3

VESSELS

3.1 INTRODUCTION This chapter presents potential failure mechanisms for vessels and suggests design alternatives for reducing the risks associated with such failures. The types of vessels covered in this chapter include: In-process vessels (surge drums, accumulators, separators, etc.) Pressurized tanks (spheres, bullets) Atmospheric, fixed roof storage tanks (cone/dome roof) Atmospheric, floating roof storage tanks

Reactors are a unique subset of vessels, in that they are specifically designed to contain chemical reactions. Because reactors have unique failure scenarios specifically attributable to the reaction (e.g., reactant accumulation), a complete chapter (Chapter 4) is devoted to this important class of equipment. However, many of the generic vessel failure modes discussed in this chapter, such as corrosion related failures or autopolymerization may also apply to reactors. 3.2 PAST INCIDENTS "Those who cannot remember the past are condemned to repeat it" (Santayana 1905). Important lessons can be learned from prior mistakes. Several case histories of incidents involving vessel failures are provided to reinforce the need for the safe design and operating practices presented in this chapter.
3.2. / Storage Tank Autopolymerization Incident

Plant operating problems had resulted in the production of a tank (approximately 32,000 Ib) of glacial acrylic acid (GAA) which did not meet specifica-

tions due to high water content. The material was held in storage until it was loaded into a tank wagon, where it was to be kept until the GAA could be reworked. The operator's logbook specified that warm water (250C maximum) was to be used to keep the GAA from freezing (freezing point = 130C). The outside temperature was 5-1O0C at the time. A standard steam-water mixing station was used to supply the warm water to the tank wagon coils. Water flow was maintained to the tank wagon, but no measuring devices were available for observing actual temperature or flow rate. The steam-water mixing station operation was monitored and adjusted by observing that warm water was running out of the coil outlet (noting vapor evolving from water in the cold weather). It was not clear after the incident whether the tank wagon dome lid was open, or just loosened to allow "breathing" during the hold period. Approximately l5l/2 hours after the tank wagon was filled, vapors started blowing out the loosened tank wagon lid and accumulating in the vicinity of the tank wagon. The steam-water mixer was shut off and approximately six minutes later the tank wagon exploded. The blast effect from the explosion destroyed an adjacent loading rack/pipe rack, and damaged other plant structures. A combination of local overheating (hot surface) and local inhibitor deficiency was considered the most probable mechanism for initiation of polymerization. Contamination may have contributed to the violence of the polymerization once it was initiated. Water and iron were the two main candidates in contamination considerations. Screening experiments showed that water can reduce GAA stability at temperatures > 10O0C, and that soluble iron in the 1-100 ppm range can also reduce stability. See item 10 in Table 3 for potential design solutions. Ed. Note: This example illustrates the hazard of using temporary facilities for the storage of hazardous materials. Such facilities are often not subject to the same scrutiny as permanent facilities.

3.2.2 Storage Tank Stratification Incident Acetic anhydride is used as an acetylating agent for many compounds. When it reacts with a hydroxyl group, acetic acid is formed as a byproduct. Pure acetic anhydride will react energetically with water to form acetic acid. In typical acetylation reactions, an excess of anhydride is used to drive the reaction to completion. This excess is then reacted in the receiver tank with water to convert the excess anhydride to acid. The acid is then refined and remanufactured into anhydride. This operation can be performed safely, since die presence of acetic acid makes water and acetic anhydride miscible, and therefore the rate of reaction can be controlled by the rate of water addition.

In this case, the acetylation reaction did not proceed as designed, due to an inadvertent omission of the strong mineral acid catalyst needed to initiate the reaction at low temperatures (-1O0F). Thus, the receiver tank did not contain a mixture of acetic anhydride and acetic acid, but only very cold, pure anhydride. The operator in charge of the water addition did not realize the change in composition, and additionally failed to turn the tank agitator on prior to beginning the water addition. After several minutes of water addition, he realized his mistake with the agitator, and hit the start button. Immediately, the water, which had layered out on top of the cold anhydride, mixed and reacted violently. This caused a partial vaporization in the tank, and eruption through an open manway, resulting in fatal burning of the operator. Had the agitator been turned on prior to beginning the water addition, the reaction rate would have again been controlled by the water addition rate. In this case, the water was added at near-stoichiometric concentrations virtually instantaneously, resulting in an uncontrolled exotherm.

3.2.3 Botch Pharmaceutical Reactor Accident While two operators were charging fiber drums containing a penicillin powder into a reactor containing a mixture of acetone and methanol, an explosion occurred at the reactor manhole. The two operators were blown back by the force of the explosion, and were covered with solvent-wet powder. The incident was initiated by the ignition of solvent vapors, which resulted in a dust explosion of the dry powder. The solvent liquid mixture in the reactor did not ignite. Tests on the polyethylene liner inside the fiber drums, which had been grounded at the time of the incident, showed that they were of the non-conducting type. The most probable cause of the ignition was an electrostatic discharge from the polyethylene liner during reactor charging. After this accident, the company instituted the following procedures (Drogaris 1993): Requiring nitrogen inerting when pouring dry solids into flammable solvents Adding dry powder to the reactor by means of grounded metal scoops, where possible, rather than by pouring in directly from drums with polyethylene liners Using only conductive polyethylene liners Using a closed charging system rather than pouring dry powders into flammable solvents directly via an open manhole Performing an electrostatic hazard review of the whole plant and all the processes whenever powders and flammable solvents are used

Ed. Note: Even though this incident involved a reactor, it applies as well to any vessel, open-manhole, charging operation. Most likely the liners were loose and the operators not grounded. If fixed liners were in place and the operators grounded, the accident might not have occurred.

3.3 FAILURE SCENARIOS AND DESIGN SOLUTIONS The information on equipment failure scenarios and associated design solutions is introduced in table format in this chapter and followed in each subsequent equipment chapter. The organization of the tables is the same in each chapter. The table headings used are described below. Operational Deviationgeneric operational parameter deviation such as overpressure. Analogous to HAZOP parameter deviation. Failure Scenariospecific failure mechanism/cause for specified generic parameter deviation (e.g., overpressure due to upstream control system failure). Potential Design Solutionpotential design solutions that could be considered to reduce the risk of the failure scenario. For the reasons given in Chapter 2, the design solutions are grouped into the following three categories: inherently safer/passive, active and procedural. Vessel failure scenarios, along with associated design solutions, are presented in Table 3. Design solutions are provided for each scenario, although some scenarios do not have practical design solutions for all categories. Operational deviations marked with (T) are discussed in further detail in the chapter text.

3.4 DISCUSSION
3.4. / Use of Potential Design Solutions Table

It should be recognized that the design solutions presented are possible approaches for reducing the risk of the associated failure scenario. The authors of this book could not anticipate all the possible applications nor conditions that may pertain to a specific design situation. Also, the design solutions are not necessarily equivalent in terms of benefit in reducing the risk of the stated hazard scenario. Therefore, it is intended that the table be used in conjunction with the design basis selection methodology presented in Chapter 2 to arrive at the optimal design solution for a given application. Furthermore, some solutions are not applicable to all classes of vessels. (For example, designing

for maximum expected deflagration pressure is not practical for tanks designed to API Std 650 (1988) but should be considered for some pressure vessels.) Use of the design solutions presented in Table 3 should be combined with sound engineering judgment and consideration of all relevant factors. For example, let us assume that it is decided that a nitrogen blanketing system will be installed on an atmospheric storage tank to reduce the risk of internal explosion. Typically nitrogen supply pressures are significantly higher than the design pressure of a storage tank designed to API Std 650 (1988). Consequently the total system design also needs to address the hazard of overpressure due to uncontrolled opening of a high pressure utility system. This example illustrates an important aspect of the intended use of the equipment failure tables. The design and installation of safety systems, especially active systems, can also introduce potential hazards that were not originally present. Therefore, it is necessary to use the table in the context of the total design concept to insure that all hazards have been considered. As shown in the example, this may involve combining several scenario design solutions to arrive at a final acceptable design. Consequently, the table should be consulted at various stages of the design to reaffirm that all failure mechanisms are considered. Utilizing several design solutions for the same scenario is also possible and often desirable. Again referring to the design of a flammable liquid storage tank, employing ignition source controls (e.g., non-splash filling, grounding) as well as vapor space inerting may be desirable based on the consequences of catastrophic tank failure. In addition to providing the required degree of reliability for any one failure scenario, multiple safeguards may be the optimum approach to process deviations caused by very different failure scenarios. For example, suppose a vessel can be overpressured by deflagration in the vapor space in one scenario and by runaway reaction in another scenario. The deflagration event may be characterized by a high pressure rise rate but a modest pressure rise ratio. The reaction runaway may be characterized by a very high pressure rise ratio but a modest reaction rate early in the runaway. With this disparity in the scenarios, the optimum safeguard design might be pressure containment for the deflagration and emergency pressure relief for the runaway reaction. In this situation, these safeguards are not redundant.

3.4.2 Special Considerations

The tables contain numerous design solutions derived from a variety of sources and actual situations. Many of the solutions are readily understood. In some instances, additional explanation is warranted to fully appreciate the

approach. This section contains additional information on selected design solutions. The information is organized and cross referenced by the Operational Deviation Number in the table.
Ignition of Flammable Atmosphere (3,19)

When applying vapor space inerting, there are some special circumstances that need to be recognized; namely, the presence of oxygen is needed for some hazard mitigation measures. For example, the corrosion inhibiting mechanism of certain metals (e.g., stainless steel) depends on the presence of some oxygen. Likewise, some polymer formation inhibitors that are added to reactive materials need oxygen to stay active. In such situations, a reduced oxygen atmosphere may achieve the desired balance between inhibitor activity and flammability protection. The use of flame arresters deserves additional consideration. Flame arresters are often implicated in vessel incidents, not because they are ineffective, but because they are misapplied or improperly maintained. Flame arresters that are not routinely inspected can become plugged (e.g., condensation/corrosion by stored fluids, foreign debris). Eventually, the protected vessel can be subjected to overpressure or vacuum conditions if the vessel is not protected by a relief device. Flame arresters do not necessarily provide protection against detonation unless specifically designed for that purpose. When using in-line flame arresters, it is necessary to evaluate the potential for deflagration to detonation transition (DDT) in the piping systems being considered. Information on analysis of DDT can be found in CCPS 1993, Chapter 13.
Chemical Reaction Increases Pressure (10)

In the case of cold storage tanks, emergency cooling needs to be independent since loss of primary cooling may be a cause of high reaction rate. When polymerization inhibitor is used, the solubility of the inhibitor in the reactive monomer over the range of potential operating conditions needs to be considered. For example, as acrylic acid melts, the inhibitor tends to stay in the solid producing a potential runaway hazard in the molten liquid. See Section 3.2.1.
Pressure Generated by Rollover (12)

The earliest recognized incident of rollover occurred in a Liquefied Natural Gas (LNG) tank due to density stratification. In this incident LNG was transferred from a tanker to a partially filled LNG tank. The LNG transferred was more dense than the LNG in the tank and was added to the bottom of the tank. As a result, two discrete layers of LNG existed in the tank. With heat

transfer from the surroundings, energy accumulated in the lower layer since the hydrostatic head of the upper layer suppressed vaporization. As the lower layer temperature increased, its specific gravity decreased. Heat transfer to the upper layer resulted in boil-off of methane and an increase in the specific gravity as the concentration of heavier components increased. In time the difference in specific gravity between the two layers disappeared, and the resulting rapid equilibration released the stored energy in the lower layer as a high rate of liquid vaporization. Fortunately, in this situation tank safety relief devices were able to provide adequate protection, and tank failure was averted (Drake etal. 1973). Rollover can also occur with two immiscible, reactive materials, such as acetic anhydride and water. As the materials react at the interface, acetic acid is formed as a reaction product. Once a sufficient amount of acid is generated, the two phases become miscible, collapsing together and generating a large, nearly instantaneous exotherm. With this energy release, the resulting reaction mixture can be partially vaporized, with an accompanying rapid rise in vessel pressure.

Tank Failure under Vacuum (20 to 25)

In flammable service, generally it is not desirable to allow air into a vessel to prevent vacuum conditions. Bleeding in an inert gas under pressure control is a design solution that is often utilized. Depending on the consequences of inert gas failure, an emergency supply of inert gas may be needed. In some instances, an air vacuum breaker is provided as a last line of defense. This design approach is based on acceptance of the lower likelihood of ignition instead of the much more likely prospect of damaging the tank which could result in loss of containment.
Tank Failure from Frost Hea/e (47)

This is a serious problem for design of cryogenic fluid storage tanks. However, it can be managed through proper foundation design. Design solutions that have been used include elevated foundation pedestals to minimize heat transfer from the soil and foundation heating elements.

3.5 REFERENCES
API Std 650 1988. Welded Steel Tanks far Oil Storage. Washington, DC: American Petroleum Institute. CCPS 1993. Guidelines for Engineering Design for Process Safety. Center for Chemical Process Safety, New York: American Institute for Chemical Engineers.

Drake, E.M., Geist, J. M., and Smith, K. A. 1973. Preventing LNG "Rollover." Hydrocarbon Processing. Drogaris, G. 1993. Major Accident Reporting System: Lessons Learned from Accidents Notified. Amsterdam: Elsevier Science Publishers, B.V. Santayana, G., 1905. The Life of Reason Vol. I, Reason and Common Sense.

Suggested Additional Reading API Publ 2210 1982. Flame Arrestersfor Vents of Tank Storing Petroleum Products, 2nded., Washington, DC: American Petroleum Institute. US Coast Guard 1990. Specifications for Tank Vent Flame Arresters 33 CFR Part 154, Appendix B, United States Coast Guard: US Department of Transportation. UL 525 1984. Flame Arresters for Use on Vents of Storage Tanks for Petroleum Oil and Gasoline, 5th ed. UL.

TABLE 3. FAILURE SCENARIOS FORVESSELS

Click here to download as Microsoft Word

Potential Design Solutions

No. 1

Operational Deviations Overpressure

l
Failure Scenarios Liquid overfill resulting in back pressure or excessive static head Inherently Safer/Passive Vessel design accommodating maximum supply pressure Use open vent or overflow line

Active Emergency relief device Level device interlocked to prevent overfill

Procedural Instructions to monitor level during transfer Verify tank has sufficient free board prior to transfer High level alarm with instructions to intervene to prevent overfilling Labeling of utility connections

Overpressure

Inadvertent or uncontrolled opening of high pressure utility system

No utility connections above pressure rating of vessel Incompatible utility couplings to prevent connections of high pressure utilities Mechanical flow restriction (e.g., restriction orifice) of utility with open vent on vessel Vessel design accommodating maximum utility pressure

Emergency relief device on vessel or utility line Pressure sensor interlocked to isolate utility pressure

Potential Design Solutions

No.

Operational Deviations

Failure Scenarios Ignition of flammable atmosphere in vessel vapor space

Inherently Safer/Passive Floating roof tank instead of fixed roof (see procedural) Ignition source controls (e.g., lightning protection, permanent grounding/bonding, non-splash filling including dip pipe, fill line flow restriction, or bottom inlet) Vessel design accommodating deflagration pressure Store belowflashpoint (if not heating) Use non-intrusive instrumentation (e.g., radar level detection)

Active Explosion venting (e.g. frangible roof for fixed roof tank) Store material at temperature below its flash point (cooling) Vapor space combustible concentration control Vapor space inerting Flame arrester in vent path Emergency purge and/or isolation activated by detection of flammable atmosphere

Procedural Oxygen analyzer with alarm Instructions to feed empty tanks at low rate until fill line submerged, avoiding splash filling No transfers during electrical storms Low feed rate until floating roof is afloat

3(T) Overpressure (see items 18, 19)

Overpressure

Excessive fill rate resulting in back pressure from venting vapor

Use open vent (e.g., vent diameter larger Flow shutdown interlock Operating instructions to activated by high pressure limitflowto a maximum thanfillline for short vent lines) safe value or high flow Flow restriction orifice in fill line Operating instructions to Automated flow control Vessel design accommodating maximum monitor filling rate and loop on fill line with high supply pressure intervene to prevent flow alarm excessive fill rate Emergency relief device

Overpressure

External fire

Buried (underground or bermed) tank (consider environmental issues) Fireproof insulation (limits heat input) Slope-away diking with remote impounding of spills Locate outside fire affected zone Provide recommended tank-to-tank separation

Fixed fire protection water spray(deluge) and/or foam systems activated by flammable gas, flame, and/or smoke detection devices Emergency relief device

Emergency response plan Manual activation of fixed fire protection water spray (deluge) and/or foam systems

Overpressure

Inadequate or obstructed vent path, resulting in high vapor space pressure during filling

Use open vent Emergency relief device Vessel design accommodating maximum Heat tracing of vent to supply pressure avoid condensation and solidification Vent screen to avoid entrance of foreign objects

Operating instructions to verify open vent path before initiating fill operation Operating instructions to periodically examine vent opening for obstructions Periodic sampling/ analysis of contents for leakage Emergency action plan to transfer contents to safe location if adverse reaction can occur

Overpressure (see item 54)

Internal heating/cooling coil leak or rupture

Use of external heater/cooler (panel coil) Emergency relief device Use of heating/cooling medium which is High pressure interlock not reactive with vessel contents that activates utility Vessel design accommodating maximum closure heating/cooling medium pressure Back pressure control with external heating/ Use electrical heating cooling circulation to Use lower pressure/temperature heating avoid leak into vessel or cooling medium Vessel design accommodating maximum stored material vapor pressure at maximum heating medium temperature

Potential Design Solutions

No. 8

Operational Deviations Overpressure

Failure Scenarios

Inherently Safer/Passive

Active

Procedural

Vessel contamination Vessel design accommodating maximum Emergency relief device Isolation of volatile expected pressure with high vapor materials by blinding, Weak seam roof for tanks pressure material removable spool, Use of incompatible couplings (introduction of disconnection, etc. volatiles) Excessive heat input resulting in high vapor pressure Vessel design accommodating maximum Emergency relief device expected pressure High temperature or Limit the temperature orflowof the pressure alarm and heating medium (e.g., use hot water interlock which isolates instead of steam) the heating medium High temperature or pressure alarm with operator activation of heating medium isolation Operating instructions to periodically test for inhibitor concentration or activity High temperature and/or pressure alarm and manual addition of quench, diluent or inhibitor Manual activation of quench or cooling system Periodic draining of accumulation points (i.e., knock-out pots)

Overpressure

10 (T)

Overpressure

Chemical reaction Vessel design accommodating maximum Emergency relief device resulting in increased expected pressure High temperature and/or pressure Limit or avoid the storage or unintended pressure alarm and accumulation of reactive materials automatic addition of quench/diluent fluid or Consume reactive intermediate process inhibitor materials as soon as they are produced Automatic activation of emergency cooling system

11

Overpressure

Control or equip Vessel design accommodating maximum ment failure in vapor expected pressure recovery system on Additional insulation to prolong refrigerated/chilled acceptable refrigeration outage storage Roll-over of stratified layers, resulting in high vapor pressure

Emergency relief device High pressure interlock to automatically start spare compressor

Operator startup of spare compressor on high pressure indication

12 (T)

Overpressure

Vessel design accommodating maximum Mechanically agitate or expected pressure recirculate tank contents Use of in-line mixer external to vessel to Emergency relief device premix feeds Provide tank filling system design that avoids tank stratification (e.g., top splash filling) Emergency relief device High pressure alarm and interlock which isolates the inlet flow(s) Emergency relief device or breather vent valve Automatic external cooling water spray

Operating instructions on filling procedure to avoid stratification

13

Overpressure

Failure of upstream Vessel design accommodating maximum process controls, expected or upstream pressure resulting in vapor or Ensure control valves are not oversized flashing liquid feed Ambient temperature change, resulting in higher vapor space pressure Vessel design accommodating maximum expected pressure Use of buried (underground or aboveground) tank Insulate tank Open vent on fixed roof tanks Place tank under a roof Use reflective coating on vessel

Operator activation of flow isolation on high pressure indication Operator activation of water spray on indication of high temperature in vessel

14

Overpressure

15

Overpressure

Blocked outlet flow path

Vessel design accommodating maximum Emergency relief device upstream pressure Interlock to isolate vessel Eliminate unnecessary outlet block valves inlet or trip feed pump on high pressure Outlet sized to eliminate or reduce likelihood of plugging

Procedures for securing valves open via seals or locks

Potential Design Solutions

No. 16

Operational Deviations Overpressure

Failure Scenarios

Inherently Safer/Passive

Active

Procedural Operating instructions to maintain liquid level above heating surface at all times Manual response to low level indication

Ignition/reaction due Vessel design to accommodate maximum Automatic level control to high temperature expected temperature and pressure with low level alarm and shutdown of liquid at unwetted internal Use of external recirculation heating withdrawal system to heating element sursystem ensure liquid is above face Maintain submergence of heating surface heating surface at all times by locating liquid withdrawal connection Vapor space inerting above the heating element Limit temperature of heating medium Selection of materials to avoid rust (i.e., eliminate potential catalytic effects) Heating and thermal expansion of liquid Temperature controls on Install open overflow nozzle to heating medium to containment system prevent overheating Elimination of all unnecessary heating High level shutoff connections preventing liquid from Eliminate capability to "block in" system rising above level where Provide vapor space in vessel expansion would cause overfill Thermal expansion relief valve

17

Overpressure

Operating instructions on control of temperature below a certain limit, or restrictions on the length of time that heat can be applied Instructions on limiting the maximum liquid level Manual shutoff on detection of high level Instructions on draining vessel or isolating source of heat input before blocking in

18

Overpressure (batch or semibatch)

Electrostatic spark discharge and ignition of vapors during charging of solids through an open manhole or charging chute resulting in deflagration or flash fire

Eliminate addition of materials as solids (e.g., use slurry) Charging of solids through a nozzle by means of a closed system (e.g., hopper and rotary airlock, screw feeder, doubledump valve system, etc.)

Automatic inerting of vessel prior to solids addition Ground indicator with interlock to prevent manhole opening if ground connection to solids container is faulty

Manual inerting of vessel prior to solids addition Procedures for manual grounding and bonding of solids container and runnel to vessel Ground operator Avoid use of nonconductive plastic containers Verify acceptable oxygen concentration before charging

19 (T)

Overpressure (Floating Roof Tank)

Ignition of flamma- Provide double roof seal ble atmosphere in Provide adequate natural ventilation tank vapor space folbetweenfixedroof and floating deck lowing seal failure Eliminatefixedroof provided over the on internal floating floating deck roof Ignition source controls (e.g., lightning protection, permanent grounding/bonding) Failure of vacuum system control

Use offixedroof tank with inerting Provide inerting between fixed roof and floating deck End-of-line flame arrester

Periodic inspection of roof seals Periodic testing for combustibles in tank vapor space

20 (T)

Underpressure or Vacuum

Vessel design to accommodate maximum Vacuum relief device vacuum (full vacuum rating) Automatic isolation of vacuum system on high vacuum

Manual vacuum breaking on indication of high vacuum

Potential Design Solutions

I No. 21 (T)

Operational Deviations Underpressure or Vacuum

Failure Scenarios Obstructed vent path

Inherently Safer/Passive

Active

Procedural

Vessel design to accommodate maximum Use of blanketing gas Operating instructions to vacuum (full vacuum rating) pressure control system to verify open vent path minimize vacuum before initiating Vent screen to avoid entrance of foreign withdrawal operation objects Vacuum relief device Operating instructions to Heat tracing of vent to periodically examine vent avoid condensation and opening for obstructions solidification Low pressure interlock to isolate outlet path Vessel design to accommodate maximum Use of blanketing gas vacuum (full vacuum rating) pressure control system to minimize vacuum Insulation Vacuum relief system Open vent Feed heater Vessel design to accommodate maximum Use of blanket gas vacuum (full vacuum rating) pressure control system to minimize vacuum Open vent Vacuum relief system Restrict withdrawal rate Vessel design to accommodate maximum Use of blanket gas vacuum (full vacuum rating) pressure control system to minimize vacuum Open vent on fixed roof tanks Vacuum relief device Insulation Locate tank under roof Operating procedure for monitoring temperature and addition rate of materials

22 (T)

Underpressure or Vacuum

Uncontrolled condensation/absorption of vapor phase component

23 (T)

Underpressure or Vacuum

Excessive liquid withdrawal rate

Procedural limitations on the maximum rate of liquid withdrawal

24 (T)

Underpressure or Vacuum

Ambient temperature change, resulting in vapor space vacuum

Manual vacuum breaking on low pressure alarm

25 (T)

Underpressure or Vacuum

Control or equip Vessel design to accommodate maximum Use of blanket gas ment failure in vapor pressure control system vacuum (full vacuum rating) recovery system on to minimize vacuum refrigerated/chilled Air vacuum breaker storage device Interlock to shutdown compressor/blower on low pressure

Manual shutdown of compressor/blower on low pressure alarm

26

High external level High external pressure on vessel walls liquid from water level in dike or vault resulting in dislodging tank or external collapse of tank wall

Vessel design to accommodate maximum Dike level measurement external pressure with automatic drain or pump-out Use of remote impounding instead of dike Anchor tanks Elevate tank Dike height limits liquid level

Operating instructions to inspect dike periodically and drain as necessary

Storm water drain system Operating instructions to drain storm water collected in the dike after heavy rainfall Keep tanks filled to a minimum liquid level Instructions to cool or shut off feed when temperature rises above a certain level Manual shutdown on high temperature indication

27

High Temperature High temperature Vessel design to accommodate maximum High temperature material fed to vessel expected temperature and pressure of interlock to activate feed material(s) cooling or shut off feeds at desired temperature High Temperature Control failure of heating/cooling system Vessel design to accommodate maximum High temperature alarm expected temperature and pressure and shutdown interlock experienced due to loss of heat transfer Auxiliary cooling/quench Use of heating medium whose maximum or heat transfer system temperature is limited to vessel design Emergency relief device temperature

28

Potential Design Solutions

No. 29

Operational Deviations

Failure Scenarios

Inherently Safer/Passive

Active

Procedural Manual initiation of high temperature shutdown and/or quench/cooling addition

High Temperature Chemical reaction (also see Chapter 4)

Vessel design to accommodate maximum Emergency relief device expected temperature and pressure of a High temperature alarm possible exothermic reaction and interlock shutdown Substitute less-reactive material Automatic addition of reaction inhibitor and/or quench fluid Automatic activation of emergency cooling system Use of buried (underground or aboveground) tank (consider environmental issues) Insulate with fireproof insulation Provide remote impounding of flammable liquid spills Locate vessel to minimize exposure Provide recommended tank-to-tank spacing Fixed fire protection water spray (deluge) and/or foam systems activated by flammable gas,flame,and/or smoke detection devices Emergency relief device Fire detectors

30

High Temperature External fire or failure of internal refractory liner

Emergency response procedures Manual activation of fixed fire protection water spray (deluge) and/or foam systems Monitoring of vessel wall temperature with thermocouples or optical devices Instructions to turn off agitator on high temperature indication

31

High Temperature Excessive mechanical Vessel design to accommodate maximum Agitator shutdown on high temperature agitation expected temperature and pressure detection Limit agitator motor power Leave vessel uninsulated to allow heat loss

32

Low Temperature

Low ambient temperature

Vessel design to accommodate minimum Automatic activation of expected (ambient) temperature heating system Use of buried (underground or aboveground) tank Insulate tank Locate equipment indoors

Manually activate heating system or drain materials which could freeze

33

Low Temperature

Control failure of heating/cooling system

Vessel design to accommodate minimum Low temperature alarm expected temperature and shutdown interlock Auxiliary heating system

Operate system manually or activate back-up heating/cooling system Instructions to isolate feed on low temperature indication

34

Low Temperature

Low temperature Vessel design to accommodate minimum Low temperature alarm material fed to vessel expected feed temperature and feed isolation interlock Low temperature alarm activates external heating

35

Low Temperature

Refrigerant leak into vessel

Vessel design to accommodate minimum Low temperature alarm expected refrigerant temperature and refrigerant system shutdown and/or Use refrigerant with vapor pressure isolation interlock below process pressure Interlock to close depressuring valve at specific pressure Provide external heating

Manual system shutdown on low temperature indication Instructions to deinventory liquid before depressuring Instructions to warm-up vessel before repressuring Instructions to stop feed when level reaches a certain point

36

Low Temperature

Depressuring of Provide metallurgy suitable for low vessel containing liq- temperature uified gases

37

Over-fill

Level control failure causing spill

Install open overflow nozzle to containment system Closed loop filling Diking or drainage to remote impounding

High level alarm and automatic feed cutoff/isolation

Potential Design Solutions

No. 38

Operational Deviations Over-fill

Failure Scenarios

Inherently Safer/Passive

Active High level alarm and automatic feed cutoff/isolation

Procedural Operating instructions on correct or permitted crossconnections between tanks and vessels Operating/maintenance instructions to isolate tanks via blinding and disconnection Manual isolation on high level Leak detection devices (e.g., pH, conductivity, capacitance) and manual isolation

Incorrect or unantici- Install open overflow nozzle to pated crosscontainment system connection Use of dedicated connections Use of incompatible connections

39

Over-fill

Leak from heating/cooling system

Install open overflow nozzle to containment system External heating/cooling system Operation of heating/cooling system at pressures below process pressure Double tubesheet heat exchanger Intermediate heat transferfluidat a pressure below process pressure Install open overflow nozzle to containment system Orifice restriction in utility connection

High level alarm and automatic heating/cooling medium cutoff/isolation Electrical bonding of floating roof to tank

40

Over-fill

Leak or excessive fill from liquid utility system (e.g., utility water)

High level alarm with utility isolation interlock

Operator isolation (e.g., disconnection, blinding, double block and vent) of utilities Leak detection devices (e.g., pH, conductivity, capacitance) and manual isolation

41

Low Level

Level control failure

Locate underflow nozzle to maintain a minimum liquid level in the vessel

Low level alarm with shutoff preventing further liquid withdrawal from vessel via either pump shutdown or closure of block valve Low level alarm with shutoff preventing further liquid withdrawal from vessel via either pump shutdown or closure of block valve

Manual shutoff on low level indication

42

Low Level

Incorrect or unanticipated crossconnection causing uncontrolled outflow

Locate underflow nozzle to maintain a minimum liquid level in the vessel Eliminate all unnecessary crossconnections Use incompatible couplings to avoid improper cross-connections where hoses are used

Operating instructions on the correct or permitted cross-connections between tanks and vessels Operating/maintenance instructions to isolate tanks via blinding and disconnection Manual outflow isolation on low level indication

43

Low Level (Floating Roof Tank)

Ignition of flamma- Locate underflow nozzle to maintain a ble atmosphere in minimum liquid level in the tank tank vapor space following low level that results in floating roof sitting on its internal legs Incompletely sub Locate underflow nozzle to maintain a merged agitator minimum liquid level in the vessel impeller causes Agitator designed to run stably during excessive forces on filling and emptying (e.g., stiffer shaft, vessel wall and heads foot bearing)

Low level alarm with Operating instructions to interlock to automatically monitor tank level shutdown the transfer periodically pump Electrical bonding of floating roof to tank Low level shutoff Instructions to stop preventing further liquid agitation at withdrawal from vessel predetermined level Low level alarm with interlock to automatically shutdown the agitator

44

Loss of Containment

Potential Design Solutions

No. 45

Operational Deviations Loss of Containment

1
Procedural Corrosion coupons with periodic withdrawal and analysis Regular thickness measurements (i.e., nondestructive testing) at key points On-line corrosion analysis with alarm Respond to indication of tank subsidence

Failure Scenarios Corrosion from process fluid

Inherently Safer/Passive Use corrosion resistant materials of construction Protective coatings and paints Double walled tank design

Active Automatic addition of corrosion inhibitor

46 47 (T) 48

Loss of Containment Loss of Containment Loss of Containment Loss of Containment

Subsidence of soil below vessel

Design and construction of tank foundation (piling and soil compaction) Foundation heating system Self-closing drain valves Excess flow check valves Flammable and/or toxic vapor sensors interlocked with agitators

Frost heave (on cryo- Design and construction of tank genic tanks) foundation (elevated pedestal) Insulation between tank and foundation Open drain connections Loss of sealing fluid to vessel agitator resulting in seal failure and emission of flammable or toxic vapors Eliminate bottom connections Limit size of drain connections Circulate vessel contents via external, seal-less pump Use of double or tandem mechanical seal Alternative design which does not use a sealed agitator (i.e., continuous reactor with static mixer)

Operating/maintenance instructions to blind drains when not in use Operators to visually check reservoir levels on regular basis Seal liquid reservoir to have low level sensor and alarm Flammable and/or toxic vapor sensors Operator emergency response to indications of a seal leak

49

50

Loss of Containment (Floating Roof Tank)

Floating roof sinks from snow or water on top of roof or corrosion of roof/pontoons Fire following seal failure on external floating roof Corrosion from contaminated earth moisture trapped between insulation and vessel walls chemical contamination aggressive environment Incorrect or unanticipated crossconnection

Provide fixed roof to protect the floating roof Double deck or pontoon floating roof Corrosion-resistant material selection for floating roof Use fixed roof tank Double roof seal Electrical bonding/grounding of roof and shell Protective coatings and paints Cathodic protection Use above-ground construction Do not insulate tank Locate below-ground vessel in secondary containment Install weatherproof jackets to protect insulation from moisture especially where chlorides may also be present Use of dedicated connections Use of incompatible couplings Physically separate points of connection of incompatible materials Use of interlocks which prevent certain addition combinations

Operating procedures for periodic draining of roof Periodic inspection and repair of pontoons Emergency response procedures Fire fighting foam system

51

Loss of Containment (Floating Roof Tank) Loss of Containment (Underground Storage Tanks and Insulated Vessels)

52

Corrosion coupons with periodic withdrawal and analysis Regular thickness measurements at key points Periodic leak detection

53

Wrong Composition

Operating instructions on the correct or permitted cross-connections between tanks and vessels Isolate tanks and vessels via blinding and disconnection Sample/analyze prior to transfer Color coding and labeling of lines

Potential Design Solutions

No. 54

Operational Deviations Wrong Composition

I
Procedural Periodic analysis to detect the presence of water or other coilfluidin the stored material Periodic draining of floating roof Intermittent sampling and analysis with instructions to cut-off feed Operating instructions to verify inhibition effectiveness periodically Manual activation of back-up pump around system Manual shut off of feed on detection of loss of agitation

Failure Scenarios Leaking tank roofs or coils

Inherently Safer/Passive Indoor location (shielded from rain) External heating/cooling with leak protection Electrical heating instead of steam

Active

55

Wrong Composition

Change in feed composition

Design for all possible feed variations

On-line analyzer with alarms and interlock

56

Wrong Composition Less Agitation

Incorrect inhibitor composition or concentration Failure of agitator causing stratification of immiscible layers External, inline mixing of feeds before entering tank Use of compatible/mutually soluble materials

Automatic control of inhibitor addition rate Agitator monitor interlocked to stop feed stream Automatic backup pump around system

57