piping design for hazardous fluids 2c rev a

7/21/2019 Piping Design for Hazardous Fluids 2C Rev A

1/15

W. M. Huitt

W. M. Huitt Co.

The potential for an accidental occurrence of a firein a process facility or plant is something that isvery much on the minds of folks that work in andmanage these facilities as well as those of thecommunity fire departments responsible for theprotection of both personnel and property withinand around such a facility. Incorporating firesafety into plant design takes on two fundamentalgoals: That of trying to prevent the occurrence offire and the other to protect the initiallyuninvolved piping and equipment long enough for

operations personnel to perform their duties andfor emergency responders to get the fire undercontrol.

Fire has proven time and again its potential toinitiate and develop rapidly into a catastrophicloss of capital and ultimately the loss of life.While it is impractical to expect to build acomplex process plant facility, one that isexpected to handle and process hazardouschemicals, to be completely safe from thepotential of an accidental fire, it is reasonable toassume that certain aspects of design can certainlyreduce that risk. While this is a fundamental topicthat should be on the minds of the designers andengineers charged with the design of thesefacilities, it is certainly not a job for complacentminds.

Designing facilities that use and store hazardouschemicals requires a more demanding set ofrequirements, at times beyond what canpractically be written into Industry Codes andStandards. It is ultimately the responsibility of the

Engineer of Record (EOR) and the Owner to fillin those blanks and to read between the lines of

the adopted Codes and Standards to create a safeoperating environment, one that minimizes theopportunity for fire and its uncontrolled spreadand damage.

This discussion will not delve into the varioustrigger mechanisms of how a fire might get startedin a process facility, but will instead discusscontainment and control of the fuel component ofa fire that resides in piping systems that containcombustible, explosive, or flammable fluids. Thediscussion will also touch on extenuating issues

that go beyond the piping system proper.

OSHA (Occupational Safety and HealthAdministration), under the United States

Department of Labor, defines HazardousChemicals as:

Any chemical that is a health hazard or aphysical hazard.

It goes further to define both Health Hazard andPhysical Hazard:

A health hazard is a chemical for whichthere is statistically significant evidencebased on at least one study conducted in

accordance with established scientificprinciples that acute or chronic health

effects may occur in exposed employees.Chemicals covered by this definitioninclude carcinogens, toxic or highly toxic

agents, reproductive toxins, irritants,corrosives, sensitizers, hepatotoxins,

nephrotoxins, neurotoxins, agents that act

Designing facilities that use and store hazardous chemicals requires a more

demanding set of requirements.

PPiippiinnggDDeessiiggnnffoorr

HHazzarrdousFFlluiids


2/15

2

on the hematopoietic system, and agentsthat damage the lungs, skin, eyes, ormucous membranes.

And, a physical hazard as a chemical forwhich there is scientifically valid evidence

that it is a combustible liquid, a

compressed gas, explosive, flammable, anorganic peroxide, an oxidizer,

pyrophoric, unstable (reactive), or water-reactive.

In this discussion we will focus on physicalhazards, and more precisely on combustible,explosive, and flammable fluids. Hereafter suchfluids will be referred to simply as hazardous.When designing piping systems containing suchfluids there are critical aspects of the overalldesign of these systems that need additional

consideration beyond that of what might beinvolved in the design of piping systemscontaining non-hazardous fluids. For thosesystems considered hazardous, under the abovecriteria, there are two key safety aspects that needto be incorporated into the design. They are:system integrity and fire-safety.

Part of fire-safety takes into consideration theprotection of process piping and equipment fromaccidental damage creating the potential for fire,and the protection of process piping and

equipment not involved in the initial occurrenceof a fire. By protecting the surrounding piping andequipment in close proximity to a fire it controlsand delays the potential for the fuel contained inthat piping and equipment to be added to the fire.

System Integrity

System integrity describes an expectation ofengineering that is integrated into the design of apiping system in which the selected material ofconstruction, system joint design, valve selection,examination requirements, design, and installation

have all been engineered and performed in amanner that instills the proper degree of integrityinto a piping system. While this approach iscertainly needed for the piping design of whatASME B31.3 considers Normal Fluid Service it isabsolutely critical for hazardous fluid systems.

The design of any piping system, hazardous ornon-hazardous, is based, in large part, onregulations and industry accepted standardspublished by such organizations as the American

Society of Mechanical Engineers (ASME) and theAmerican Petroleum Institute (API). TheStandards published by these organizationsinclude tables that establish joint ratings based onMaterial of Construction (MOC) and temperature.Where the design consideration for hazardousfluid services departs from that of non-hazardous

fluid services is in gasket and seal materialspecifications.

This is due to the need for sealing material tocontain hazardous chemicals that are in closeproximity to a fire. The effect of heat from a fireon an otherwise uninvolved piping system canonly be delayed for a relatively short period oftime. And the first thing to fail will be mechanicaljoints.

Depending on the type of fire and whether the

piping is directly in the fire or in close proximitythat window of opportunity, prior to joint sealfailure, for an emergency response team to get thefire under control is anywhere from a few hours toless than 30 minutes. As you will see a number offactors dictate the extent of that duration in time.

A system in which the gasket material is selectedon the basis of material compatibility, designpressure, and design temperature may only requirea solid fluoropolymer. In a fire this non-metallicmaterial would readily melt allowing the contents

of the pipe to discharge from the joint once sealedby the gasket. Specifying a gasket that is bettersuited to hold up in a fire for a longer period oftime, gives the emergency responders time tobring the initial fire under control, making it quitepossible to avoid a major catastrophe.

Fire-Safe SystemIn a process plant environment in whichhazardous liquids are routinely handled one of thekey concerns is fire; its prevention and control.While consideration for preventing a fire from

occurring is paramount in the design and ongoingmaintenance of a facility, the protection of pipingand equipment containing hazardous liquids fromthe effects of a fire, in an effort to minimize oreliminate the ability of a fire to sustain itself or tospread uncontrolled, is just as critical.

Preventing the potential for a fire goes to thepiping material specification itself. Controllingand restricting the spread of fire goes beyond thepiping proper. Results of the assessment reports of


3/15

3

catastrophic events coming from the U. S.Chemical Safety and Hazard Investigation Board(CSB) have shown that many of the occurrencesof catastrophic incidents have actually played outthrough a complex set of circumstances resultingfrom design flaws, instrumentation problems, pipemodifications, inadequate fire-proofing, and/or

human error.

Events, such as a fire, are not necessarily then theresult of a hazardous fluid simply escapingthrough a leaky joint then coming in contact withan ignition source. There are usually a complexset of events leading up to a fire incident. Itssubsequent spread, into a possible catastrophicevent, is then the result of inadequate designrequirements that extend beyond the piping itself,which we will discuss later.

While this discussion touches only on pipingissues know that this is only a part of the overallintegration of safety into the design of a facilitythat handles hazardous fluids. What follows arerecommended piping design considerations thatare intended to substantially reduce the risk of theonset of fire and its uncontrollable spreadthroughout a facility. In discussing the spread offire it will be necessary to include discussionregarding the needs of disciplines other thanpiping, namely fire proofing of structural steel.

In GeneralFrom a fire-safety standpoint some requirementsand industry regulations are stipulated in theInternational Fire Code (IFC), published by theInternational Code Conference (ICC) under IFC3403.2.6.6. There are also requirements by theNational Fire Protection Association (NFPA)under NFPA 1 and NFPA 30. Test requirementsfor fire-safe valves can be found under AmericanPetroleum Institute (API) API 607Fire Test forSoft Seated Quarter Turn Valves. Starting with the4th edition of this API Standard it was added that,

among other things, the tested valve has to beoperated from fully closed to fully open after thefire test. Prior to the 4thedition a soft-seated fire-safe valve had to only remain sealed whenexposed to fire without having to be operated, orrotated. Additional fire test requirements can befound as published by the BSI Group (formerlyknown as British Standards Institution) as BS-6755-2 Testing of Valves. Specification for FireType-Testing Requirements, and FM Global FM-7440Approval Standard for Firesafe Valves.

With exception to the specific requirementscovered in the valve testing Standards, the Codesand Standards referenced above providegeneralized requirements that touch on such keyaspects of safety as relative equipment location,mass volume vs. risk, electrical classifications,

valving, etc. They cannot, and they are notintended to provide criteria and safeguards forevery conceivable situation. Designing safety intoa particular piping system containing a hazardousliquid goes beyond what should be expected froman industry-wide Code or Standard and falls to theresponsibility of the Owner or Engineer ofRecord. As ASME B31.3 states in its introduction,The designer is cautioned that the Code is not a

design handbook; it does not do away with theneed for the designer or for competentengineering judgment.

In other words, an Industry Code or Standard,while containing, in many cases, essential designcriteria, is not intended to provide all of theinformation needed to design all of the piping forall facilities. It is the intent of the AmericanNational Standards (ANS) Developers, thoseorganizations given accreditation by ANSI(American National Standards Institute) todevelop industry Standards, to establish theminimum requirements necessary to integratesafety into the design, fabrication, inspection,

installation, and testing of piping systems for awide range of facility types.

When designing piping systems to carryhazardous liquids the design basis of a project oran established protocol for maintenance needs toincorporate a mitigation strategy against twoworse-case scenarios. Those being:

1. A leak at a pipe joint containing ahazardous liquid, and

2. The rupture or loss of containment, during

a fire, of surrounding hazardous pipingsystems, not otherwise compromised,adding fuel to the fire.

The occurrence of those two failures, oneinitiating the incident and the other perpetuatingand sustaining the incident, can be minimized oreliminated by creating a design basis thatprovides:


4/15


5/15

5

W = weld joint strength reduction factory = coefficient from Table 304.1.1

Also found in Para. 304 of B31.3 are wallthickness equations for curved and mitered pipe.

With regard to circumferential welds, the designer

is responsible for assigning a weld joint reductionfactor (W) for welds other than longitudinal welds.What we can do, at least for this discussion, is toprovide some quality ranking for the variouscircumferential welds based on the stressintensification factor (SIF) assigned to them byB31.3. In doing so, the full penetration buttweld isconsidered to be as strong as the pipe with a SIF =1.0. The double fillet weld at a slip-on flange hasa SIF = 1.2. The socket-weld joint has a SIF = 2.1.Any value in excess of 1.0 will de-rate thestrength of the joint below that of the pipe. With

that said, and assuming an acceptable weld, theweld joint, and particularly the full penetrationbuttweld, is still the joint with the highest degreeof integrity. In a fire the last joint type to fail will

be the welded joint.

The threaded joint has a SIF = 2.3 and requires athread sealant applied to the threads, uponassembly, to maintain seal integrity. With flametemperatures in a fire of around 2700F to 3000Fthe thread sealant will become completely uselessif not vaporized leaving bare threads with no

sealant to maintain a seal at the joint.

The flange joint sealing integrity, like the threadedjoint, is dependent upon a sealant, which, unlikethe threaded joint, is a gasket. Flange bolts act assprings and will provide a constant applied load solong as all things remain constant. Should thegasket melt or flow, due to the heat of a fire, thatinitial tension that was given the bolts when the

joint was assembled will be lost. Once the gaskethas been compromised the joint will leak.

Knowing that the mechanical type threaded andflange joints are the weak points in a pipingsystem, and the primary source for leaks, it issuggested that they be minimized to the greatest

extent possible. Threaded joints should be limitedto instrument connections and then only if theinstrument is not available with a flange or weldedconnection. If a threaded connection is used itshould be assembled without thread compoundthen seal-welded. This may require partialdismantling of the instrument to protect it fromthe heat of the welding process.

It is recommended that piping systems be weldedas much as possible and flanged joints beminimized as much as possible. If flanged joints

are necessary for connecting to equipmentnozzles, flanged valves, in-line components, orneeded for break-out joints it is suggested that aspiral wound type gasket with graphite filler be

specified. This type material can withstandtemperatures upwards of 3000F. There are alsogasket designs that are suitable for when afluoropolymer material is needed for contact withthe chemical, while also holding up well in a fire.These are gaskets similar in design to that shownin Fig. 1. It is still preferable to make the pipingsystem an all welded system except for equipment

and instrument connections, and that includesusing welded end valves and in-line componentswhere possible.

ValvesA fire-safe rated valve meeting the requirementsof API 607 Fire Test for Soft Seated QuarterTurn Valves is designed and tested to assure theprevention of fluid leakage both internally alongthe valves flow path, and externally through thestem packing, bonnet seal, and body seal (where a

Figure 1Fire Safe Spiral Wound Type Gasket


6/15

6

multi-piece body is specified). Testing under API607 subjects a valve to well defined andcontrolled fire conditions. It requires that afterexposure to the fire-test the valve shall be in acondition that will allow it to be rotated from itsclosed position to its fully open position usingonly the manual operator fitted to the test valve.

Quarter turn describes a type of valve that goesfrom fully closed to fully open within the 90rotation of its operator. It includes such valvetypes as ball, plug, and butterfly having a valveseat material of a fluoropolymer, elastomer, orsome other soft, non-metallic material.

Standards such as FM-7440 and BS-6755-2,touched on earlier, apply to virtually any valvetype that complies with their requirements. Underthe FM and BS Standards valve types such as

gates, globes, and piston valves with metal seatscan also make excellent fire-safe valves whenusing a body and bonnet gasket and stem packingmaterial similar to a graphite.

Process SystemsAt the onset of a fire within an operating unit theinitially unaffected process piping systems shouldnot be a contributor to sustaining are spreadingwhat is already a potentially volatile situation.

There are basic design concepts that can beincorporated into the physical aspects of a processsystem that will, at the very least, provideprecious time for operators and emergencyresponders to get the situation under control. Inreferring to the simplified flow diagram in Fig. 2there are seven main points to consider:

1. Flow supply (Line A), coming from thefluids source outside the operating unit,needs to be remotely shut off to the areathat is experiencing a fire,

2. The flow path at the systems use pointvalves (VA-1) needs to remain open,

3. The flow path at drain and vent valves(VA-2) needs to remain sealed,

4. The external path through stem packingand body seals needs to remain intactduring a fire,

5. The bottom outlet valve (XV-2) on a

vessel containing a flammable liquidshould have an integral fusible link forautomatic shut-off, with its valve seat,stem packing, and body seals remaining

intact during a fire, and6. Pipeline A should be sloped to allow all

liquid to drain into the vessel.7. The liquid in the vessel should be pumped

out to a safe location until the fusible linkactivates, closing the valve. There should

Figure 2Simplified P&ID


7/15


8/15

8

gasket material that is fire-safe as mentionedearlier.

Specific Points made above:

1. Use welded connections to the maximumextent possible, and minimize flange

joints throughout the piping system forflammable fluids.

2. Where flange joints are required use afire-safe spiral wound type gasket.

3. Threaded joints should be relegated toinstrument connections, and then onlywhen a flanged or welded instrument isnot available,

4. In making a threaded connection, do sowithout thread compound, then seal-weld,

5. The supply line of a flammable fluidshould have an automated on/off fire-

rated valve installed prior to entering thebuilding or operating unit battery limits.The valve should have an interlock withthe fire alarm system and have remote,on/off, operation from a safe location.

6. All valves in a flammable fluid serviceinside a building or operating unit shouldbe either:

a. A fire-rated valve used at thefollowing locations:

i. Vents and drainsii. Tank bottom

iii. Any location where thevalve is required to be ina closed position during afire to maintain a blockedflow path

b. A non-fire-safe valve with fire-safe type stem packing and bodyseal gasket material used at thefollowing locations:

i. Any location other thanthose listed in 2,a

7. All hazardous service valves inside a

building or operating area should eitherhave welded ends (preferred) or flangedends with a fire-safe, spiral wound typegasket at the flange joint.

8. There may be exceptions, but generallyall in-line valves (not vents, drains orsource shut-off) should be in the openposition during a fire with all residualfluid able to drain freely toward a vesselwith a relief device that is vented to a safelocation.

9. For a vessel containing a flammableliquid a fire-safe tank-bottom valve with afusible link, when possible, should beused.

10.The liquid inside vessels and tanks, at theonset of a fire, should be pumped to a safelocation until the fusible link is activated,

closing the valve.11.Valved gage and instrument connections

should have valves with a fire-safe typestem packing and body seal gasketmaterial, at a minimum.

12.Each flange joint for flanged gage andinstrument connections should use a fire-safe spiral wound type gasket.

13.Outside tank farms should have a fire-safevalve connected directly to each nozzlelocated below normal liquid level with theexception of gage or instrument

connections.14.Each tank outlet valve (does not include

drain valves) should have a fusible link.15.Gage and instrument nozzles should have,

at a minimum, valves that have stempacking and body seal material made of afire-safe type material.

16.Fire-safe spiral wound type flange gasketsshould be used at all flange nozzles, gageand instrument connections.

17.All other valves installed in tank farmpiping should, at a minimum, have a fire-

safe type material specified for stempacking and seal gasket material.

Situations will arise that do not fall neatly intothose described above. If there is any doubt withregard to valving default to a fire-rated valve.Each piping system identified as needing to befire-safe should be designated as such. Whereindividual fire-safe valves are to be strategicallylocated in a system they should be designated ontheir respective P&IDs either by notation orthrough the assigned pipe material specification.

The pipe material specification should beindicated on each pipeline of the P&ID. Thespecification itself should be descriptive enoughfor the designer to know which valve to apply ateach location.

INCIDENT EXAMPLES AND LESSONS

LEARNED

While this particular discussion is specific topiping leaks and joint integrity it bares touching


9/15

9

on a few subjects that are integrally associatedwith piping safety: pipe rack protection,protecting piping from vehicle traffic, anddesigning for disaster (HAZOP).

In Incident #1 below, the onset of a fire that mightotherwise have been quickly controlled becomes a

catastrophic event because piping mounted on theunprotected structural steel of a pipe rack, outsidethe extent of the initial occurrence, becomescollateral damage adding more fuel to the firecausing it to sustain itself, increase in intensity,and continue to spread.

In Incident #2 below, an unprotected andprotruding pipeline component (Y-strainer) isdamaged causing a major leak that operations wasunable to stop. The ensuing fire lasted for fivedays.

In Incident #3 below, two dimensionally identicalspool pieces were designed for a system in whichthe two were fabricated from different materialbecause their service conditions were verydifferent. It can only be assumed that this was anerroneous attempt at trying to achieve duplicationof pipe spools in an effort to assist the fabricatorin their productivity of pipe fabrication. Instead itultimately caused injury to one person and costthe plant Owner $30MM.

Incident #1

Valero-McKee Refinery, Sunray,TX, February 16, 2007

Figure 3Valero-McKee Refinery90 SecondsAfter Ignition.

Without going into great detail as to thecircumstances that led up to this incident, pipinghandling liquid propane in a Propane

Deasphalting (PDA) unit ruptured. The location ofthe rupture was in a section of isolated piping thathad been abandoned in place several years prior.A valve, intended to isolate the active flow ofliquid propane from the abandoned-in-placepiping, had been unknowing left partially opendue to an obstruction inside the valve. Water had

gradually seeped in past the valve seat over theyears and being heavier than the liquid propane,settled at a low point control station where iteventual froze during a cold period. Theexpanding ice inside the pipeline subsequentlycracked the pipe. When the temperature outsidebegan to warm the ice thawed allowing liquidpropane to escape from the active pipeline,through the partially closed valve, and out thenow substantial crack. The resultant cloud ofpropane gas drifted toward a boiler house where itfound an ignition source. The flame of the ignited

gas cloud tracked back toward its source wherethe impending shockwave from the explosionripped apart piping attached to the PDA ExtractorColumns (No. 1 Extractor identified in Fig 3)causing ignited propane to erupt from one of thenow opened nozzles on the column at such avelocity as to create a jet fire.

The ensuing jet fire, which is a blow torch likeflame, discharged toward a main pipe rackapproximately 77 feet away engulfing the piperack in the jet fire. As the temperature of the non-

fire proofed structural steel of the pipe rackreached its plastic range and began to collapse inon itself the piping in the rack, which containedadditional flammable liquids, collapsed along withit (Ref. Fig. 4).

Figure 4Collapsed Pipe Rack as a Result ofHeat from a Jet Flame.

Due to the loss of support and the effect of theheat, the pipes in the pipe rack, unable to supporttheir own weight, began to sag. The allowablebending load eventually being exceeded from theforce of their unsupported weight, the rack piping


10/15

10

ruptured spilling their flammable contents into thealready catastrophic fire. The contents of theruptured piping, adding more fuel to the fire,

caused the flames to erupt into giant fireballs andthick black smoke.

The non-fire proofed support steel, seen on theleft in Fig. 4 and on the right in Fig. 5, wasactually in compliance with APIrecommendations. Those recommendations can befound in Publication 2218 Fireproofing

Practices in Petroleum and PetrochemicalProcessing Plants; API Publications 2510

Design and Construction of LPG Installations;and 2510A Fire-Protection Considerations for

the Design and Operation of Liquefied PetroleumGas (LPG) Storage Facilities. In these issues ofthe Publications it was recommended that piperack support steel within 50 feet of an LPG vesselbe fire proofed. The collapsed support steel wasapproximately 77 feet from the ExtractorColumns, which is beyond the 50 footrecommended distance.

While the Engineer of Record (EOR) was incompliance of the governing Code, with regard to

fire proofing, there may have been a degree of

complacency in their defaulting to that minimumrequirement. This goes back to a point made

earlier in which it was said that industry Standardsare not intended to be design manuals. They

instead provide, the minimum requirementsnecessary to integrate safety into the design,

fabrication, inspection, installation, and testing ofpiping systems Proprietary circumstances

make it the imperative responsibility of the EORor the Owner to make risk assessments based on

specific design conditions and go beyond theminimum requirements of an industry Code orStandard when the assessment results and good

engineering practice dictates.

Incident #2Formosa Plastics Corp., Point

Comfort, TX, October 6, 2005

Figure 6Formosa Plastics, Point Comfort, TX10/6/05

A trailer being towed by a forklift operator downa pipe rack alley in the olefins II operating unit ofFormosas Point Comfort facility attempted toback the trailer up into an open area between piperack support columns in an effort to turn the rig

around. When the operator, in the process ofpulling back into the pathway, began to pullforward the trailer struck a protruding 2 blow-down valve on a vertically mounted Y-strainerthat was connected to a 4 NPS liquid propyleneline subsequently ripping the valve and nipplefrom the strainer (Ref. Fig. 7). Liquid propyleneunder 216 PSIG pressure immediately begandischarging into a liquid pool from the 2 openingand partially vaporizing into a flammable cloud.

Figure 5Same Collapsed Pipe Rack as Fig. 4 Seen From Above


11/15

11

The flammable cloud eventually found an ignitionsource, ignited and exploded, in-turn igniting thepool of liquid propylene. The fire burned directlyunder the pipe rack and an attached elevatedstructure containing process equipment andpiping. About 30 minutes into the event non-fireproofed steel sections of the pipe rack and theelevated structure containing process equipmentcollapsed. The collapse caused the rupture ofequipment and additional piping containingflammable liquids, adding more fuel to an alreadycatastrophic fire. The flare header was alsocrimped in the collapse and ruptured causing flow

that should have gone to the flare stack to bedischarged into the heart of the fire. The fireburned for 5 days.

Again, as in Incident #1, you can see in Fig. 8 theresult of insufficient fire proofing of steel beamsand columns in close proximity to process units.And fire protection does not apply only to verticalcolumns. As you can see, it is not sufficiently

effective enough to have the vertical columnsprotected while the horizontal support steel is leftunprotected and susceptible to the heat from afire.

Another key factor in the Formosa fire was theambiguous decision by the designer to orient theY-strainer blow-down in such a position ofvulnerability. While there is absolutely nothingwrong with installing the Y-strainer in the verticalposition, as this one was, they are normallyinstalled in a horizontal position with the blow-down at the bottom, inadvertently making italmost impossible to accidentally strike it withenough force to dislodge the valve and nipple.

However, orienting the blow-down in such amanner, about the vertical axis, should haveinitiated the need to evaluate the risk and makethe determination to rotate the blow-down aboutits vertical axis to a less vulnerable location, or toprovide vehicle protection around the blow-downin the form of concrete and steel stanchions. Bothof these precautionary adjustments wereoverlooked.

The plant did perform a hazard and operability

study (HAZOP) and a pre-startup safety review(PSSR) of the Olefins II operating unit. In theCSB report, with regard to process piping andequipment, it was stated that, During the facility

siting analysis, the hazard analysis team[Formosa]discussed what might occur if a vehicle(e.g., fork truck, crane, man lift) impacted process

piping. While the consequences of a truck impactwere judged as severe, the frequency of

occurrence was judged very low (i.e., not

Figure 7Impact Point Showing Damaged Y-Strainer

Figure 8Collapse of Non-Fire Proofed

Structural Steel


12/15

12

occurring within 20 years), resulting in a lowoverall risk rank [The ranking considered both thepotential consequences and likely frequency of anevent]. Because of the low risk ranking, the teamconsidered existing administrative safeguardsadequate and did not recommend additional

traffic protection.

Incident #3BP Refinery, Texas City, TX,

July 8, 2005In the design layout of a duplex heat exchangerarrangement (Fig. 9) in the Resid-Hydrotreaterunit of the BP Refinery in Texas City, TX, thedesigner duplicated the fabrication dimensions ofthe 90 fabricated elbow spool assemblies shownin Fig. 9 as Elbows 1, 2, and 3. While the pipesizes and equipment nozzle sizes were the same,prompting this to be done, the service conditionswere not.

The shell side conditions on the upstream side (atElbow 1) were 3000PSIG at 400F. The shell sideconditions on the downstream side (at Elbow #3)were 3000PSIG at 600F. The intermediatetemperature at Elbow #2 was not documented. Inthe initial design the material for Elbow #1 wasspecified as carbon steel, Elbow #3 was specified

as 1 - 1/4 chrome/moly alloy. The reason for thedifference in material of construction is thatcarbon steel is susceptible to High TemperatureHydrogen Attack (HTHA) above ~450F at3000PSIG, therefore the chrome/moly alloy wasselected for the higher temperature Elbow #3.

At 3000PSIG and temperatures above 450Fhydrogen permeates the carbon steel and reactswith dissolved carbon to form methane gas. Thedegradation of the steels tensile strength andductility due to decarburization coupled with theformation of methane gas creating localizedstresses weakens the steel until it ultimatelyfatigues and ruptures.

In January 2005 scheduled maintenance wasperformed on the heat exchanger assembly. Thepiping connected to the heat exchangers was

dismantled and stored for the next 39 days. Aftermaintenance was completed the piping wasretrieved from storage and reinstalled.

The elbows of different material were not markedas such and the maintenance contractor was notwarned of the different MOC for the elbows.Elbows #1 and #3 were unknowingly installed inthe wrong locations. On July 8, 2005,approximately five months after re-installing thepiping around the heat exchangers, the elbow inthe #3 position catastrophically failed as shown in

Fig. 10.

Figure 108 NPS Hydrogen Piping SeveredFigure 9Heat Exchanger Flow Diagram


13/15

13

Figure 11Fragments of the Failed 8 NPSCarbon Steel Spool

As you can see in Fig. 11 the carbon steel, afterbecoming progressively weakened by HTHA,fractured on the inside of the pipe andcatastrophically failed. The incident injured oneperson in operations responding to the emergencyand cost the company $30MM.

The one thing you can take away from thisincident is Do Not Dimensionally ReplicatePiping Spools or Assemblies of DifferentMaterial. The other underlying, but significantcomponent you can also take away is this: In theinitial design of a plant facility the Engineer ofRecord will routinely hold formal design reviewsthat will include all key personnel with vested

interest in the project. In doing so, include, amongthe attendees, key operations and managementplant personnel from one of the Ownersoperating facilities, if available. These individualstypically bring a lot of insight and knowledge to areview. Whereas the designers may not have thewherewithal to think along the lines of issues thatmight pertain to a facility turnaround, the plantpersonnel will. These are issues that they normallythink long and hard about. Make use of thisresource.

TO SUMMARIZE

This article has touched on only a few isolated,but key safety issues and criteria that should betaken into consideration when designing,modifying, or maintaining a process facility.Whether it is a petroleum refinery, chemical plant,or a pharmaceutical API facility the same safetyconsiderations apply.

The key points covered in this discussionpertaining to fire safety are:1. Joint integrity

a. Minimize mechanical jointsb. Specify all welded joints accept where

mechanical joints are absolutely requiredc. Specify gasket material that will extend

the life of the gasket seal in a fire2. Valving

a. Specify and locate valves based on anengineered strategy

b. Select bonnet seal, body seal, and stempacking material that can withstandupwards of 3000F

c. Select fire-safe valves specifically whenthe valve needs to remain sealed in theclosed position

d. Metal seated valves with high temperatureseals and packing can also be considered

fire-safe3. Process system overview

a. A HAZOP review of P&IDs shouldinclude the analogy of the occurrence of afire

b. The review should identify the need forautomated fire-safe shut-off valves to becontrolled from a safe location outside thebattery limits of the operating unit underreview

c. Sloped piping to allow liquid contents ofthe piping to drain to a vented vessel

d. In accordance with ASME Boiler andPressure Vessel Code (BPVC) pressurevessels require a relieving device. Thatrelieving device should be vented to asafe location outside the battery limits ofthe operating unit

e. Assess the need for a fusible link on tankbottom valves

f. Vent and drain valves shall either havemetal seats or be certified fire-safe

4. Strategic fire proofing of structural steela. While industry Codes and Standards

provide the minimum requirements fordetermining when structural steel shouldbe fire proofed there are proprietarycircumstances that should be analyzed,evaluated, assessed, and a pragmaticengineering decision made based on thatassessment, so long as the result does notgo below the minimum requirement.

5. Evaluating and assessing potential processhazards


14/15

14

a. Performing a HAZOP review of a plantlayout is a very circumspect process. Itrequires the reviewers to assimilate anumber of what-if propositions and tothen thwart the outcome of those variousscenarios by reacting with designcorrections and changes. This is a process

that should begin with P&IDs, progresswith design by reviewing design layouts,and finally walkthroughs of the physicalplant. It is a completely ongoing processthroughout the life-cycle of a project.

b. At the P&ID stage the effects of theprocess design are considered shouldthere be a fire, or runaway reaction, etc.At this stage the reviewers will create ascenario and determine the fail position(FC or FO) of automated valves; shouldthe need for a valve to be car seal open

(CSO) or car seal closed (CSC) becountermanded; does a tank bottom valverequire a fusible link; this is also the timewhen there should be inter-disciplinediscussions between process design andstructural engineering on the subject offire proofing requirements.

c. At the design layout stage, when drawingsare at the 60% to 90% completion stage,reviewers should look for, among otherthings, maintenance and operationalaccessibility; equipment, instruments, or

attachments that may be vulnerable totraffic related damage; unwanted pocketsin piping; unwanted dead-legs in piping;the need for valve chain wheels.

d. A physical plant review can take onvarious characteristics depending on howthe program is set up. An informalapproach can be adopted by the HAZOPteam, in tandem with a formal program.i. The informal approach basically

integrates a procedure that allows foranyone involved with the project

(green field, retrofit, upgrade, ormodification) to submit a writtenform describing a concern based onan observation made whileperforming their regular duties. Theseconcerns can be originated by acontractor, an operator, validationteam member, start-up team member,or others. Each issue is documented,reviewed, and responded to by theHAZOP review team. This dovetails

in with the more formal HAZOP teamactivities.

ii. The formal program is orchestratedand performed by the HAZOP team.This involves strict proceduralguidelines establishing both achecklist of specific concerns and the

flexibility to evaluate unexpectedconcerns. The procedure shouldinclude a formal process for reportingconcerns, the review and assessmentof those concerns, and the resolutionto either reject or remediate eachconcern.

e. As with the dimensionally identical spoolassemblies in the resid hydrotreater unit inIncident #3, this is the type of designissue that can be very easily overlooked.Unless you are reviewing the isometric

fabrication drawings that depict thefabrication dimensions and connect thedots with future maintenancerequirements a potentially hazardouscircumstance such as this may not readilybe identified.

IN CLOSING

Keep in mind that fire prevention is an attempt toincorporate various means and methods intendedto prevent the mechanisms needed to start a fire

from occurring. Fire protection, on the other hand,is a time related design element integrated into theelements of a facility that is intended to delay theeffects of fire for a period of time sufficientenough to allow for personnel to evacuate the areaand for emergency responders to gain control andsuppression of a fire.

The events that initially spawned the creation ofthe American Society of Mechanical Engineers(ASME) were the many catastrophic boilerfailures that had been occurring during the late

1800s. Engineering had not caught up withindustrialization at that point and much of theengineering and fabrication taking place at thetime was accomplished through theinconsistencies of trial and error. In response tothe need for sound, safe, and repeatableengineering concepts the ASME was born. Thusthe manufacture of safe operating boilers throughimproved design and pragmatic engineering was,over time, created, establishing a new era of safetyand consistency in engineering.


15/15

15

Today safety remains at the heart of not only theASME, but virtually all of the American NationalStandards Developers. The cost impact on aproject to engineer a plant with piping systemsthat are inherently safer in both preventing leaksthat can precipitate a fire and in containing

hazardous fluids during a fire is minimal. Doingotherwise is more of a risk than most of us wish toaccept. At the end of the design and constructionof a CPI facility there should be a high degree ofassurance that the men and women working inthose facilities are safe from possible harm andare absent the concerns, not the awareness, ofworking in a high risk environment.

References

1. Occupational Safety and Health

Organization (OSHA)www.osha.gov2. American Society of Mechanical

Engineers (ASME)www.asme.org3. American Petroleum Institute (API)

www.api.org4. U.S. Chemical Safety and Hazard

Investigation Board (CSB)www.chemsafety.gov

5. International Fire Code (IFC)www.iccsafe.org/cs/cc/ifcc/index.html

6. International Code Conference (ICC)www.iccsafe.org

7. National Fire Protection Association(NFPA)www.nfpa.org

W. M. (Bill) Huitt hasbeen involved inindustrial piping design,engineering andconstruction since 1965.Positions have includeddesign engineer, pipingdesign instructor, projectengineer, project

supervisor, pipingdepartment supervisor,engineering manager and

president of W. M. Huitt Co. a piping consulting firmfounded in 1987. His experience covers both theengineering and construction fields and crossesindustrial lines to include petroleum refining, chemical,petrochemical, pharmaceutical, pulp & paper, nuclearpower, biofuel, and coal gasification. He has writtennumerous specifications, guidelines, papers, andmagazine articles on the topic of pipe design andengineering. Bill is a member of ISPE (International

Society of Pharmaceutical Engineers), CSI(Construction Specifications Institute) and ASME(American Society of Mechanical Engineers). He is amember of three ASME-BPE subcommittees, severalTask Groups, an API Task Group, and sets on twocorporate specification review boards. He can bereached at:W. M. Huitt Co.

P O Box 31154St. Louis, MO 63131-0154(314)[email protected]

www.wmhuitt.com

END OF ARTICLE
http://www.osha.gov/http://www.osha.gov/http://www.osha.gov/http://www.asme.org/http://www.asme.org/http://www.asme.org/http://www.api.org/http://www.api.org/http://www.chemsafety.gov/http://www.chemsafety.gov/http://www.iccsafe.org/cs/cc/ifcc/index.htmlhttp://www.iccsafe.org/cs/cc/ifcc/index.htmlhttp://www.iccsafe.org/http://www.iccsafe.org/http://www.nfpa.org/http://www.nfpa.org/http://www.nfpa.org/mailto:[email protected]:[email protected]://www.wmhuitt.com/http://www.wmhuitt.com/http://www.wmhuitt.com/mailto:[email protected]://www.nfpa.org/http://www.iccsafe.org/http://www.iccsafe.org/cs/cc/ifcc/index.htmlhttp://www.chemsafety.gov/http://www.api.org/http://www.asme.org/http://www.osha.gov/

piping design for hazardous fluids 2c rev a

Documents