This article originally appeared in the November/December 2019 issue of the Nitrogen+Syngas magazine.
The annual Ammonia Safety Symposium is organised by AIChE’s Ammonia Safety Committee and is dedicated to improving the safety of plants that manufacture ammonia and related chemicals, such as urea, nitric acid, ammonia nitrate, and methanol.
Attendees, including plant safety personnel, plant managers, and process engineers representing a spectrum of nitrogen-fertilizer-based industries, all participate in the symposium, where they share technological advances and discuss strategies for improving plant safety, maintenance, and management. Ammonia industry leaders and practitioners describe how their organisations avoid or manage potential plant accidents, and present solutions to a variety of safety engineering problems.
From September 8th to September 12th, 2019, 350 engineers from more than 30 countries and 100 companies attended the AIChE’s 64th Ammonia Safety Symposium at the Hyatt Regency hotel in San Francisco, California in USA. The San Francisco weather was ideal for outside activities and encouraged many people to visit the Golden Gate Bridge, Fisherman Wharf etc. Johnson Matthey’s outing included a tour of the city via a Hornblower cable car to see the highlights of San Francisco, followed by dinner at Bistro Boudin, site of the bakery for San Francisco’s famous sourdough bread. Haldor Topsoe’s outing included a cruise to Angel Island on San Francisco Bay, which gave people the opportunity to view the San Francisco skyline.
Cultures' influence on safety
This year’s keynote speech “Cultures’ Influence on Safety” was presented by Manny Ehrlich, member of the US Chemical Safety Board (CSB), and focused on process safety. Manny’s speech grabbed the attention of the audience as he recounted major incidents that have taken place in the chemical industry over a number of decades.
Safety culture is how the organisation behaves when no one is watching.
In his presentation Manny stressed that most root causes don’t involve rocket science issues and that there are many repeat or repetitive causes. In many cases the issue becomes one of repetitive findings related to deviation from basic fundamentals of acceptable safety practices when there is full understanding of what deviation from them could mean.
For example, typical repetitive issues for confined space violations include:
- Hot work practice violations
- Improper handling hazardous materials:
- Flammables
- Combustibles
- Toxins
- Corrosives
- Explosives (or substances capable of exploding)
- Poor utilisation or lack of proper PPE
- Poor utilisation or lack of proper RPE
These issues occur over and over again. But why are we seeing repeat “violations” involving issues that we know to be problematic? Is it:
- a competence issue?
- a personnel issue?
- an individual/organisational issue?
- attitudinal in nature?
- behavioural in nature?
- related to risk?
- an ownership problem?
- a lack of commitment issue?
- a normalisation issue?
- a matter of beliefs?
It is believed that the intersection of all of these issues in aggregate constitute “the culture”, or in this case, safety culture. Safety culture is important because management systems and their associated policies and procedures depend upon the actions of individuals and groups for their successful implementation. It is the product of the individual/group values, attitudes, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organisation’s health and safety programs.
A more succinct definition has been suggested: “Safety culture is how the organisation behaves when no one is watching.” Human beings take shortcuts for a variety of reasons and may do so without unacceptable consequences. Over time this can result in normalisation of deviance and lead to a poor safety culture, for example:
- little or no safety planning;
- no balance between safety and profitability;
- lack of training;
- no reporting of hazards;
- general lack of awareness of consequences of actions which could lead to a catastrophic disaster;
- inevitable consequences of actions led to catastrophic disaster;
- no commitment from workforce;
- feedback loop is not closed after an accident;
- management blames individuals for an accident.
Manny stated that we have to stop behaving like an ostrich, sticking our heads in the sand and believing it will improve if we do nothing. We need to start talking, start doing, and by believing together we can move toward zero fatalities.
Safety incidents
The key safety related papers were:
Fire due to oil tank rupture
A power outage tripped the ammonia plant and 30 minutes later the syngas compressor oil tank exploded. They had all the components needed for an explosion in the tank. Oil vapour likely containing hydrogen degassed from oil to a limited extent ignited as oxygen enriched ambient air entered the oil tank. The missing pressure switch trip on the nitrogen compressor and the leaking end lid contributed to the incident.
It is very unlikely to identify such a scenario through a HAZOP, where double jeopardy isn’t usually considered. All unwanted incidents, like a nitrogen compressor not stopping when it should, must have two independent technical barriers. In this case the water mist system limited the damage. Another fact is that during the 30 minutes between the plant trip by the power outage and the fire, the control room operator got 900 alarms from the DCS.
Process gas cooler (pgc) tubesheet thermal disintegration
This paper highlighted the complexity of designing and operating a process gas cooler. The fibre materials used (high SiO2 content) were not resistant to the reducing gas atmosphere and started to dissolve over time, opening gaps. The inliner of the central bypass was restricted in axial movement and pushed the refractory away from the tubesheet.
The gap between the ferrules and the tubesheet holes was not closed with resistant material and allowed the gas to flow through. The learnings were as follows:
- Damage along the tubesheet (gas side) cannot be detected during regular inspections without having the refractory removed.
- If the gas bypasses the refractory it may cause overheating of the metal shell, leading to coking and material loss. Also, the risk of high temperature hydrogen attack arises.
- Fitness for service analysis can determine whether a PGC with a damaged tubesheet is further usable.
- During equipment design an exchange of all operating parameters including start-up and shutdown conditions is extremely important as design parameters are easily compromised during those operational stages.
- During manufacturing and repair a high focus must be put on refractory design and execution as well as details regarding ferrule tolerances and the bypass in liner.
HP SCRUBBER UNDETECTED CARBAMATE CORROSION
In February 2018, a leak was noticed in the spherical dome part of a HP scrubber in a urea plant. The plant was stopped immediately to attend to the leak. Upon opening of the HP scrubber sphere, it became clear that severe corrosion had occurred on the liners. The liner was covered with a huge amount of corrosive products and many cracks were observed which resulted in leaks. The severe corrosion of the pressure bearing part of the sphere was due to the fact that the liner leakage preceding this corrosion could not be noticed as leak detection holes got plugged.
This demonstrates the importance of a reliable and robust leak detection system. Nowadays the technology licensor recommends using a state of the art leak detection system, which is based on continuous forced air flow fed to an ammonia analyser (so-called pressurise system), which can be connected to the DCS system. The leakage in the liner occurred due to so-called strain induced intergranular corrosion (SIIC). This was the result of condensation of reactor off gases in combination with plastic deformation of the 316L UG liner. The plastic deformation was mainly the result of bending the liner plates during manufacturing.
However, frequent temperature and pressure cycles may play a role as well. Condensation of the hot reactor off gases cannot be avoided completely in the HP scrubber sphere, despite the presence of a steam tracing. Plastic deformation of the 316L UG liner material cannot be completely avoided either. Due to the liner leak, ammonia-carbamate started to corrode the carbon-steel pressure shell. Besides wall thinning, hydrogen induced cracks (HIC) were also developed in the carbon-steel. Unfortunately, the selected steel (20MnMoNi45 DIN 17201) for the HP Scrubber sphere is prone to this failure mode (HIC) due to the high strength properties. Corrosion of the carbon-steel pressure retaining part should be avoided always. This is managed by having a reliable leak detection system in place. Furthermore, the risk of hydrogen induced cracking can be reduced by applying so-called low strength steels instead of high strength steels.
DAMAGE OF COMBUSTION AIR DUCTING
Severe damage to the parent material and structural integrity of the combustion air ducting (CAD) arrangement was experienced in an ammonia plant primary reformer. The root cause of the damage was the reverse flow of excessively hot combustion air/flue gas from within the radiant section of the primary reformer through the CAD. Investigation into the cause of the severe damage was performed in conjunction with the furnace designer. During a controlled plant shutdown of the primary reformer, the FD fan was taken offline. Control logic causes both the cold and hot air doors to open.
The ID fan would then remain online to assist in cool down of the entire reformer train. It was noted on May 2016 that the FD fan was taken offline followed by an ID fan trip within a few minutes. With the cold and the hot air doors opened and no forced or induced draft, hot flue gases have travelled from the convection section to the radiant section, up through the CADs to the hot air doors, and towards the atmosphere. All six CADs in the primary reformer penthouse have experienced flue gas temperatures in excess of 980°C (1,800°F). Due to lack of temperature indicators within the ducting, it was not possible to determine the actual temperature that the CADs were exposed to.
To prevent a reoccurrence, the following recommendations were made:
- Adjust the cold and hot air doors logic: In the event the ID fan trips during a plant shutdown, control logic should automatically close the hot and cold air doors to mitigate against the potential for reverse flow through the CADs.
- Amend standard operating procedures (SOPs): Restart of the ID fan is now included in the SOP if the ID fan trips during a plant shutdown. This would allow for controlled cooling of the primary reformer train from the radiant section through the convection section. In the event the ID fan cannot be restarted, ensure that the hot and cold air doors are closed until restart of the ID fan.
- Install temperature indicators (TIs) on all six CADs within the primary reformer penthouse: Due to the absence of TIs within the CADs, the plant operators were unaware of the fact that the CADs were experiencing temperature excursion during the plant shutdown. TIs were subsequently installed on the CADs with high temperature alarms of 400°C (750°F) set to assist with operator intervention in the event of temperature excursions. The consequence associated with temperature excursions within the primary reformer CADs can be significant and the importance of continuous operator monitoring during plant shutdowns and startups would be crucial in identifying and addressing deviations in a timely manner. Evaluation of installed instrumentation on the primary reformer train as well as a review of SOPs for primary reformer shutdown should be considered.
SECONDARY REFORMER BURNER TIP FAILURE
A loss of containment scenario occurred on the secondary reformer in an ammonia plant resulting in an emergency shutdown and a fire emitting from the top head of the vessel. The root cause of failure was a cracked weld joint on the internal air distribution pipe. This caused a flammable mixture to leak internally in the secondary reformer and flame impingement on the internal components eventually deteriorated the liner, refractory, and outer wall. Further analysis indicated that cracking on the air distribution pipe was caused by thermal fatigue. Strict quality control (QA/QC) is required for repairs on a system like this. Every practical effort should be made to reduce the number of startups/shutdowns to limit thermal cycling.
RUPTURE AND FIRE IN SYNTHESIS LOOP
There was a localised cracking/rupture which led to fire in ammonia synthesis loop in a spool piece of 1.3-m length of the vertical leg of pipe between two exchangers at the downstream of synthesis converter. As part of the plant upgrade activities, the synthesis loop boiler feed water exchanger of Ammonia Unit II was replaced in February 2012 due to its tube plugging history. The elevation of the inlet nozzle of the new BFW exchanger was higher than the previous one. To accommodate the change in inlet nozzle elevation of the old BFW exchanger, a pipe spool piece of 1.3-m (4-ft) length was inserted into the vertical leg of piping from a new exchanger installed in 1993 plant revamp at the exit of old BFW exchanger.
The fire incident happened due to localised cracking/rupture at the weld joint of this inserted spool piece which was carrying synthesis gas at a temperature of 285°C (545°F) and pressure of 179.5 bar (2603.5 psig). The incident took place on 5th November 2017 at 10:08 am and the fire was controlled within 15 minutes. The plant was operating normally prior to this incident. The fire caused damage to the equipment, pipelines, instrument and electrical cables, insulation etc. in the vicinity, which were assessed and restored. The plant operations were fully normalised by 30th November 2017. Positive material identification (PMI) of the inserted 1.3-m spool piece revealed that low temperature carbon steel A333 Grade 6 (incorrect material of construction for this service) was inserted. Since the existing material was ASTM A335 Grade P22, the 1.3-m spool piece added should also have been of same material. LTCS (A333 Grade 6) is not recommended as per API 941 and discontinued since 1991 for such service as synthesis gas at the operating temperature being handled by pipe.
METHANATOR VESSEL OVERHEATING
Several Yara ammonia plants have recently experienced overheating of their methanator vessels leading to complete catalyst unloading for internal inspection. What went wrong? The four incidents described showed how overheating could occur very quickly when key operational, control and safety measures fail. The causes of each described incident were different; however, the human factor was predominant in all of the four, in particular with respect to the override of the safety instrumented system (SIS) and the management of change of the SIS logics.
Recommendations:
- Ensure that the CO2 removal and methanator trip systems are properly working.
- Verify that the trip thermocouples are correctly located.
- Verify that proper maintenance and inspection routines are correctly executed on trip systems, trip valves, solenoids, relays, thermocouples.
- Verify that the loop testing of trip circuits are properly carried out during turnarounds.
- The override of the safety functions shall not be allowed unless a complete risk assessment is done, and all the required mitigating actions are in place.
- In almost all the cases, one should question if the metal wall temperature of the vessel has gone up at the same temperature of the bulk catalyst. The only way to answer to this interrogation would be to install metal temperature measurements on the vessel which will record the real metal temperature of it. This cannot be considered as an active prevention for the methanator overheating event, but it could eventually reduce the economic impact of it, immediately indicating if the integrity of the vessel was threatened or not by the event itself.
- In case of overheating methanator vessel event, do not restart the plant without having executed a proper integrity assessment of the vessel.
Roundtable session
On the fourth day of the symposium, a roundtable session covered industry incidents, risks of leaks in urea plants, and ammonia and flammable gas leak detection systems.
The 2020 Symposium will take place in Munich, Germany, August 30 to September 2 at the Westin Grand Munich hotel.