What is a Safety Critical Element (SCE)?

SCE’s consist of any element (hardware, software and systems) which

• Prevents the occurrence/realization of a Major Accident Hazard; or
• Where in it’s absence a Major Accident Hazard can be realised

Some examples of SCE’s in the Process Industry:

• Pressure Relief Systems
• Blowdown Systems
• Critical Alarms
• Safety Shutdown Systems
• Emergency Power

What is SCE Management?

SCE Management is a process of:

• Identification of Major Accident Hazards and associated SCE’s;
• Developing Performance Standards for each SCE containing
  • Functionality of the element;
  • Availability of the element;
  • Reliability of the element;
  • Survivability of the element; and
  • Interdependency of the element with others.
• Developing Asset Integrity and Assurance Plans;
• Execution / Verification of Integrity Assurance Exercise throughout facility lifecycle; and
• Applying Change Management Process when necessary.

The following Guideline is available from the UK HSE

SCE Management is Important Because:

• Enables Identification and accurate understanding of the functions of critical safety critical equipments / systems in a Major Hazard Facility;
• Enables Focused Maintenance of critical safety critical equipments / systems in a Major Hazard Facility;
• Enables Systematic and cost effective assurance / maintenance exercise on the SCEs;
• Prevents / Minimizes on-demand failure of SCEs; and
• Ensures that SCE’s are given priority for Maintenance in a facility.

The Means of SCE Identification:

1. Develop the SCE List Using Guidance from standards such as API RP 14C; or 
2. Use quantitative / semiquantitative techniques like HAZID/HAZOP/LOPA and BowTies

What is a QRA?

A QRA is a technical analysis done on Major Hazard Installations (i.e Petrochemicals, Oil and Gas etc) to identify risks to the businesses due to their hazardous activities and substances. A QRA presents risks as below (in quantitative values):

1. Likelihood of Major Accident Events Occurring
2. Probability of fatality (Personnel Risk) of on-site and offsite (societal – if applicable) personnel
3. Extent of consequences of released hazard from the source of release

Why is a QRA needed?

For Industries a QRA might be needed under the following circumstances:

1. Legal requirements, where local governments require corporations to demonstrate that their operating risks towards employees and society are within legal / ALARP limits.
2. Corporate requirements, where companies / investors make calculated risk evaluations and prioritise risk management activities / investments.

What are the contents of a QRA?

These are the information commonly found in a QRA study report:

• Identification of Hazards / Major hazards associated with the facility being assessed
• Identification of major events from the hazards identified and their probability of occurrence
• Personnel risk calculation given commonly in the following forms
  • LSIR – Location Specific Individual Risk – The risk of fatality faced by a person by being present at a specific location in the facility. These values represent comparative risks between locations in the facility being assessed.
  • IRPA – Individual Risk Per Annum – Risk of fatality upon an individual of a specific worker group (e.g: Operator, supervisor) by being present in the facility (assumed being present throughout the year). This is the value used to demonstrate if the fatality risks at the facility / society surrounding are tolerable. The values are normally compared with published tolerable risk values (i.e: OSHA, UK HSE, etc)
  • PLL-Potential Loss of Life – The possibility of fatality within a worker group factoring in their presence and occupancy in the facility. These values are also comparative values between different worker groups
• Representation of consequences of the major events assessed, which commonly consist of:
  • Toxic release
  • Fire 
  • Explosion
  • Unignited Release
• The above are normally expressed as contours indicating effect/severity distance from the event source. An Example below shows fireball intensity across distance. Each contour shows different intensity (the shorter the distance, the higher the intensity and probability of fatality within the region). With the absence of the probability calculations, these charts normally indicate worst case scenarios (subject to assumptions made in the modelling and QRA mathematical inputs). These charts, can be helpful for sites to organize and structure their ERP to improvise the sites preparation in facing major accident hazards.
• Any recommendations for the facility to implement to demonstrate that their risks are ALARP

How a QRA can be used?

A QRA Report is more than just a document to satisfy the authorities. There are more uses of the QRA report provided it has been prepared with adequate thoughts and technical clarity. A QRA can be useful as:

1. Reference in identifying major threats to the business and asset;
2. Reference in organizing a site’s emergency preparedness (being prepared for the worst case scenario); and
3. Technical data for cost benefit analysis when a major business / safety investment has to be taken by the company to improvise safety.

Does your site need a QRA?

If your facility could be quantified as a Major Hazard Site by the local Laws and Regulations, you are likely under the obligation to prepare a QRA for your facility. Major hazard facilities are facilities that handle hazardous substances in large quantities that have the potential to cause major hazard events, fatalities, societal impact or major pollution impact. Some of these facilities may include :

1. Chemical Plants
2. Petrochemical Installations
3. Chemical / Oil storage Facilities
4. Oil and Gas Facilities (both onshore and offshore)

You may need to check with your local Regulations / authorities if you installation falls into the Major Hazard category. With the help of a Technical Safety Professional / Consultant a QRA report can be prepared for your facility, should you need one.

WHAT IS HAZOP?

HAZOP is a systematic hazard identification and evaluation methodology, developed in the 1960’s by the Imperial Chemical Industries (read here). It is an effective and popular method being utilized in the process industries, and is a legal requirement in some regions. This post discusses about the pitfalls / challenges HAZOP teams face.

Pitfall 1: Time

Current project / operational requirements tend to exert time pressure on HAZOPs. Most HAZOPs are required to be finished in a fixed time duration, by the stakeholders of the project, at times without the consultation of the HAZOP facilitator.

The first day of HAZOP is normally slow paced and the momentum picks up as the discussion progresses. The HAZOP team needs time to align / tune themselves with the flow and of the HAZOP.

Determining the HAZOP duration is not exact science. It depends on:

• Scope & Size of the facility in question
• Experience level of the facilitator
• Degree of preparedness of the facilitator and members
• Level of firm engineering details (P&ID’s, PFD’s, process descriptions)
• Level of competency of participants

A HAZOP discussion can usually be delayed by:

• Deviated discussions; usually pertaining to:-
  • Discussions of redesigning the facility being HAZOPped
  • Disagreements on scope, methodology and execution of the HAZOP
• Unavailability of information, data and right personnel on the team

Unwanted delays in a HAZOP can be reduced by some early preparation:

• Node selection, description and markups can be prepared well in advance. The HAZOP facilitator can, up to a certain extent, estimate the duration of the HAZOP. The facilitator could also could be prepared with a plan on how to execute the HAZOP session
• A Terms of Reference Document (TOR) can be prepared in advance. This document can be submitted for formal approval to the stakeholders; stating the scopes, methodology,guidewords, documents required and required members for the HAZOP session. This avoids deviating discussions on methodologies, scopes after the HAZOP has commenced.

Pitfall 2: Level of Information Available

HAZOP Facilitators commonly face this one challenge:

• Out of date drawings and engineering details, specifications;
• Inaccurate SOP’s, safeguarding systems, alarm points etc;
• Vague reaction data; or
• Inaccurate process envelopes / limits of operations.

The effects of inaccurate information is an inaccurate HAZOP:

• Poor deviation identification;
• Poorly defined consequences;
• Poor understanding of the design and operating principles of safeguards; hence underestimating the risk; or
• Long discussions with members trying to make design decisions in the HAZOP / refining the poorly defined parameters.

The need to Re-HAZOP the facility may also arise when the design details change.

To avoid this situation, the stakeholders could ensure the following prior to the HAZOP:

• The process flows should be firmed and finalized
• Finalized P&ID’s should be submitted for the HAZOP
• A firmed basis of design should be made available prior to HAZOP

It should be noted again that the HAZOP forum is not the place to:

• Learn the process; or
• Redesign the process

Pitfall 3: Too Large a Team Size

If a HAZOP team gets too large, the facilitator may face a challenge of having all members focusing on the HAZOP discussion. A large crown tends to deviate from the focus point and have other unrelated discussions during the HAZOP. In a large HAZOP forum, non contributing members are normally observed.

If the HAZOP team is too small, there is a lack of required expertise and the HAZOP will lack substance / or insufficient input.

Generally a team of 6 to 8 core members are deemed reasonable for a HAZOP session. Specifically, the following disciplines are normally core to the HAZOP:

• Process / Production Engineer
• Instrumentations Engineer
• Maintenance Engineer
• Chemists
• Process Safety / HSE Representative
• Operations representative

The terms of reference document (TOR) is helpful for facilitators to inform the stakeholders on assigning the right personnel to the HAZOP. The TOR should specify core, full-time members and non core members.

The non-core members can be requested to be present where the respective nodes requiring their input are being discussed, if the HAZOP is prep-planned by the Facilitator.

It is also worthwhile to keep a phone number of the non-core members and ring them up whenever their input is needed.

Pitfall 4: Distractions

Distractions are common in HAZOP discussions. A HAZOP can be taxing as it requires focus and a thorough thought process of all the members. It easy to lose focus (phone calls, laptops etc) in a HAZOP.

The HAZOP facilitator has the responsibility to maintain the focus of the group and keep the HAZOP process moving and avoiding discussions going out of control.

Adequate breaks, and engagements of all members will help to retain focus and involvement. Conducting HAZOPs outside the facility workplace can help members being called out of the forum.

Should the participants are likely to be engaged in their laptops, the facilitator can engage them by sharing the nodes and drawings electronically(instead of printed copies), too keep them engaged from their devices.

Pitfall 5: Modification / Brownfield Scopes

Most sites have a good written Management of Change (MOC) procedures and require HAZOPs for significant changes (read article on MOC’s here). The common challenge in doing such modification / Brownfield HAZOPs are adequate understanding of the overall HSE impact of the modification to the facility. Most of the times, the HAZOPs tend to focus on the hardware changes, and the cascading changes to / from associated parameters (ie downstream process, control system, utilities, waste management etc) could be overlooked.  It is also true that time is a limit for Brownfield HAZOPs and the Facilitator has limits on covering a broader envelope of the facility. Under such circumstances, there are possibilities of new / escalated hazards overlooked at the facilities not directly related to brownfield tie-ins, and could potentially become a threat.

The following suggestions can help the HAZOP facilitator / stakeholders on effectively HAZOPping modifications / Brownfield scopes:-

• Review the existing HAZOP records, well before the HAZOP and understand / identify the following;
  • The process descriptions and basis of design of the entire facility in question. A broad understanding of the overall engineering design, process control, alarms and safety instrumented systems will be helpful in executing the HAZOP later.
  • Read the consequences identified and check if the modification / tie in would change these consequences (both upstream and downstream). Pay attention to any deviations / scenarios disregarded as not probable / possible under current conditions and check if the modifications increase the probability of occurrence. Forward these points as questions for discussion during the HAZOP.
  • Carefully go through the barriers taken credit for at the process systems both downstream and upstream of the modification / tie-in. Conduct a brief assessment if the barriers would still help post modification / tie-in (Instrument ranges, set points, spurious trips etc). These could be kept as notes and asked as questions to the HAZOP forum
  • A brief check through the action / close outs and the drawing updates is necessary. This is to ensure the HAZOP is conducted on an updated P&ID’s and references
  • Upon such preparation, a note can be prepared to the stakeholders, should it be necessary that the existing HAZOP subjected to a review and more timeframe should be allocated.
• During the HAZOP, the participants can be reminded to be mindful of the wider impacts the modifications / tie ins. If the allocated time does not permit a revisit of the existing HAZOP, notes / actions can be generated for a review later.

Pitfall 6: Vendor Scopes

Facilitators often face some challenges with vendors. Sometimes, vendors participating in HAZOPs of their respective packages are seemed to be reserved or defensive. At times it is difficult to get meaningful HAZOP outputs when Vendor Packages are subjected to HAZOP.

Vendor packages are sometimes proprietary information and subjected to non-disclosure restraints. Sometimes certain vendor package information could affect them commercially end expose commercial sensitive information to potential competitors. Also when a HAZOP dwells deeply into the design level of the vendor packages, vendors do get an impression that their equipment / designs are being criticized, that too before a potential Client. This is seen as a commercial disadvantage. Therefore it is no surprise that Vendors take a defensive stance / reluctant to disclose information in HAZOPs.

The facilitator / stakeholders can try the following suggestions to have better vendor participation in HAZOPs

• Share the TOR so the Vendors are aware of the purpose and approach of the HAZOP. They would be more participative and eager to share information if they see the HAZOP as an opportunity to directly engage Clients and an opportunity to present their products to suit Client’s requirements.
• Vendors are usually cooperative and supportive if they are given an opportunity to. The HAZOP Facilitator, instead of only seeking information from the Vendors, could provide an opportunity to briefly describe their package. Most vendors see this as opportunity and would be willing to contribute. Given the flexibility, vendors could play an effective role in the HAZOPs.
• Normally two types of information are required from vendors in HAZOPs; Operating details of their package and protective functions within their package. The HAZOP facilitator at times faces challenges on getting vendor data on how certain protective functions work, set points etc. Sometimes the Facilitator tries to engage the Vendor repetitively for such information (some might be proprietary). Instead the following approaches can be taken:
  • If inadequate information available from Vendor on the protective functions, avoid taking credit for its availability. This is reasonable since most vendor package protective systems are designed to protect their equipment rather than the facility. Trying to assess these elements in too much detail can be non-productive.
  • Protective functions outside Vendor packages can be taken credit of, including interfacing elements. These data are normally available with the HAZOP team
• The HAZOP team has a duty to protect the vendor’s sensitive / proprietary information. Should such information are really required to be disclosed in the HAZOP, then the stakeholders can hold a discussion on non-disclosure notes, restriction on distribution etc, and get written vendor agreement before requesting disclosure of their proprietary information. The HAZOP Team should also be careful not to have competing vendors in a single HAZOP session; it is counterproductive as the Vendors could be more defensive as they have a duty to protect their company secrets from competitors. An assurance that their sensitive information will be treated appropriately helps to gain Vendor confidence and better participation.

What is indoor air quality?

Indoor air quality (IAQ) refers to the quality of air within buildings / occupied structures which has the potential to affect the health of the occupants. In Malaysia, the Department of Occupational Safety and Health (DOSH) has published a Code of Practice on IAQ in year 2015 (amended in 2010).

Why is indoor air quality important?

Poor indoor air quality (IAQ) can potentially result in health problems; both short and long term. The following health issues are commonly related to poor IAQ:

• Allergic reactions
• Respiratory problems
• Eye irritation
• Sinusitis
• Bronchitis
• Pneumonia
• Risks of dread diseases

Buildings that are mechanically ventilated (split A/C included) have higher potential of poor IAQ. Inadequate ventilation is a contributor to IAQ issues.

What are the pollutants?

IAQ issues are caused by indoor pollutants which are not adequately ventilated. Some of the pollutants and the sources are as follows (list is not exhaustive):

• Environmental tobacco smoke (ETS) exhaled from smokers; ETS is recognized as human carcinogen by the International Agency from Research on cancer (IARC) in 2002. ETS exposure could potentially increase the risk of coronary heart disease and lung cancer.
• Formaldehyde is contained in furniture adhesives, furnishings, lacquer and paints could be emitted indoors and expose the occupants. Extensive exposure to formaldehyde could increase the risk of leukaemia and cancers of the nose, throat, and sinuses.
• Volatile organic compounds (VOC – typically solvents) contained in furniture paint, varnishes, wax, aerosol sprays, air fresheners and cleaning liquids can be emitted indoors. VOCs can potentially lead to health problems such as Eye, nose and throat irritation, headaches, loss of coordination, nausea, liver and kidney damage and central nervous system damage. Some VOC’s are suspected carcinogens.
• Ozone could originate primarily from emitted from copiers / printing machines and indoor electrostatic air cleaners. Studies have shown that extensive short-term exposure ozone can temporarily affect the lungs, the respiratory tract, and the eyes. Long term exposure could potentially impair lung function.
• Other sources include smoke and volatiles from indoor cooking / stoves and biological agents (virus / bacteria etc); which have similar health impacts described above. Poorly ventilated interconnected buildings could also contribute to pollutants in occupied buildings.

The following are acceptable indoor air quality parameters in Malaysia (COP-IAQ):

What you need to do?

The following can be undertaken by occupiers of a building to manage IAQ issues at workplace:

As a proactive measure, the employer, could conduct building walkthroughs and identify potential IAQ hazards (substances, activities that potentially contribute to IAQ issues in the building); or

Identify potential IAQ issues by having a complaint registration and investigation procedure. Employees should be made aware of the IAQ hazards and encouraged to record a complaint to the occupier / employer if they have significant “sick building syndrome” symptoms in the workplace, which may include one or more of the following:

• eye and nose irritation
• fatigue
• cough
• rhinitis
• nausea
• headache
• sore throat

Should the complaints / walkthroughs be found to be related to workplace IAQ, the employer should arrange for a IAQ assessment and monitoring by a competent IAQ Assessor (certified by Malaysian DOSH). The assessor would furnish an assessment report, verifying the findings and suggestions of corrective actions, the IAQ assessor may recommend a few approaches, and the employer shall implement them to the extent where it is as far as reasonably practicable.

What is an MOC?

Change in an industry is inevitable. As soon as a processing facility is commissioned, engineers begin to think of improvising and optimizing. New and improved products flood the market. Equipment bypasses or temporary repairs may be needed. This is a common scenario in any processing facility.

The MOC is a review and assessment process applied in process industries where any changes to plant, process, programmable electronics and personnel are subjected to hazard reviews and controls prior to resuming operation. MOC is one of the crucial elements of Process Safety Management.

Why is MOC important?

The following major accidents have made the process industries realize the importance of managing change and the potential consequences for lack of MOC’s:

Flixborough (1974) –  An explosion involving 30 tonnes of cyclohexane occurred at the caprolactam manufacturing plant. It had cost the lives of 28 workers, injured 89 others as well as extensive offsite damages. The explosion event was initiated from a temporary change. The plant personnel have decided to temporarily bypass a reactor which was leaking (read more here). Temporary piping was installed to bypass the faulty reactor and continue the process. However, the changes were done hastily with the following shortfalls, which led to loss of integrity of the piping and subsequently release of cyclohexane and the explosion:

• No hazard/design review was undertaken
• Personnel designed and executed the change were not professionally capable
• Poor documentation, design work and understanding of the changes and the hazards associated with it

Bhopal (1984) –  The incident involved release of Methyl Isocyanate resulting in deaths of thousands of people in the surrounding of the plant. The disaster was initiated by a runaway reaction involving water leaking though a jumper line into Methyl Isocyanate storage (read more here). Among other factors that led to the disaster, a poor management of change of installing the jumper line (having done no hazard assessments of the change) is one of the contributing factors.

A Management of Change is crucial in any facility to ensure that:

• The change does not introduce new hazards to the facility or aggravate existing hazards, and potential hazards are adequately managed;
• The change does not disable / jeopardize any safety barriers in place; and
• Changes (even temporary ones) are adequately designed, assessed, approved by competent people and properly documented.

What are the common contents in an MOC procedure?

While the MOC procedures vary among organizations, the following are minimum requirements in an MOC procedure (list is not exhaustive):

• Accurate definition of “change” within company purview;
• Adequate provision and requirement for review and hazard assessment of the proposed change;
• Provision indicating that assessments and reviews should be conducted by competent people;
• Provision for detailed hazard assessment and studies (i.e HAZOP, LOPA) if necessary;
• Provision to record and document all assessments and reviews, as well as the decision made on the proposed change and relevant justifications;
• Requirement to meet regulatory standards;
• Provision to identify and update cascading changes to drawings, procedures, work instructions, Process Safety Information and HSE Case documents (CIMAH, EIA etc);
• Requirement for training and instructions should the proposed change is implemented;
• Review and acceptance of the change post implementation;
• Assurance of implementation of identified risk control measures;
• Provision for monitoring and controlling temporary changes;
• Provision for audit and review of the MOC system; and
• Requirement for document control management of the MOC system.

Common Failures of MOC’s

While most facilities would have well-documented MOC procedures in place, implementing them may be a challenge. The following are some common challenges industries face in implementing MOC’s

• Perception: Temporary or insignificant changes do not need an MOC. This would probably the most common argument for resisting / bypassing an MOC procedure. It is often perceived that conducting MOC for a small / temporary change would be a waste of time and resources. It should be understood any change is a potential hazard and the MOC helps the facility owners to satisfy themselves that the hazards, if any are clearly understood and are managed properly. Any non like-for-like replacement should be treated as a change and an MOC should be applied. If the change is insignificant, then it should be documented as such. Temporary changes should not be neglected as they are equally hazardous as permanent changes. In many facilities, unchecked temporary changes have ended up as permanent solutions (as organizations / people forget why the change was made in the first place). Note that the Flixborough disaster was initiated from a temporary piping fixture; the incident occurred about 2 months after the change was done.
• Without complete documentation / document control MOC is not possible. It is true that incomplete / unmanaged documentation (process details, drawings, technical data) associated with the facility will affect the execution of the MOC. Organizations do not have memories, they rely on experienced personnel and documented data. If up-to date data is not available, then there is a possibility of misguided decisions to be made in the MOC execution, which could also be hazardous. Organizations should keep up-to date Process Safety Information details (PSI is an element of Process Safety management), so an accurate reference is available when needed. However, lack of such information should not avert execution of MOC procedures. Teams should find other means of identifying technical data (Team discussions, HAZIDs, HAZOPs, Vendors, Site visits) and obtain as much information possible. The risk of implying a change without and MOC still outweighs the resource spent to find information.
• Perception: MOC is a hindrance when companies are under time pressure / emergency situations. Time spent on assessing changes and potential hazards is not time wasted. It is time invested to adequately analyze and ensure the facility is not subjected to additional hazards. In fact, studies have reported that changes that underwent proper MOC procedures have recorded higher return on investments (>100%) compared to changes which did not (<40%). Under emergency scenarios (Emergency: life threatening situation, possible pollution or asset loss situation) the MOC should not be neglected either. The ERP procedures should take precedence and put the facility in safe mode. The MOC can be still executed to assist the ERPs where adequate thought process is done to ensure the changes do not aggravate the hazards.
• Overcomplication of MOC procedures. MOC implementation requires substantial amount of paperwork and documentation. It is the intent of an MOC to document as much relevant information as possible. However, when too much emphasis is given to administrative features, overcomplication can happen. Some common overcomplication of MOC procedures include too many signatories / review cycles, extensive screening forms and automation beyond necessity. Such overcomplication could result in discouraging change initiatives among plant personnel. Personnel might not be proactive in suggesting / initiating beneficial changes in fear of extensive paperwork and authorization cycles. An MOC procedure should be aptly designed, not too complex that it becomes a paperwork burden, nor too simple that it misses its objective. It should be user friendly; with only relevant review and authorization signatories and avoid extensive forms to fill. Automation is preferred if it simplifies the documentation work.
• Perception: The change does not involve hazardous processes or materials, hence an MOC can be forgone. This is quite common especially when the change involves changes by departments not directly related to the process activities. For example, the organization’s procurement might change a vendor as a business decision. Indirectly, the change may affect the process in terms of the type / quality / property. It is worthwhile that employees in all levels of the organization, even those who are not directly involved in operations, to be exposed the intent and risk reduction benefits of the MOC procedure. Whenever such “nonhazardous” changes are done, at some point the potential impact to the processes can be identified and rectifications can be planned.
• The MOC is not going to identify all the hazards associated with the change, so what is the need for it? It is true there are limitations with MOC, but so is any other safety / operational procedure. The objective of MOC’s is to identify credible (if not all) hazards associated with the change, and satisfy that the change will not subject the facility to intolerable risks. The MOC, like any other safety procedures, involves continuous learning and upgrades. By having the right personnel and asking the right questions an MOC should deliver reasonable risk reduction associated with the changes.
• Perception: The intent of an MOC is to get permission and budget approval to execute the change. That perception is only partially true. The primary objective is to assess the intended change, with all the stakeholders, and ensure that the risks associated are tolerable and the benefits are worth the risks and resources put in. The intent is to have the proposed changes reviewed by relevant professionals with adequate technical competence. Gaining administrative / budgetary approval is secondary in MOC.

Guidance

Guidance is available on MOC from:

• US Occupational Safety and Health Administration
• The UK Health and Safety Executive

Excess Flow Valves

What are excess flow valves?

Excess flow valves are spring loaded check valves. When the flow of the fluid exceeds the limit of the valve, it closes and shuts off flow.

What are they used for?

Excess flow valves are protective devices intended to prevent the uncontrolled release of hazardous materials from road, rail and marine transport vessels, stationary storage vessels and distribution networks. During downstream leak or rupture, the flow across the EFV will exceed its limit and closes the valve, preventing further release to atmosphere. Properly designed, installed, and maintained EFVs could be an effective accidental release prevention measure.

Incidents involving EFV failures

The following incidents have occurred because of inadequate protection involving EFVs in the past:

A hose rupture from a chlorine railcar released 48,000 pounds of chlorine in Missouri (2002). The incident involved evacuation of nearby residents, injuries needing hospitalization and damage to vegetation. Investigations found that EFV on the railcar did not function as needed, and there were no alternative means of stopping the chlorine release.

Rupture of offloading line on a railroad tank car released methyl mercaptan into the atmosphere. The incident cost the lives of 3 employees and resulted in evacuation of nearby residents. Similarly, it was found 2 EFV fitted onto the system did not function.

A hose coupling break from an LPG truck resulted in release of propane, and the EFVs fitted onto the system did not function to stop the release.

Lessons Learned

Flow restrictions in the affected lines (i.e pipe length, branches, reduction in pipe size, and partially closed shut-off valves). This is also true in lines fitted with pumps to transfer the material. If a release occurs downstream of the pump and the EFV activation point is greater than the pump capacity, the pump will function as a regulator limiting the flow below EFV activation limit.

An EFV is also has its limitations when the release involves small leaks. Upon closure of EFV, the pressure upstream will keep it closed until the downstream pressure equals the upstream pressure. When the pressure has equalized the valve will re-open. In the case of a hose rupture, line break situation the pressure will not equalize and the valve will stay closed. In the event of a bleed hole, the EFV does not provide 100% flow shutoff and will continue to bleed.

The installation of EFVs also play a role in its effectiveness. Some EFVs are designed for vertical mounting, and some for horizontal mounting. The mounting and positioning of the EFVs need careful attention to ensure they will perform adequately on demand.

Other factors that limit the functionality of an EFV are as follows:

• Insufficient upstream pressure which limits the flowrate across the EFV
• Buildup of contaminants in the EFV preventing its closure

Hazard Management and Control

The following is recommended in utilizing EFVs as hazard control measure in hazardous service:

• Conduct adequate hazard identification and risk assessment (HAZOPs, HAZIDs) on the hazardous processes;
• Analyze credible release scenarios and use these data to adequately design / select EFVs;
• Consider the characteristics of the hazardous material in designing / selecting EFVs. (e,g two phase flows upstream of the release point upon flashing conditions);
• Ensure correct installation of the EFVs (as per vendor instructions);
• Adequate maintenance of the EFVs;
• Applying proper change management procedures and operating procedures;
• Additional protection systems, depending on the degree of hazard of the material handled. This may include

• • Remote shut off systems;
  • Emergency shut off valves; or
  • Hoses with self-closing mechanism in case of detachment.

Guidance

Guidance is available from the following institution on the application of EFVs (list is not exhaustive):

• Chlorine Institute (CI);
• National Fire Protection Agency (NFPA); and
• Compressed Gas Association (CGA).