion is independent of the other's. So each would count to reduce the initial SIL, bringing the result for this example to SILO, or no independent safe-ty shutdown would be required.

The levels of "credit" (integrity of protection) of various types of lPLs need to be worked out and agreed upon before the SIL Review in order to get consistent results.

Items left with some level of SIL ranking will then need to be marked as action items for a later SIL Assessment where the actual shutdown in-strumentation needed to meet the SIL will be se-lected. Some engineering contractors perform both the SIL Review and SIL assessment by the same person, but at KBR, we have specialists who can more efficiently perform the assessment after the determination is completed.

My personal experience is that it works best to run the SIL Review concurrent to the PHA. The discussion format is almost identical and the par-ticipants are the same. This helps cut down the combined length of both reviews. There are times when it is necessary to run the SIL review

2015

first though, such as running a preliminary SIL Review (to be fo llowed later by a more formal one) to get an estimated instrument count to con-... ",,'" to a' d;, ".

I ::'~:- I"'""'" I"'"

, ~ ~

[''::'' ~ 1;;;-

I~'" ,~' ,

1='=

,;;;;'" ,

,

, , ~.

, I;;;'

l'~ I~~ - - 1-

~ :::-, I~ -"~

Figure 7. Sample PI-I . jf, Discuss ion Notes

Quantitative Risk Analysis (QRA)

Depending on the client and what scenarios need to be investigated, a QRA to review certain con-sequences may be required. The QRA is a risk based analysis generally used for setting the loca-tion of occupied buildings in the ammonia facili-ty. The analysis reviews scenarios such as leaks causing fires, toxic dispersions, and blast over-pressures, all based on industry data for likeli-hood_

2015

111--) .-- ~ I_ow _.-

"--,

195

I-'~,

1--

1--"

,

KBR generally prefers to hire a third party to perform the QRA. This is in the client 's best in-terest. First, we are building the faci lity. We are not impartial. Secondly, the engineering contrac-tor is not the best judge of what ri sk scenarios and their likelihoods should be considered. We do help the third party in collecting the necessary data for the QRA, and there are typically several discussions among the contractor, client, and third party_

AMMONIA TECHNICAL MANUAL

3D Model Review

Subsequent to all of the above reviews, as engi-neering design continues, group reviews of the 3D model of the plant take place. Process Safety participates in these reviews, making sure that a ll decisions from the PHA and required vent eleva-tions from consequence modeling have been properly implemented. Sometimes during the 3D model review, new areas of concern a re spotted, and Process Safety may be asked to review those items.

On onc ammonia plant design I recently worked on, steam vents seen in the 3d model review looked like they might be too close to elevated platforms. Process safety modeled the vents based on the temperature of the release plume. This was an unusual scenario to model, as steam doesn' t fa ll under the flammable, toxic, or explo-sive categori es we usua lly model. The vents all were found to be located safely in regards to any n~urby operators. (Se~ figur~ 8 below)

Management of Change (MOC) and follow-up. tracking of PHA Action Items

All of the previously mentioned reviews are meaningless if no one fo llows through and makes

AMMONIA TECHNICAL MANUAL 196

sure all the action items are properly completed. Proper documentation of these actions is also a cri tical component of the client's later Pre-Start-up Safety Review. The abil ity to track the pro-gress of completion of the PHN SfL action items (and any other outstanding safety concerns) is es-sential. Periodic reporting on these actions is re-quired.

In addition to tracking actions from the safety re-views, a system must be put in place to track any post-PHA changes to the P&IDs and other criti-cal documents. Typica lly, Process engineering will track P&ID changes, with the PSE review-ing every change in light of what was discussed in the PHA. Any change that might affect the prior discussion is marked for follow-up. Period-ic MOe PHA meetings are he ld to update the PHA notes to reflect the changes, possible result-ing in new action items. This process continues until the completion of construction and the am-monia plant is turned over to the client. As with the PHA actions, track ing which P&lD changes require a MOe PHA review is critical.

Conclusion

A Process Safety Engineer has many roles on an engineering project. The PSE is involved contin-uously throughout all stages of the design. The contributions of the PSE help ensure a safe and reli able ammonia plant design.

A good Process Safety Engineer must have un-derstanding of the ammonia process, as well as the safety concerns that need to be investiga ted during design. The PSE needs to be organized, able to keep track of what has been reviewed, and know the status and approve the resolution of all safety re lated actions that transpire. Hav ing a knowledgeable PSE as part of the design team is key to a successfu l ammonia plant design.

2015

References

Process Safety - General • "Guidelines for Engineering Design for

Process Safety", CCPS (Center for Chem-ical Process Safety), American Institute of Chemical Engineers

Consequence Modeling • "Guidelines for Use of Vapor Cloud Dis-

persion Models, Second Edition", CCPS (Center for Chemical Process Safety), American Institute of Chemical Engineers

• "Guidelines for Evaluating Process Plant Buildings for External Explosions, Fires, and Toxic Releases, Second Edition",

PHAIHAZOP

2015

• "Guidelines for Risk Based Process Safe-ty", CCPS (Center for Chemical Process Safety), John Wiley & Sons, Inc.

197 AMMONIA TECHNICAL MANUAL

AMMONIA TECHNICAL MANUAL 198 2015