December 2020

Environment and Safety

Applying tools to strengthen safety and risk management

The same characteristics that make hydrocarbons useful as fuels can also make refineries, and any other areas where processing or storage takes place, potentially dangerous.

Pinto, N., Emerson

The same characteristics that make hydrocarbons useful as fuels can also make refineries, and any other areas where processing or storage takes place, potentially dangerous. Those who work in such plants depend on effective safety systems, training and a constant awareness of the potential for harm. This enables many well-run and well-maintained facilities with conscientious people at all levels to compile a long record of safety.

However, between February and April 2020, three major refinery fires (FIG. 1) in the U.S. showed that there are still real hazards despite all the efforts to prevent such events. This suggests four primary questions when it comes to fire prevention:

FIG. 1. Most facilities maintain safe operations, but incidents still happen.
  1. Are the dangers not fully understood?
  2. Is proper training in place for personnel?
  3. Are up-to-date technical solutions employed?
  4. Is the combined effectiveness of all the safety measures in place adequate?

The following briefly examines each of these questions.

For the first question, it is difficult to argue that individual companies, standards organizations and insurance companies have put inadequate efforts into understanding the nature of the dangers involved. This has been the subject of lengthy study, examining every imaginable scenario of how fires can start and how to prevent them. There is no shortage of resources available today.

Regarding the second question, anyone researching major safety incidents of the last 10 yr–20 yr will find that plant personnel can certainly be a major contributing factor, if not the outright cause. This is often the result of short staffing and/or inadequate training, and, sometimes, violations of procedures to meet production goals. It can also come in the form of management’s cutting of maintenance budgets, resulting in malfunctioning instrumentation remaining unfixed, and also leaving operators with poor situational awareness. Bad information results in bad decisions, and, consequently, in undesirable results.

Regarding the third question, there is no shortage of potential technical solutions. Over the years, countless companies have developed instruments and systems to detect when a process upset or equipment failure is beginning to escalate into something bigger and can lead to a loss of containment. The problem is how these solutions should be evaluated and applied to deliver the highest level of protection.

The fourth question is the most difficult to answer. No technical solution is ever 100% effective. People can get careless and ignore their training. Safety mechanisms of all kinds are ultimately capable of reducing risk, but none can eliminate it entirely. Some solutions also impair the ability to operate effectively, so it is possible to go too far with protections. Therefore, a company must ask itself: Have we done enough to protect our people and plant, while providing ourselves the ability to operate in ways that allow us to fulfill our production and financial goals?

Different companies approach this with different attitudes, as examinations of various incidents will bear out. While most companies are very fastidious about safety, some may not be as diligent. Still, this is not a decision that a company ultimately makes solely on its own, since other stakeholders also weigh in.

Local authorities want to make sure that the plant has taken appropriate precautions to avoid causing environmental damage or harm to workers and the local populace. They enforce this through the permitting process and inspections, and they can force a shutdown, if necessary. Moreover, the insurance carrier protecting the company and facility wants to ensure that it is not taking undue risks with an irresponsible client.

How much protection is enough?

A refinery or major petrochemical plant will have safety strategies and systems arranged to provide multiple layers of protection (FIG. 2), each designed to trigger a minimally disruptive response to a developing incident. These systems include:

FIG. 2. A loss of containment means that an incident has broken through multiple protective layers. Source: Kenexis Fire and Gas Systems Engineering Training Ltd.
  1. The distributed control system (DCS), which keeps the process on an even keel and controls upsets
  2. Safety instrumented systems (SISs), which respond to problems that the DCS cannot handle to maintain product containment—shutting production down, if necessary
  3. Gas detectors, which identify when a release of flammable products has occurred
  4. Flame detectors, which identify when an actual fire has started, and, consequently, may trigger suppression systems.

Note: In this list above, 1 and 2 are preventive, whereas 3 and 4 mitigate an incident in progress, and each level has a progressively disruptive response connected to it.

Designing protection

Determining what these systems should look like is covered under a variety of standards. For example, SISs are covered by the International Electrotechnical Commission (IEC) under IEC 61508 and IEC 61511. Moving into the realm of mitigation efforts, the picture changes to the National Fire Protection Association (NFPA), since fire is the primary concern. The NFPA has standards applicable to virtually any type of residential, commercial or industrial building or facility, so it can be a challenge to figure out what applies in each situation.

The two standards used most frequently for refineries and process plants are NFPA 70: National Electrical Code and NFPA 72: National Fire Alarm and Signaling Code. These are enormous in scope, as they apply to commercial and industrial facilities.

NFPA 70 Chapter 5 is the origin of the hazardous location classification system used extensively in process plants, which most will recognize as Class 1, Division 1, etc. If more detail is needed, there is also NFPA 497: Recommended Practice for the Classification of Flammable Liquids, Gases or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas. The purpose of this system is to avoid putting electrical equipment capable of creating arcs and heat in areas where there might be flammable fumes present, thus denying a potential fire an ignition source.

NFPA 72 is more specialized, and concentrates on fire detection and alarming. Again, it covers any conceivable application, so that much of it is irrelevant to a refinery. It expands on NFPA 70 in that it discusses the specialized wiring necessary to support fire detectors and alarms. It also cross-references with other NFPA standards, including those already mentioned, as well as the following:

  • NFPA 15: Standard for Water Spray Fixed Systems for Fire Protection
  • NFPA 30: Flammable and Combustible Liquids Code
  • NFPA 59A: Standard for the Production, Storage, and Handling of LNG.

For a company trying to decide if it has deployed adequate systems necessary to protect a facility and its people, the standard is important but is often not adequate enough. Some specific areas are well detailed, while others seem particularly vague. NFPA 72 Chapter 17 (Initiating Devices) offers a case in point when comparing the discussions related to gas detectors and flame detectors.

Gas detectors

Combustible gas detectors are installed to recognize when flammable hydrocarbons have escaped their containment and might be drifting with enough concentration to burn if they find an ignition source. These can be gases (e.g., methane and propane) or liquid vapors. Some designs can detect a presence of gases or vapors when the concentration is below the lower explosive level (LEL), allowing responders to locate the source before a fire is possible.

Gas detectors can use three technologies (FIG. 3), which include:

FIG. 3. Combustible gas detectors use different approaches, including (a) acoustic<sup>a</sup>, (b) point source<sup>b</sup> and (c) open path<sup>c</sup>.
FIG. 3. Combustible gas detectors use different approaches, including (a) acoustica, (b) point sourceb and (c) open pathc.
  • Acoustic detectors, which listen for the characteristic noise of a compressed gas leak
  • Point detectors, which use either catalytic bead or infrared sensors
  • Open-path detectors, which detect a target gas moving through a beam of light.

NFPA 72 Chapter 17.10 covers gas detectors, and it is frustratingly brief. It offers several statements, including one saying that detectors shall be listed by ANSI/UL, and that “the selection and placement of the gas detectors shall be based on an engineering evaluation.”

Flame detectors

Once a fire has started, detecting it as quickly as possible is critical for avoiding plant damage and possible harm to personnel. Several technologies have been used, most of which respond to heat or smoke. The problem with these is that they require the fire to burn long enough to reach the measurement threshold. This works adequately in an enclosed space, but is not ideal for the open construction of refineries and chemical plants. The fire can easily grow and spread before enough heat or smoke has accumulated to be detected.

A newer technologyd (FIG. 4) detects a fire in progress by “seeing” specific wavelengths of ultraviolet (UV) or infrared (IR) radiation characteristic of hydrocarbon-, hydrogen- and carbon-based fuel (FIG. 5). As soon as a fire breaks out, the sensor can recognize the change in a matter of seconds and trigger the desired response. Since the range of possible fuels in each situation is limited, it is possible to select a unit able to detect the relevant wavelengths, thereby minimizing the potential for a false alarm from an unexpected source, such as sunlight, arc welding or incandescent lighting.

FIG. 4. Flame detectors respond to specific wavelengths produced by burning hydrogen- or carbon-based fuels.
FIG. 5. Combustion of fuels containing hydrocarbons, hydrogen and/or carbon creates intensity peaks in detectable wavelengths.

NFPA 72 Chapter 17.8 (Radiant-Energy-Sensing Fire Detectors) details how these should be selected and deployed. Section 17.8.2 details the specific wavelengths involved and how the radiant energy is propagated. It discusses how smoke from burning fuels affects radiation and how to minimize interference. Section 17.8.3 provides an extensive discussion of spacing, location and coverage (very helpful to someone designing an installation), and even includes maintenance tips.

Uneven prescriptiveness

Given the uneven treatment of various topics, what is the purpose and value of a standard? It is an authority, but not a design guide. A technician could refer to it to determine a critical detail (such as how to terminate the cable of an acoustic gas detector correctly), but it will not say where to place the gas detector. The person reviewing plans for a new fire suppression system will undoubtedly use it to verify many specific points, but it will not help much when plotting the initial strategy.

Standards also change over time. NFPA updates its standards every 3 yr, and there are changes for each version. A facility that has been operating for many years (e.g., refineries and chemical plants) likely has items installed under many editions of the relevant standard.

It is rare when a standard is revised drastically enough to call for something installed under a previous version to be changed. The more common situation is where an old installation does not take advantage of new technologies that were not available in previous years. For example, a flame detector using a slow-acting heat sensor could be updated to a newer flame detector to provide a quicker response and a higher level of protection.

The NFPA’s National Fire Alarm and Signaling Code Handbook (an expanded version of NFPA 72, with extensive commentary and resources) advises:

Whenever a system is modified or updated, it is vital that the system designer have a thorough understanding of the existing equipment, including its capabilities and the system’s wiring (i.e., circuit class, type, and configuration). Where applicable, the software and firmware of existing systems need to be examined to verify compatibility with the new equipment. Often, the existing equipment is too old to interface easily with the newer technology used in the planned additional equipment. The existing equipment may or may not be able to be modified to conform to current Code requirements. In some cases, the most prudent choice may be to install a new fire alarm system or other emergency signaling system where used.

A standard is most important to the people evaluating or inspecting an installation. This could be the state or local permit-granting body or an insurance company evaluating the risk at a client’s facility. The plant needs to know the standard well enough to defend its actions if challenged by an inspector, which, in some cases, might require pointing to the relevant chapter and subsection.

Safety saves on insurance

The ultimate yardstick for measuring a safety system’s effectiveness is how well the plant runs and if all its employees go home alive and well every day. Success may be the result of a very well-designed system operated by conscientious and well-trained employees. Conversely, at a more haphazard facility, it may be the result of luck combined with people who can improvise.

Insurance companies must look at a facility and make an objective assessment to determine the underlying reality. They consider the likelihood of an incident and what kind of equipment damage might result, as well as potential dangers to personnel, the local population and environmental impact. Based on these and other factors, the insurance company decides if it wants to work with the prospective client and what premiums to charge based on risk and the probable cost of an incident.

Obviously, the intentionally safe company deserves to work with a top-rated insurer and to receive a preferential rate—whereas, the duct-tape-and-bailing-wire plant will pay heavily, if it can get a policy at all. Luck does not hold forever.

What is the value to the intentionally safe company? It likely spent heavily on its systems, and probably will not make all this money back in reduced insurance costs. However, insurance savings may not be the only benefit, because the company should also suffer fewer production outages and less personal injury settlements.

At the other end of the spectrum, could the haphazard company improve and update its systems to not only cut its insurance costs, but also increase production and make life better for its employees? In most cases, the answer to this question will be an emphatic yes.

Safety has many costs, but it also has many benefits. Calculating the optimum relationship can be difficult, but it is better to err on the side of safety.

Path to success

Designing effective safety systems and training must be left to experts. The overall strategy, component selection and implementation all require a knowledge of the big picture. At the same time, attention must be paid to the smallest details to create effective end-to-end systems that can pass even the most critical inspection. This applies to new systems and to the evaluation of existing installations, with an eye toward improving sensor selection for higher sensitivity or faster performance. HP


         a Emerson Incus Ultrasonic gas leak detector 
Emerson Net Safety Millennium 2 SC310 catalytic bead combustible gas sensor
         c Emerson Rosemount 935 open-path combustible gas detector
         d Emerson Rosemount 975 flame detector

The Author

Related Articles

From the Archive



{{ error }}
{{ comment.comment.Name }} • {{ comment.timeAgo }}
{{ comment.comment.Text }}