~ . . 1 r' .. . .

:;::: ~------- - -------

: l

. _ .. _,--------- ,_ .. ,--_. - -_. --

,

I: SAFETY ,

_ ... __ .. - ;

--'~~~-.--~~~A~$PEC T SO F-- ........... -~. MAINTENANCE

;~ , J ;

,

~.- "

r I

I . , L ,

I' , L

r !

! , i

, i ,! i

SffETY ASPECTS OF NAINTENANCE

by .-.~ - ---._- "--'- - .. _-- -._--. ! Dr. H. Farabi

Depdrtment of Chemical Engineering The! University of the West Indies

st. Augustine

A sound, efficient maintenance programme is essential in any

industrial establ ishment. Such a programme will keep the physical , i -- -- - .. . - . - - - -- ---.-

plant in good conditior and will reflect favourably in the safety record.

Too often maintebance is thougllt to mean only repair. Considerable I

emphasis should also be placed on preventive maintenance and on the

type of inspection tha~ will discover conditions pertaining to tile building or eqUipment ~hich, if uncorrected, might resuJt in accidents.

The need for maihtenance on a plant implies some abnormality j

and often some increast in hazard. The ~onduct of the maintenance - . . "j -

~ . ~ work may-a Iso-i-ntrodUcr-~i ts-own haz

- 2 -

,.

can seem a confusing maze of vessels and pipework, much of it lagged,

andit is oftendiff~cult toident~.f:y-equ.i.pmenL-uri.ajded.s.i.mply.by tracing

the course of pipework or by the use ~f other clu~s.

It is necessary, therefore, to adopt a mOi-e positive policy

the identification of equipment.

One method which may be used is to attach a permanent identification

to.a particular equipment.

Identification should be consistent and should accord with reason-able expectations.

the identification

Another method of identification; therefore, is

tag. This is particularly useful for joints, but

is applicable to other equipments also instead ofiPermanent identification.

The ideritification of the equipment, permanent or ,temporary, should

be given on the permit form .

. __ Lsolatio.nof plant ----- ~-~~- -~-

- -- - - --. Another fertile source of. inc i dentsi s . i nadequ ate_iSQJ,;.tjonof .

equipment on which maintenance is to be carried out. It is essential

for there to be positive isolation both with respect to process materials

and to moving parts.

Isolation from process fluids is sometimes c'arried out by closing

an i,solation valve on a line, .but thisis.not .a.completely effective

method of isolation. There have been numerous inc~~ents in which'either

the valve has been opened in error or the valve has corroded or jammed

and has passed fluid. It is necessary, therefore, to effect more positive

isolation.

Equipment such as a pump or an agitator should be isolated by

locking off the starter and/or removing the. fuse."_.A notice. should

be hung on the starter prohibiting startup of the device.

Other preparatory measures

After the plant section has been isolated ani:! before maintenance

r I ,

. I L

I.

r---i j

I ,

r I

- 3 -

work is done the section should be vented to release pressure, drained,

and, if necessary, cleaned and/or purged.

Venting is norma11y to atmosphere at a safe place or into gas

absorption equipment. Liquid is drained into a container or, if the

liquid is expendable and it is safe to do so, into the works drain.

In this latter case the drain should then be flushed with water. Clean-

ing/purging is by air, inert gas, steam or water, as appropriate.

CONTROL OF MAINTENANCE

Permit systems

Maintenance and modification of process plant involves many

potential hazards and it is essential that this work be controlled

bya formal system of permits -to-work.

The object of the permit system is to control the conduct of the maintenance activities- by specifying the work to bedone,-bjldeTinirig-

the responsibilities of individuals, by eliminating hazards or protecting

against them, and by ensuring appropriate inspection and testing.

Types of permit

Permits-to-work- have a variety of names: clearance cer~ificaes,

fire permits, etc.

Permits may be classified by reference to the operation to be

performed, the equipment to be worked on, the classification of the

area where the work is to be done, the special hazards which may be

encountered, the equipment to be used or the tim\,! .. of day specified

for the work. A list of typical permits, which illustrates all these

categories, is as follows:

Operations

line breaking

vessel entry

hot work

waste disposal

equipment removal

excavation

Equipment worked on

electrical equipment

sprinkler system

Area classification

flammable area

Special hazards

fire

corrosive substances

toxic substances

- 4 -

.- ---.-------~~-- ----------------

.- .'-'-"'-.-"--~"-- - ---------- -------------- --------- _.- r !

Equipment used

.-mobile crane -=f: --Time of day

after hours work

Contents of permit

A typical permit-to-work, in this case a clearance certificate,

is shown in Figure 1.

Some important features of a permit and its use are as follows.

The section of plcint and the item of equipment on which work is to

done should be specified. The equipment may be idehtified by an

identification tag and this should be cross-referenced on the permit.

The nature of the work to be done should be clearly described. There

should be a certificate that it is safe to proceed- with the work.

This certification means that the possible hazards have been considered.

The precautions already taken, such as isolation of pipes and of moving

machinery, should be stated and so should those still to be taken,

such as use of breathing apparatus. The period of validity of the

r

I

- 5 -

certificate sllould be shown and cross-references given to other related

certificates. The permit should be signed before the work is handed

over by the issuing authority and by the recipient and preferably by

all tile individuals in~olved in the work. When the work is handed

back, the permit should again be signed by these two parties.

Types of perm it sys tem

The permit syst~m for a given job may be either a one~ or a two-

stage system. In the ~ingle-stage system there is one permit normally

issued by tile operations supervisor to the ~aintenance supervisor ..

In the two-stage system there is a furt~er permit which is issued

by the maintenance supervisor to the members of his workforce who are

to do tile job.

-An-otller differen-ce of practice in Hepersonnelwhci- are- autllorized-

to issue or accept a pen~it-to-w(jrk. Typically these are the -operations

and maintenance supervisors. In some firms, however, certain permits

are issued by the s~fety officer.

In a particular permit system a given job may require more than

one document. There may well be other certificates which are necessary

before tile main permit .an be issued. A test certificate for analysis of the working atmosphere is a common example.

Tile job may be subdivided and separate permits issued for each

subdivision.

Some types of permit relate to higher levels of hazard than others

so that there is a hierarchy of permits. Thus t.he lowest level of

permit may be a clearari.ce certificate, followed by a safety certificate

and finally a fire certificate.

Operation of permit systems

There are many practical problems in the operation of a permit

- G -

~.--.---.. --------

system.

It is a principal object of such a system to: define the

responsibilities of all conce~ned. The exact division of responsibility

between operations and maintenance supervisors, for example, may vary

according to circumstances. It should be absolutely clear, however,

in a given case where the responsibility lies.

The norm is that the operations supervisor. is the issuing authority

and the maintenance supervisor is the accepting authority. It is the

responsibility of the former to ensure that the plant is safe for the

work to proceed. The latter is responsible for ensuring that the further

working precautions are taken. In certain cases, such as maintenance

work on switchgear, the operations supervisor is not competent to give

clearance so that the maintenance supervisor has gceater degree of

responsibility than usual.

-Another-object of a permit-systemis to ensure that--thepe-oj3le--

who actuall~ have todD the job understand what is ~nvolved. Iti:;

very desirable, therefore, for the maintenance men to read the permit.

This is not easy to achieve, since the general content of permits rapidly

becomes famil iar. In some systems there is a requirement that the

men countersign the permit. The device of affixing the permit in a

plastic case to the equipment to be worked on is al~o used. ..

~.

It not infrequently happens that there is a change of intention

while the job is being done. An example is a change from work on pump

bearings which does not involve breaking into the process lines to

other work which does. If such a change of intention occurs, a separate

permit should be issued.

The area affected by the work should be considered carefully.

Work at a particular plant may affect or may be affected by adjacent

plants. It may be appropriate in certain defined cases to require

the supervisor on such a plant to countersign the permit.

--r I

r-i

r

[ l.

r ; b

/ " ,.

//.t' ..... '1~

I

- 7 -------~. ----- ------------- -

Tilere must also be clear arrangements for the discharge of permits.

Tile system should normally be that the permit is signed off only by , the maintel]_ancesupervisor to whom it is issued or by ahother supervisor

of the same trade and responsible for the same area of plant and that

a fresh permit is issued each time work is resumed. Lack of cl arity

canr_e.sult in_b_rea_k_dow_n __ of the permit arrangements, as the following

case illustrates. A maintenance fitter left a job unfinished overnight, intending to resume it, next day. The job was signed off, however,

by another of the maintenance personnel. When the original fitter

began work next day, the plant was no longer safe for work.

Audit of permit systems

It is not enough to create a permit system to control maintenance - ---- -- -----., --

___ -"'yrk:-.:_::T_her-eshould also-be arrangements for the audit of the system

--to-ensore-that--H--is-operating properly. These may consist of a speci-fic

instruction to the plant manager to check each week a prbportion of

the permits issued.

MAINTENANCE ACTIVITIES

Emptying, purging and cleaning

Much maintenance work requires the prior removal of process , materials from vessels and pipes. Frequently these materials are

corrosive, toxic and/or flamrnable.

The normal procedure for emptying a vessel or pipe_ is to isolate

it, to vent to release the pressure and then to draw off tile contents.

It is then-frequently necessary to remove-t~aces of process rnaterial

from the inside of the vessel or pipe. This may be done to render

tile equipment safe for'welding or to allow people to work inside.

When welding has to be done, the removal of process material

should be rather thoro~gh .. Some materials form residues wllich are

very difficult to shift and which can adhere to the sides and. roofs

- 11 -

as well as the bottoms of tanks. These residues can give off flammable

vapours at the high temperatures used in welding.

There are various methods which

of process materials from equipment.

mechanical washing and hand cleaning.

may be used to remove traces

These include steaming out,

Washing with cold water or purging with air are not effective

methods of removing oil. Reliance on these method~ has been the cause of many accidents.

The problems of preparing equipment for maint,enance work have

already been -considered in relation to vessel entr~ and are considered

further below in connection with line breaking and demolition.

When it is necessary for the atmosphere in an) equipment to be

free of flammable or toxic materials, this should bee checked positively

by chemical analysis by a competent person. If the: work is prolonged, ';

-repeat- checks should be made. --- ----

Breaking of pipelines

Breaking into a pipel ine can invol ve a number! of hazards and

it is necessary to exercise considerable care.

For the breaking of a pipeline there should be clear instructions

on the work and on the area in which it is to be dOne. Information

should be given on the material in the line and its;hazards, and on

precautions to be taken.- The joint to be broken should b~ indicated

by an identification tag. The \~ork is normally covered by a permit-

to-work.

Some preliminary measures and precautions include

isolation of the working area and posting of warning notices;

_ provision of safe access;

support of the pipe on either side of the joint; isolation of the pipe section;

release of pressure from the pipe section;

(

r

f [ /-:

, -I ,,:.-.

r b

--'.- .. -- .-:~----------;-- --- - 9 -

draining ofth-epipe--sectTon anilliilfftning-of the fluid drained;

precautions against fire;

protection of personnel. - ... - -,. - -' - - -- - ------_. -----_._- _. . ~-.---.. -. - ..

The joint to be broken should be isolated. Pumps or other devices

which could put the joint under pressure should be switched off. Measures

should be taken to release the pressure_2n the 1 ine.

It should be assumed, however, that the pipe may be full and

under pressure, and precautions should be taken accordingly. In

particular, it may be necessary.to use protective hoods or equivalent

equipment.

Some joints are difficult to break and thus constitute a potential

hazard. A persistently troublesome joint should be reported by the

maintenance men. - An ai ertsupervi sor-will recogn i ze such a joint as ----~- ------

--~a probi em.---:- --

The-pTpewbrk designer -also ha,-a-cDntribution-to make by building

into the design enough 'spring' to facilitate the breaking of joints

which must be broken frequently. Alternatively, a slip ring may be

installed.

After breaking, a pipe is sometimes found to be choked. The

blockage may be removed by means such as digging it out. But it should

not be cleared by using air or gas pressure. The danger IJere is that

the plug of material will be ejected as a projectile.

The ends of pipes on the installation should be blanked off.

Tank repair and demolition

The repair and demolition of tanks is another operation which

has given rise to a number of accidents and requires careful precautions.

The principal hazard is fore/explosion of the flammable material

ignited by operations such as welding or cutting. This hazard is usually

well understood with volatile liquids, but it is not always appreciated

<

- 10 -

--------

that it exists with relatively involatile liquids and residues also.

Residues can contain considerable amounts of volatile material which

constitute a fire hazard.

The main risk is that residues catch fire, volatile material

is evolved and a more serious fire/explosion occurs. Heat from the

cutting torches alone is generally not enough to vaporize sufficient

material to create a vapour explosion risk, but it does provide a source

of ignition for the initial residue fire.

Residues are not confined to tank bottoms, but occur also on

walls and roofs. If the inside of a tank is covered with a thin film

of flammable material, a film fire can occur which can result in a

serious fire/explosion.

In certain cases volatile materials which can polymerize may

. -1 eave so 1 i d po lymer res i dues on the upper wa 11 s or the roof. Such

-------mater-ia-lsare. usua11yprotected against polymerization in the-liquid

phase by inhibitors, but this does not stop polymerization in the vapour

phase.

Hot work and welding

The principal hazard of hot work, including welding, is that

it introduces a source of ignition.

There are some plant areas where such an igoition source is not

normally allowed. In these areas special precautions and formal

procedures are necessary for hot work.

It is essential, therefore, for equipment to- be worked on to

be clearly identified and to be isolated, emptied and cleaned, tested

for flammables and inspected.

It may also be necessary to protect neighbouring equipment by

some means such as shielding.

In certain circumstances it is desirable to assign a fire watch

r i

I

l .

- 11 -

to monitor any fire which may start as a-resuH-o-f this work~--such

as smouldering material.

Further aspects of welding are considered below In relation to hot tapping.

Eguipment removal

The removal of equipment from the plant to the workshop can create a hazard if flammable or toxic material may be trapped inside it. It is necessary to have some procedure to deal with this problem.

Equipment which is installed but is no longer required should

normally be removed. This applies to all kinds of equipment whether

it be vessels, pumps, pipes, instruments, fuses, etc. Unused and often disconnected equipment _ is a fertile source of accidents_;

MAINTENANCE EQUIPMENT

Tools

Tools such as hammers and spanners have been con-sidered a possible

source of igriition and non-sparking tools have been developed.

Materials used in such tools are typically aluminium, bronze

or monel for tools that have to withstand impact or torque such as

hammers, spanners, and crowbars; copper-beryll ium alloy for tools

requiring a cutting edge or gripping teeth such as knives, chisels,

saws, drills, pliers and shears; and plastics, leather, fibre and wood

for shovel and scraper tools.

These tools have a number of disadvantages. _ Generally, they

are more expensive fand they are softer and tend to burr. Moreover,

particles can more easily become embedded in them, thus reducing their non-sparking qualities.

The API has issued a number of reports over a period of years

on non-sparking tools (e.g. API 1973 Item 23). The general conclusion

- 12 -

is that such tools have limited value. It was considered that an

incendive spark -of -s-teel would be unlikely to be produced manually

and that power Dperation would be needed. Possible exceptions are atmosphei-es fl ammab 1 e due to the presence of hydrogen ~ acetylene, ethylene

or carbon disulphide.---

Thus instead of using all types of non-sparking tool in flammable

areas a more limited use may be preferred. One policy is to restrict

their application to the use of non-sparking hammers (though not spanners)

for the hardening up of leaking .joints on lines containing the above

four gases.

Lifting equipment

Lifting equipment has been the cause of numerous accidents.

There are statutory requirements, therefore, for the registration and regu lar inspection _of _equ.Jpm~-rifsuch as ch_ai ns , s lings and ropes. These'ar-'e--gTvenJnthe FactorleS J\ct1961 :--10 X.};

Only this properly registered and inspected equipment should

be used for lifting.

In process plant work incidents sometimes occur in which a lifting

lug gives way: This may be due to causes such as incorrect design

or previous.overstressing.

Mobile cranes

Mobile cranes present several different types of hazard. One

is the danger of collision with process plant, pa~ticularly pipebridges, when the crane is on the move. A minimum measure to prevent this is

clear identification of pipebridges, but it may be advisable to resort

to more positive protection, such as a crossbeam in front of the pipe-

bridge which obliges the crane driver to lower the jib.

Another type of hazard is the overturning of the crane on to

r'--j i :

r ' f

l L

- 13 -

process plant. For a given crane there- is a maximum safe load and

maximum safe jib radius. There is normally a safe load indicator,

but nothing to indicate the safe jib radius. If this latter is exceeded,

the jib itself constitutes the main load and a small additional load

may be enough to topp 1 e the crane.

It is important for crane drivers to be well trained in the operation and limitations of their cranes and in the special hazards of process plants.

A rather less obvious hazard in cranes hired from outside

contractors is the use of cab heaters which are not sui~able for flammable

areas. A heater is needed, but it should be of an appropriate type.

Forklift trucks

- It-i s-conven i en-t--to-note-here the- Iliizards ass-o-clatedwj th:TorkJjJ~t_._-~~~_

trucks. IncidEnts _ar.e numerous in which for~li_ft trucks are driven

into and damage buildings and plant, including process plant. Pipework

is particularly at risk.

It is desirable, therefore, to review the routes which are used by forklift trucks and to consider whether there is a need for special

protection of vulnerable features such as pipebridges and for special

training for drivers.

SOME MAINTENANCE PROBLEMS Materials identification

Misidentification of materials is a significant problem. Materials

errors may occur in maintenance ~Iork. Situations in which they are

particularly likely are those where the materials look alike; e.g.

low alloy steel and mild steel or stainless steel and aluminium painted

mild steel.

It is necessary, therefore, to exercise careful control of

- 14

~-- ~---~---------

materials. Methods of reducing errors include marking, segregation and instrument Sj:lOt checks. -

Component identification

Thus confusion can easily arise, for example, over pressure relief

valve components, with the result that a relief valve may be put back

on the plant with too high a setting. This type of error can readily

occur with similar components made by the same manufacturer.

Similarly, it is easy for slip plates to become mix~d up so that

a slip plate suitable only for a low pressure duty is used on a high

pressure application.

A particular type of component identification error is fitting an equipment with a component which alters its performance. Thus the

capacity of a control valve may be increased by putting 51la_wr.ong

r I

[' trim,- or the de l-iver;y--pressur.e of..ci -pump ma:y_ ... b:e_Jot.t:ea.s.e...d-=_bY..::.ftttiOg_-:-::-.:.. __ ... __ __ _" .~ wrong impeller.

There is need, therefore, for systems of control for such critical

items.

External corrosion

External corrosion beneath lagging is a considerable problem

on process plant. It is important that the maintenance system should

check on external corrosion.

Such corrosion occurs particularly on steel equipment in the

temperature range 0-1250 C. Below OOC the surface is protected by ice, while over 1250 C water evaporates. Use of types of mineral wool

insulation which are acidic can exacerbate the problem.

There are various forms of corrosion which can occur due to agents

other than water. Chloride attack occurs from chlorides which are

leached out of some insulation materials. It can also arise from thermal

l

~,-j

t::-" l:. !

f L-.l

. - .

. ~-.

- 15 -

decomposition of PVC labels on very hot pipe surfaces. Nitrate attack

arises from the use of nitrite treated water on plant surfaces.

Supports for storage tanks and vessels are a common site of external

corrosion.

Pumps and other eguipments

Pumps are the source of a large proportion of leaks and fires

on process plant.

The leakage often

A common fault is seal failure with resultant leakage.

ignites and causes a pump fire. Another frequent

fault is bearing failure, which can induce a seal failure. After a

pump fire it is' not always easy to tell whether the seal or bearing

lIas failed first.

Reduction of pump failures is partly a matter of design and

... ~s~l.ect io.n, but maintenance -aspects- are -a 1 so important. Many fau lts -- _. --- --

can be forestalled by a careful overall check when a pump is taken

off for other maintenance work.

In addition it is not uncommon for faults to be introduced in

the course of' maintenance work. A simple example is misalignment of

the impeller shaft when the pump is reassembled.

Faults of this kind point to the need for proper systems of work

maintenance and for adequate training.

Similar problems arise with other types of equipment .

Small bore connections

Small bore connections are another source of-leaks and fires .

. Such connections are often abused. Heavy pressure gauges or valves

may be fitted to them without adequate support. They are frequently

overtightened, sometimes with a pipe wrench. People stand on them

to reach isolation valves.

- 16 -

MODIFICATIONS TO THE PLANT

Some engineering work on plant goes beyond mere maintenance and

constitutes modification. Such modification involves a change in the

.plant and/or process and can introduce a hazard.

The outstanding example of this is the Flixborough disaster.

The Flixborough Report (Parker, 1975, para, 209) states: 'The disaster

was caused by the i ntroduct i on into a we 11 des i gned and cons tructed ----

plant of a modification which destroyed its integrity.'

It. is essential, therefore, for there to be a system of identifying

and controlling modifications.

Modifications may be made to the plant or the process or both.

Types of modification

r i I

t .'

r

, . I ,

Modi fi cat.i onsmay _be_ctassjned~cc_ordjngtQ..J:tJe.:.st,,:g~ofJ:ll.E!.......:- ------ -- r ~-~~---I:

project at which they are made:

(1) design modifications;

(2) commissioning modifications;

(3) operating modifications.

They may be. distinguished by the degree of permanency:

(1) temporary modifications;

(2) permanent modifications.

And they may be classed by the level at which expenditure decisions are made:

(1) non-sanction modifications;

(2) sanction modifications.

'These different situations tend to have their own characteristic hazards.

Modifications made during the design process really fall outside

the present discussion, which is mainly concerned with the stages of

-1 , I

r' !

I -:-: I l

.. : . -~;---- - 17 -

commissioning and operation. It is sufficient here to re-emphasize

the points already made concerning the need to ensure that at the design

st

- 18 -

forgotten that it is necessary also to check the relief valve capacity,

which is reduced by the derating.

Similarly, an increase i~ plant throughput me,) rp-n if i Y'P . -,- .. - a change

in pressure.relief valve capacity.

The ease with which hazards associated with pressure relief can

arise means that the check that the modification has not invalidated

the pressure relief arrangements is particulariy import~nt.

Other hazards of modifications

Modifications can invalidate not only pressure relief but also

instrument systems. In particular, a situation may be created where

an important measurement signal is degraded by the interposition of

a restriction filter, etc.

A commonrnOd i fi. ca ti on i s . .:tp.e temp~l"~ rjlJ.eplacelllent or bypas ~1 flg _______ .. _ .... of a unit such as a reactor or heat exchanger with a length of pipe.

This appears to be a simple matter, but it is still necessary to design . .

the pipe properly and to provide proper supports. The hazard is shown

by the Flixborough disaster.

Alt~ration. of a device which in some way limits flow or pressure

can create a hazard. Examples include the removal of a restrictor

oriftce inst~lled specifically to restrict flow, increase in the size

of a valve trim or installation of a pump impeller capable of a greater.

head.

Modifications which appear quite minor can nevertheless introduce hazards.

Other hazards are listed in tile form for the-control of

modifications shown in Figure 3.

I

k:.

. ,. ,. i

. I

; t, -,

I !

L

- 19 -

--------- . __ .. _-- .--.~-------~--"-.. ---------Modifications to the process

The lesson commonly drawn from the Flixborough disaster is the

importance of maintaining the integrity of the plant and of-avoiding

degradation due to a plant modification.

The plant can also be put at risk, however, by operation of the process ou-tside-fhe-en-velope of operatingconditionsT6rwhich the--

pressure system is designed. It is essential, therefore," to control " ,

such process modifications as well.

Moreover, even if "the envelope of operating conditions remains

the same, cilanges in operating practice may affect featurei such as

inspection and proof test intervals, which tend to be base'd on historical

plant experience.

CONTROL OF MODIFICArIONS

The elements of a system for control of plant modification are

. (1) procedures, (2) assessment, (3) inspection, (4) documef1tation,

and (5) training.

There shou.ld be a formal procedure which requires all modifications

to be author,ized by competent persons and a standard method of making

the safety assessment; there should be a system of inspection of

modifications by a competent person to make sure the work h~~ been

done as intended and is complete; there should be a system of docu-

mentation to record the change; and there should be adequ~te training

so that all personnel concerned understand the system of control.

Authority for modification

Systems for the control of modifications and the levels at which

particular types of modification can be authorized vary somewhat, but

the basic principles are quite clear. There should be a well defined

and understood system of authorization.

<

- 20 -

The system, is that any modification to a plant or process must

be authorized in writing by a competent manager and engineer. This

applied to any modification, however cheap and temporary, as well as

permanent modifications. The level of authorization is uSllally the

lowest level of technical executive management, i.e. plant manager

and plant engineer. If the modification involves instruments or electrical

equipment, an instrument or electrical equipment, an instrument or

electrical engineer should also approve the modification.

It is essential that these work personnel be capable of recognizing

problems which lie outside their sphere of competence and be willing

to consult other experts. In effect, they should adopt the approach

of the general practitioner in the medical field.

Major sanction modifications are designed in the usual way by

the design departments.

! , --

,

I

Design authority -------- ------ -- r Some modifi~ations require to be checked or completely designed

by an appropriate design authority.

There is a problem area here. Many plants are designed and built

by outside contractors, who initially have the greatest expertise about

the plant but also eventually lose touch with it. -

There is, therfore, typically a transfer of expertise to a design

authority within -the operating company and often within a particular works.

Identification of modifications

The identification of modifications is a cru~ial problem. There

is usually a large amount of maintenance work. It is necessary but

not always easy to identify items which in fact constitute

modifications.

r

[ L

L r

- 21 -

This requires til at a modification be defined. Tile following

two-part definition is given by Henderson and Kletz:

'(1) Any change in the equipment, temporary or permanent, .which

may affect the safety of the process or safety and integrity of the

plant. It does not include changes in engineering equipment which

are not in contact with the process and cannot affect the safety of the process or the safety and integrity of the plant.

(2) Any change in process materials, services, operating conditions,

or operating procedures, and including experimental programmes, which

fall outside established practice.'

Tile first part of this definition covers those equipment changes

which are normally understood as plant modifications. The second part

brings in also the process modifications.

I r\1:he"sys tem oescri bed by-theseauthors--it--isc-the-respons i bi I ity-----------. - - -. --- .. _ .. ~---

of the plant manager and plant engineer toidenUfy.mo,difications.

Critique of modifications

Modifications proposed are not always necessary. Sometimes the

proposal is a symptom of a problem which is better dealt with in some

other way.

It is appropriate, therefore, tllat a proposed modification should

be considered critically. Questions which may be asked concerning

it are: Is it necessary? Is it economic? Is there a better alternative?

Procedure for modifications

Before authorizing a modification particular attention should

be paid to ensuring that

'(1) The number and size of relief valves required are not changed

(or any necessary changes are specified).

(2) The electrical area classification is not changed (or any

<

- 22 -

necessary changes to the electrical equipment are specified).

nr-- There are no effects on tri ps or a I arms (or any necessary changes are specified).

14) There are no other effects which might reduce the standard of safety.

(5) The appropriate engineering standards are followed. (6) The right materials of construction and,fabrication standards

are used.

(7) Existing equipment is not subjected to conditions beyond

the design basis without checking that it can withstand the 'new conditions ..

(8) Any necessary changes in operating conditions are made.

(9) Adequate instruction and training are provided to operating

and maintenance teams.'

--- Safety assessment of modifications

These procedures need to be supplemented by a system (or -the

identifi~ati~n of h~zards in-the modification.

The method described by Henderson and Kletz makes use of the

safety assessment form shown in Figure 3. The form is best completed

not by a single individual but by two or three people working together.

The top half of the form provides check words which form the basis

for a hazard- and operabil ity study and the bottom half a more conventional checkl ist.

It is found helpful in making the safety assessment.to assume

that, until it is shown otherwise, any isolation valve or other restric-

tion will isolate an equipment from its protective .. device, e.g. a vessel

from its relief valve, and that any new line will introduce some unwanted

contamination, overpressure of some equipment or more flow into some

equipment than its outlet pipes can handle.

This procedure, therefore, makes use of a standard form to initiate

a safety assessment which goes beyond the use of a checklist.

r-, I r

r

f ' I

~",,:.;, g:~

r r - '

!

, L

L

- 23 -

Inspection of modifications

It is the responsibility of the person authorizing a modification

to carry out a pre-commissioning inspection of that modific.ation _and __

to satisfy himself that it is in accordance with the design intent,-

that the standards for design, construction and testing have been followed,

that the _provisions of the safety assessment~ave been met and that

the work is complete.

Documentation on modifications

It is essential that plant documentation be kept up to date and

therefore that any modification be recorded. This requirement may

be met by the use of a formal register of modifications.

-If the modification requires-alterations to operatingor-inspe~tion----pract ices ;-i-j;--=i-s-necessari-that- the -appr':-opriate--ha-ng-es -be-made-in --------

tile documentation covering these asp_ects.

Training on modification systems

A system for the control of modifications can only work if-all

the personnel involved are aware of and have an -understanding of the

system through training.

The process operator who may turn off an agitator the maintenance

fitter 11ho may blank off a vent, the instrument artificer who may al ter

a trip setting, need to be a\1are of the hazards which these types of

modification may involve and of the system of control of modifications.

The plant managers and engineers who authorize modifications

need to have the theoretical knowledge, general 'practical experience

and experience of the particular process and plant to recognize potential

hazards, and also to appreciate situations where they should call in

expert assistance.

< ./

-'"

- 24 -

Commissioning modifications

The commissioning stage tends to involve numerous modifications

at a time when the plant manager and plant edgineer are heavily loaded .

. It may be appropriate, therefore, to appoint special personnel to check

these modifications. People who have been involved in hazard

identification during the design stage may well be suitable for this

task.

It is also advisable to conduct a post-commissioning check of

the pressure relief and blowdown arrangements about a year after startup.

Variations in modification control

The system for control of modifications just outlined is essentially

and is intended primarily for large continuous petrochemical plants.

--_It - is-emphas i zed that other systems may be more appropri ate for other

~-~~'::--=~ype's'-~of:-p-i-ilnf-,-anllough-the-bas.i c pr i nci p 1 es remain app 1 i cabl e:.: :

SOME MODIFICATION PROBLEMS

Materials aspects

The materials for modification or repair should be 'suitable'

and should have properties at least equal to that of the parent material

originally used. If advanced codes apply, the materials should have

guaranteed minimum properties and should be so certified.

It is a 150 necessary that both' parent and rep 1 acement mater i a 1 s

should be capable either of withstanding the fabrication processes

without losing the required properties or of havin9 these properties restored.

The availability of suitable material may be' a problem, either

because it is no longer made or because delivery times are long.

The parent material is sometimes degraded and. may require treatment

before welding can be done on it. Thus, for example, if there is surface

, ' i i

F'

! -----!

L

. ' ;

l

- 25 -

sulphur contamination, it may be necessary to remove the contilmlnatTo,Y

by grinding and then to preheat to allow welding.

In some cases the parent material may have been rendered unweldable

by high temperature exposure or hydrogen attack.

The application of quality control procedures can give rise to

difficulties. There has been continuous progress in the measurement

of defects in materials and in acceptance standards. The situation

can eas ily ari se, therefore, where the quality demanded for the rep I ace-

ment material far exceeds that of the original equipment material.

The properties of both parent and replacement materials may be

affected by activities such as cold working, preheating or ~elding.

Materi a 1 prope,t i es may be res tored to some ex tent by su i tab 1 e heat

treatment, but the heat . -are~-s-tr'i ct 1 yl i m i teo;

MAJOR PLANT EXTENSIONS

Design of extensions

treatment operations which can be carried out

A major extension involves changes on a greater scale than a

normal plant modification. This means that it is particularly necessary

to check on the various facilities which may become inadequate ,or over-

loaded as a result of the extension. Some features of the design which

should be checked with this in mind are (1) pressure ~elief valves;

(2) vent, flare, blowdown and absorption systems; (3) drains and sewers;

and (4) trip systems.

The design, location and capacity of the pressure relief valves

should be checked and sufficient spares should be provided. A review

should also be made of the need for liquid thermal relief valves on long sections of off-site pipeline which could be boxed in.

The facilities for gas and vapour relief, for flaring, for liquid

blowdown and for emergency absorption should be checked.

---~ .. - ...

The check on sewers and drains should cover not only the capacity

- nf-the underground sewers, but also that of the surface drainage so

as to ensure disposal of fire water.

A major extension also involves more Extensive changes of plant

configuration. It is particularly important, therefore, to check not

only tha~ there are suitable trip systems on the extension itself,

but that those on the existing plant are also still appropriate.

Layout for extensions

The problems of pipework during the extension should be given

special attention. The number of live pipelines passing through the

non-operating areas should be kept to a minimum. Despite the best

safe-\~orking procedures, incidents are frequent in which 1 ive 1 ines

are broken or burnt open by construction personnel.

_____ Uti.littes~ lines' should be isolated from the non-operating area. ---_.~.- --~

by block valves. Sewers should also be isolated from the non-operating

area, since they present the hazard that flammable gas may flow through

them from the operating into the non-operating area. Wood suggests

that sewers should be isolated completely rather than simply by the

sanding down of sewer beehives . . .

There should be adequate provision of blanking-off points to

permit pre-commissioning testing of equipment such as compressors on

air or gas recycle, while maintaining isolation of the non-operating area from flammable gas and utilities.

Safe-working procedures

A major extension usually means that there are on the site a

large number of contractors' personnel and also additional company

construction and maintenance personnel. This situation is a particularly

severe test of the safe-working procedures and the normal procedures

should be reviewed to check that they are adequate.

r . !

[' f

t

!

L..,

- 27 -

The original plant usually continues in operationwfiile~coristru~ctfoii

work is in progress on the extension. It then shuts down so that it can be tied into the expansion facil Hies. Itis necessary to control

work in the non-operating plant, and it is desirable that if it is

necessary to carry out gas-freeing operations on shutdown, then hot

work in the non-operating area should cease until this has been done.

The permi t-to-work sys tern is usually that in normal use. But the number of permits issued is likely to increase greatiy and works

personnel rnay need to be assigned full tirne to analytical testing of

.atmospileres and issuing of perrnits.

In these circumstances identification of equipment becomes even

more important. It is essential that permits specify clearly the equip-

ment to be worked on and that there be positive identification of equjp~_ .

. ments .. A co] our:J:ode~_pgLeed_w.Hh~th~e.c_o.rLtractot"s~ma..l'-.:be used asan-----. --;--_ ... - ------------------additional means of identification. Pipel iries in~ the non~operating----~--~~~~~----

-. _. , "-_. __ .-area which are live should be clearly marked with an a~reed code.

It is necessary to ensure that works and contractors' pipe blinds

are kept separate. The system described byb Wood is to .use works blinds

with a straight handle to distinguish them from the T-handle type used

by contractors. Furthermore, there should be an instuction that .. neither party must remove the other's blinds. Incidents occur in which

contractors' personnel remove blinds from live lines.

As mentioned earlier,

is needed for the insertion

in sorne permit systems

or removal of blinds. a separate permit

This is particularly

appropriate for work on major extensions.

There is need for an alarm system to cover the hazard of f1 ammab 1 e

gas release from an operating plant while hot work is being done in

a non-operating area. Personnel in the non-operating area should be

instructed to stop hot work when the a I arrn is raised. The norma 1 alarrn

system should also be explained to them.

._----- -

- 28 -

The hazard of illicit smoking smoking should be reduced by the

only effective means available, which is the provision of smoking areas.

The personnel involved in the extension should be given training

on the hazards and procedures.

THE MAINTENANCE SYSTEM I , The rna intenance informat i on sys tem

Information on plant incidents, failures and repairs is needed

both for maintenance and loss prevention purposes. It should be a

specific objective of the maintenance system to generate such information.

The principal data required are those for failure, repair and

availability. The data are more valuable if they are of good quality.

Failure data should preferably give times to failure in each failure

mod~rather than overall failure rates. Availability data should give . ...... ------ - ._- ---

-=--a:-fhtoUghj5lit~dehsit}'~Fath-erthan-a single downtime figure. --

There are also other' data which are needed. These include data

on human error and on leaks and fires.

Data on failure and related aspects are essential to the loss

prevention approach.

ro le to play here. He

The plant engineer,

should make it his

system which generates these data.

Information feedback

therefore, has a crucial

business to have an information

The requirement for failure data is one aspect of the more general

need for feedback of information from the maintenance to the design

function.

Again the plant engineer can playa key role in ensuring effective

feedback of information and so reducing unreliable and hazardous features, ,

and he should make this a definite objective.

!

! .

f l.,

! L

I !

RiazSticky NoteDescribe how the maintenance information systems work

- 29 -

Maintenance policies

The policies which are followed in a process plant have a marked

influence on the level of failures experienced.

There is, however, no universally applicable policy. The policy

appropriate in a given case depends on the failure situation. In some cases breakdown maintenance is sufficient, in others preventive:

maintenance is preferable.

Maintenance of protective devices

Maintenance of the protective devices on the plant is particularly

important and should be covered by a formal system with full documentation.

Some of the principal protective devices are

-(1). pressure relief- valves; (2 )

(3)

( 4 )

(5)

(6 )

(7)

(8)

bursting discs;

tank vents and filters;

other pressure relief devices;

non-return valves;

mechanical trips and governors;

instrument trips;

other instrumentation;

(9) alal-m systems;

(10) sprinkler systems;

(11) fire water systems.

- ------

This list includes not only the more obvious protective devices,

such as pressure relief valves, but also some other critical items

which are not always thought of as protective devices, such as tank

vents.

The maintenance of instrument trip systems is very important.

The de~tgn of such systems is based on the assumption of proof testing

at fixed intervals and is invalidated if this is not correctly-donee

- 30 -

It is also important that the other instrumentation be maintained

to a high starldard:- Ifthegeneralinstrument system is allowed to

degrade with numerous incorrect measurements, false alarms and control

Fire protection equipment should be well maintained so that it is available when required. There have been many instances where equip-

ment has faiJed.to.op.erate . ott.en with. serious conseCjuences.

1

r I

, !

t L -.- - ,

r !

L..