Vous êtes sur la page 1sur 74

Chevron

Chevron Nigeria Limited

PREPARED BY ENGINEERING & DESIGN OFFICE

Conversion of TANK 200-03 to Wash Tank Service AFE No: 51232

FINAL REPORT ON THE HAZARD ANALYSIS REVIEW Conducted 28th to 29th April 2003

DOCUMENT NUMBER
WDFL-0472.RP.70.0001

P2 P1 REV

22/05/03 16/05/03 DATE

ISSUED FOR INFORMATION ISSUED FOR COMMENTS DESCRIPTION

OGUN OGUN BY

SFTO SFTO CHK

SFTO SFTO APP

TABLE OF CONTENTS
1.1 LIST OF ATTENDEES............................................................................................................................................. 3 1.2 SUMMARY ................................................................................................................................................................ 4 1.3 DESIGN REVIEW .................................................................................................................................................... 6 2.0 WHAT IF? ANALYSIS WORKSHEETS ............................................................................................................. 10 3.0 SUMMARY CHECKLIST REVIEW AND ANALYSIS (API RP 14J) ............................................................. 22 5.0 ADDITIONAL CONSIDERATIONS AND ACTION PLAN .............................................................................. 64 5.1 DESIGN REVIEW RECOMMENFDATIONS................................................................................................... 65 5.2 WHAT IF RECOMMENFDATIONS................................................................................................................ 67 5.3 CHECKLIST ADDITIONAL RECOMMENFDATIONS ............................................................................... 70 6.0 REFERENCES ........................................................................................................................................................ 73 7.0 RISK RANKING TABLE. ...................................................................................................................................... 73

1.1 LIST OF ATTENDEES


HAZAN meeting dates Monday 28th April Tuesday 29th April
S/N NAME POSITION PHONE LOCATION DAYS OF ATTENDANCE Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon/Tue Mon Mon/Tue Tue Tue Tue Mon/Tue

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Sheyi Tomoye (PHA Leader) Comfort Afella Godson Ajaero Tayo Oluyemi Abiola Laditan Peter UgburoShanomi Paul Grundy John Omabuwa Roland Onovwie Rizu Nwokoma E. Ehioda Nick Ndubuizu Eliot Quinn Ememe Ugochukwu Nav Kandola Suraj Mohammed Yomi Ogunkilede

CNL Process Engineer CNL Project Engineer CNL Process Engineer CNL Process Engineer CNL HES Terminal Engineer/Specialist CNL E& I Engineer CNL Snr. Process Engineer CNL Dehydration Supervisor CNL Terminal Operations Supervisor CNL Terminal Engineer DPR Representative CNL Terminal Engineer NALCO Account Manager CNL Process Engineer ABB Lead Process Engineer NETCO Process Engineer NETCO Instrument Engineer.

Ext. 1834 EDO Ext. 8341 Lekki Ext. 3475 Escravos Ext. 3475 Escravos Ext. 4511 Escravos Ext. 8213 Lekki Ext. 3437 Escravos Ext. 3171 Escravos Ext. 3378 Escravos Ext. 8201 Escravos DPR Warri Ext. 8454 Escravos NALCO 3891 Escravos Ext. 3827 Escravos Ext. 1852 EDO

Ext. 1813 EDO Mon/Tue Ext. 1855 EDO Mon/Tue

1.2 SUMMARY
A facility Hazards Analysis (HAZAN) review was conducted for the conversion of Tank 200-03 to Wash Tank service from April 28th to 29th, 2003. The review group included representatives from Operations, Safety & Environmental, Facilities Engineering and EDO (Design contractor). See the list of attendees on page 3. The intent of this project is to convert Tank 200-03 (ABJ 803) to wash Tank service when Tank 200-01 (ABJ 801) is out of service. The two tanks will also be available for use either as Wash Tank or as Storage Tank. A tank selection button will be used to select which one of the two tanks is used as a Wash tank at a particular time. Tank 200-03 is a fixed roof tank (conical shaped) with storage capacity of 200,000 bbls and operates at atmospheric conditions. The design flow capacity/flow rate under wash tank service is 650,000 barrels fluid per day (BFPD)> Front end and detailed engineering design will cover fabrication and installation of piping, instrumentation and structural items required to convert Tank 200-03 to Wash Tank service. The scope of work includes but not limited to the following:

1.

Installation of a 24 inlet header to come off existing 30 Tank 3 bi-directional oil pipeline and tie-in to the existing 24 inlet Wash Tank header. Installation of a 20 dry oil outlet pipeline, fitting and nozzle and tie-in to the existing 20 Wash Tank dry oil outlet pipeline. Installation of a 30 wet oil outlet pipeline, fitting and nozzle and tie-in in to the existing 30 Wash Tank wet oil outlet pipeline. Installation of a 16 produced water outlet pipeline, fitting and nozzle and tie-in in to the existing 16 Wash Tank produced water outlet pipeline. Installation of an 8 emulsion pad draw-off (internal collector) pipeline at 5 ft of tank height and tied into the 8 bottom treaters transfer pumps inlet pipeline. Installation of all necessary piping fittings and valves on the pipelines. Installation of emergency relief valve on the 24 manholes for protection against excess pressure. Determine the capacity of the bottom treater pumps to handle the emulsion pad whose viscosity is 110centipoise @ 120 0F versus the adequacy of the number of emulsion pad pick up points for the pump.

2.

3.

4.

5.

6. 7.

8.

9.

Fabrication and installation of a new valve access platform with double handrail, in accordance to Chevrons SID manual. Fabrication and installation of extension to the gaugers platform in accordance with Chevrons Safety in Design manual. Fabrication and installation of walkway with grating on the tank roof to link all roof nozzles. Fabrication and installation of 6 rain rail around the top of tank with six (6) 6 down spouts Installation of 3 sch 40 pipes & fitting as bottom water draw off line around perimeter of tank. Installation of 10 gate valve on the 10 section of the discharge line of the produced water transfer pumps for future sand jetting operations. Determine the possibility of using the exhaust or waste heat from the turbines to heat the crude at the inlet of the wash tank. This is to take care of the difficulty encountered in treating crude oil during rainy season as a result of low temperature. Installation of an inlet spreader box and 6 x 16 gas vent lines connecting the roof of the spreader box to the space above the oil so that gas from the crude oil within the spreader box does not go back into the crude oil. The gas vent lines in Tank 1 (Wash Tank) are not sufficient for effective gas venting. The dip hatch should be installed away from the sump area. Installation of 16 OD x 100 long dry oil internal collector pipe located at 22.6 ft. of tank height. Installation of 24 OD x 120 long wet oil internal collector pipe located at 10 ft. of tank height. Installation of 12 OD x 60 long free water internal collector pipe located at 1.5 ft. of tank height. Installation of instrumentation and controls for the Wash Tank (as exists in Tank 1) and tie in to the existing dehydration control room. Determine the capacity of the control hardware/software to accommodate the added control requirements. All other piping supports and all other civil works necessary to complete the conversion of Tank 200-03 to a Wash Tank.

10.

11.

12.

13.

14.

15.

16.

17. 18.

19.

20.

21.

22.

1.3 DESIGN REVIEW


Section: General P&ID: All Project P& IDs P&ID Title:

1.

2.

Issue Raised Tank 3 was to be converted to wash tank service with flexibility to be used as storage tank later. Is this considered? Installation of the 8-inch emulsion pad take-off should be through an inlet spreader located between 4 & 5ft height.

By Roland Onovwie

Status Addressed in the front end design. Detail design to continue with this concept One connection presently now in tank 1. 4 nos. connection provided in the new design with an internal spreader. Detailed review to be carried out later. Based on request by Operations. Intent is to relieve pressure when tank is operated beyond the atmospheric pressure. Detail review to be carried out later. To be reviewed during detail design phase. Not in full. Review to be carried out in detail design to determine what has been covered. No provision made. Design team to consider this. No provision made. Design team to consider this. From the turbine. PE to discuss this issue with operations. Design team can look into this if required. Yes. To be covered during detail design Located at 22ft Separate document to be produced by design team to address safety system No Design team to consider

By Nav Kandola

Roland Onovwie

Nav Kandola

3.

Why the emergency relief valve (PVSV) on the 24 inch manhole?

Rizu Nwokoma

Nav Kandola

4. 5.

6. 7. 8.

Why steel pads are required (design review item 11)? Have we combined tank repair work with the wash tank conversion project (item 12, 13 & 14)? Is provision made to determine sand build-up in the new wash tank?. Is there a way to clean the wash tank while in service? Where is waste heat recovery from?

Roland Onovwie Tayo Oluyemi Rizu Nwokoma Godson Ajaero Rizu Nwokoma Tayo Oluyemi Roland Onovwie Peter U. Shanomi Peter U. Shanomi John Omabuwa Godson Ajaero

Nav Kandola Nav Kandola Nav Kandola Nav Kandola Godson/ Nav Nav Kandola Nav Kandola Nav Kandola Nav Kandola Nav Kandola Sheyi Tomoye 6

9 10 11.

For item 19 to 21, internal collector pipes not stated as to be provided Is dry oil internal collector pipe located at 10ft? Is control and safety Instrumentation system separated? Are there new pumps other than the pneumatic sump? Is design team considering adding sampling points close to the wash tank? 8-inch emulsion pad draw off from tank 1 not provided presently

12. 13.

14

PE to review and advise design team

15

Can the two tanks be operated together as Wash tank?

Peter U. Shanomi

16

17

18

19

Relief line from main header to tank 1. Is provision made to tie-in tank 3 to the same relief line? Why is the water line maintained at 4ft level? Believe water draw-off should be designed to operate both at 4ft. and 5ft.? Is it possible to have two points for the Agar probe and be able to switch b/w the two? Why Four (4) different tie-in points? Why is the tie in points not between 4 ft and 5ft level? Installation of steel pads 4x4x1/4 plate beneath the roof support columns (38) in all. Does roof support apply to only floating roof and therefore not required in the scope of this project.

Roland Onovwie Sheyi Tomoye

The two tanks can not be operated together as wash tank. Selectors switch to be provided to select which tank to be used as wash at any particular time. Yes. Provision already made for this. To be noted and considered by Operations and design team

Godson Ajaero/ Tayo Oluyemi Nav Kandola Godson Ajaero

Godson Ajaero Roland Onovwie Roland Onovwie Godson Ajaero

Nozzle can be provided at two points as desired. Design team to review tie-in points with Escravos operations and Process group See comment under item 19 Design team to confirm with Obioma Isiuwa

Nav Kandola Nav Kandola Nav Kandola Sheyi Tomoye?

20 21`

Design Review Section: Wash Tank #3 Design Tie-Ins P&ID: 55-041.TNK.PI.10-3003 P&ID Title: Wash Tank ABJ-803
1. What is the function of AT 803B? Is it to check oil/water interface? Godson Ajaero Meant to be low level alarm for dry oil. Actually a redundant alarm. Design team to review AT 803B function with ESC process & Operations group See 1. above Sheyi Tomoye/ Nav

2.

3.

4.

Pg.8 of Control & Operating Philosophy. Why is AT 803B tied to water transfer pump? Spectacle blind was installed on lines 1455, 1454 to enable use of tanks for storage service.The other lines should also have spectacle blinds for positive isolation as this is a DPR requirement if the tank is to be used for storage. Are we having Pressure alarm/monitor on tank top LSL 803A not clouded as new Instrument

Godson Ajaero Tayo Oluyemi

Tayo Oluyemi Godson Ajaero

Dry oil outlets, water outlets have need for spec blind (i.e. all lines common to storage and wash tank purpose). Spec blind required to be added on all lines by design team to prevent co-mingling. Yes. With remote indication

5.

Instrument will be clouded

Roland Onovwie Tayo Oluyemi/ Sheyi Tomoye Yomi Ogunkile de Nav Kandola 7

Design Review Section: P&ID: Wash Tank #1 Interface with Wash Tank #3 55-041.DHY.PI.10-2001 55-041.SMP.PI.10-0191 55-041.TNK.PI.10-3003 P&ID Title: Wash Tank ABJ-801 Wash Tank Sump & Sump Pump Wash Tank ABJ-803

1. 2.

3.

4.

5. 6. 7.

Issue Raised Why is 24inch line not tie-in further down the line? Are we installing corrosion coupon on any of the lines? Design team should consider this. Lines from sample turndish is a 1 line in the new design whereas it is a 2 in the existing Do we have temperature indicator on the inlet/outlet lines? Are they desirable? Consider notes to indicate valves in the bottom lines as NC Spectacle blind in the inlet line to Tank 3 should be clouded Is LTI 803B (Internal Hanging Fisher Level Gauge) required? Is there provision for sampling points to monitor SRB growth to check whether growth is from the tank or brought in from the field? What type of lightning protection is provided? LIT 200B in the existing tank 1 compared to corresponding instrument in tank 3 is not specific on the instrument elevation. Also LSL Electrical earthing on tanks to be confirmed. Is there going to be as-built drawings to show the nozzles?

By Peter U. Shanomi Tayo Oluyemi Peter U. Shanomi Rizu Nwokoma Rizu Nwokoma Peter U. Shanomi Peter U. Shanomi Paul Grundy

Answered Shut down time required determined the tie-in point. No. Design team to explore.

By Godson Ajaero Nav Kandola Nav Kandola Nav Kandola Nav Kandola Nav Kandola Sheyi Tomoye Sheyi Tomoye

Design team to check and consolidate with the existing No. Design team to include.

Design team to include. Design team to implement Design team to investigate and review with Operations/Process group Design team to investigate and review with Operations/Process group Separate team presently working on provision of lightning protective device for all tanks Design team to check/review as required

8.

9.

G. Ehioda Peter U. Shanomi

Peter U. Shanomi Nav Kandola

10.

11. 12.

G. Ehioda Rizu Nwokoma

Electrical earthing on tank 3 typical as for other tanks As-built drawing to be produced at the end of project.

Peter U. Shanomi Nav Kandola/ Sheyi Tomoye

Design Review Section: P&ID: Wash Tank Sump / Sump Pump PBH 803 55-041.SMP.PI.10-0191 55-041.TNK.PI.10-3003 P&ID Title: Wash Tank ABJ-801 Wash Tank ABJ-803

1. 2. 3. 4. 5. 6. 7. 8. 9. 10.

Issue Raised No question raised

By

Answered

By

2.0 WHAT IF? ANALYSIS WORKSHEETS

( Risk Ranking Table in Appendix 5.0)

10

Clarification Notes

The project P & IDs were divided into 16 sections for the purpose of the What If analysis. 11 Nos. P&IDs were fully analyzed and risk ranking assigned to possible hazardous occurrences. The remaining P&IDs were not reviewed because they did not impact the project scope of work. They were included as part of the project P& ID to provide complete view of the facilities associated with the Wash Tank service. The section descriptions of the P& IDs fully reviewed during the What If analysis are: Description Wash Tank ABJ-803 Wash Tank ABJ-801Instrument and Utility Air Header Wash Tank Sump (ABH-803)/Sump Pump (PBH 803) Dehydration- Wash Tank Dry Oil Pumps KTI Charge Pumps Incoming Pipelines & Receivers/Pipeline Receivers From Offshore Export Area Instrument Air System/ Instrument Air Distribution System Tank Bottoms Transfer Pumps Coalescer #1 & #2 Wet Oil Charge Pumps Coalescer #3&#4 Wet Oil Charge Pumps P&ID No. 55-041.TNK,PI.10-3003 55-041.DHY,PI.10-2001 55-041.SMP.PI.10-0191 55-041.DHY.PI.10-2002 55-041.DHY.PI.10-2102 55-041.PPL.PI.10-1003 55-041.PPL.PI.10-1003 55-041.IAS.P1.10-9604 55-041.TNK.PI.10-3011 55-041.DHY.PI.10-2003 55-041.TNK,PI.10-2010

11

Location: Escravos P&ID No.: 55-041.TNK.PI.10-3003

P&ID Title: Wash Tank ABJ-803

Study Date: P&ID Revision Date: 03/02/03

Section Description: Wash Tank Designs Tie-Ins Design Intention: Wash Tank ABJ-803 Piping & Instrumentation POTENTIAL WHAT IF ..... ? CONSEQUENCES

EXISTING SYSTEMS & PROCEDURES (SAFEGUARDS)

ADDITIONAL CONSIDERATIONS

1.

LSL 803C Fails

Pumps may deliver gas with oil Pumps may run dry Damage to pump

Pressure monitoring (Pressure transmitter) to open recycle valve Operating procedure / Operations surveillance High Pressure alarm Operating procedure Operators Surveillance

2.

VG-60 on line 1455 left open

Treated Oil deliver to Wash Tank from any of the storage tanks False production figures Upset in Wash Tank operation

Spectacle blind to be provided LOTO provision

3.

VG-60 on line 1042 fail close (Internal mechanism drop to close valve)

Pressure build up in the line Platform shutdown Back pressure offshore Possibility of line rupture Spill / Pollution

HC Drain vessel has PSH-352 (production shut-in), PAH-352, PSV-352, TSE Operating procedures LOTO procedures

Consider installing a RO or a globe valve downstream of the ball valves Project Team

12

4.

Offshore sends excess gas

5.

6.

Isolation valve on all outlet lines faulty (Maintenance) AT 803 (Agar Probe) faulty

Wash Tank upset Breaking of other storage tanks seals Damage to inlet spreader box Excess gas release to atmosphere Tank out of service

12 nos. vent & flame arrestors PSVs 2 nos. relief hatches on 24 Manways Operating Procedure Preventive Maintenance LSL/LAL 803A SOP (Sampling intervals)

Convert PSVs to PVSVs Communication between Platform and Offshore

Maintenance access will be provided by design team (Detail design)

High water level in the tank] Oil to water treatment facilities Wash Tank profile upset Inefficient treating None

7. 8. 9.

Internal gas vent collapses Excess crude into Wash Tank Failure of one or more of PSVs

6 nos. vent

4 4

4 4 4

5 5 5

Preventive Maintenance checks 12 nos, PSVs provided Bund wall Tanks coated Fire fighting equipment Tanks spacing Bund wall Fire fighting equipment SOP

10.

Leakage in the tank or pipeline

Spill / Pollution Fire

11.

Fire on tank 3 or adjacent tank

Production shutdown Equipment damage Impact on crude storage Injuries to personnel Upset in Wash Tank

Operating procedure should address.

12.

Tanks sump filled up with sand

Preventive maintenance SOP

13

13.

Presence of H2S in the tank

Injuries to personnel Tank damage due to corrosion No well test

SOP Biocide Monitoring

Use of monitoring Instrument On-line monitors to be provided Design team to review Control Philosophy

14.

15.

16.

LTI 803A fails LSL 8093/803B LIT /LIC 803 PSVs have no upstream valve for annual calibration purpose LSH 803 fails

Liquid overflow Pollution Gas release to atmosphere Tank collapse Wash Tank upset Excess gas release to atmosphere Off Spec Oil Not applicable

LIC 803, LAH 803, etc SOP SOP

Design team to review Control Philosophy

17.

PAH/L 803 fails to alarm

18.

Inlet spreader box gives way

None

19. 20.

Oil carry over (from draw off line) into the trench LIT 803 gives false reading

N/A Design team to review Control philosophy Need to develop SAFE chart Design team to review Instrument function with Escravos Operation & Process group Design team to review Control philosophy Need to develop SAFE chart Design team to review Instrument function with Escravos Operation & Process group

21.

LAH 803 fails to alarm

14

22.

Tanks hit by lightning

Vent fire

Flame arrestors Fire fighting equipment SOP None

DPR Regulation PE to check DPR requirement and recommend Design team to provide ladder rung as access for sampling

23.

One or more sample points blocked No water wash from tank

No sample at blocked points Wash Tank upset Excess gas release to atmosphere Off Spec Oil None

24.

None

25.

One or more flame arrestors blocked

Preventive Maintenance checks 12 nos, arrestors provided Preventive Maintenance SOP Biocide Monitoring Bund wall Tanks coated Fire fighting equipment

26.

27.

No maintenance access for PSVs, flame arrestors on tank top Hazardous gas release to atmosphere (i.e. H2S)

Tank out of service

28.

High pressure or leak on the inlet/outlet lines

Injuries to personnel Tank damage due to corrosion No well test Spill / Pollution Fire

Maintenance access will be provided by design team (Detail design) Use of monitoring Instrument On-line monitors to be provided Spill / Pollution Fire

S = Severity

L = Likelihood

R = Risk

15

Location: Escravos P&ID No.: 55-041.DHY.PI.10-2001 55-041.SMP.PI.10-0191 55-041.TNK.PI.10-3003

P&ID Title: Wash Tank ABJ-801 Wash Tank Sump (ABH 803)/Sump Pump (PBH 803) Wash Tank ABJ-8003

Study Date: P&ID Revision Date: 03/02/03

Section Description: Wash Tank #1 Interface Tie-In with Wash Tank #3 Design Intention: Wash Tank #1 Interface with Wash Tank #3 Piping & Instrumentation EXISTING SYSTEMS & PROCEDURES POTENTIAL (SAFEGUARDS) WHAT IF ..... ? CONSEQUENCES

ADDITIONAL CONSIDERATIONS

29

FT 200A does not work

No flow reading

Ultrasonic flow meter Tank gauging reading Spectacle blind SOP

30.

VG-60 on line 1405 left open

Crude flow to both tanks Shipping off spec oil plus unaccounted oil to storage tanks High level in Wash Tank

31.

High pressure from relief line (AT 1461) Rupture disc or line open

SOP

32

Relief line opens to both tanks

Shipping off spec oil plus unaccounted oil to storage tanks Not applicable Not applicable

None

Integrate rupture disc monitoring to EDMAC Incorporate CSO/CSC when switching between two wash tanks to SOP Provide spectacle blind on CSC/CSO Revise SOP

33 34.

Back flow on line 1456 Line 1456 leakage due to rupture L = Likelihood

S = Severity

R = Risk 16

Location: Escravos P&ID No.: 55-041.SMP.10-0191 55-041.TNK.PI.10-3003

P&ID Title: Wash Tank ABJ-801 Wash Tank aABJ-803

Study Date: P&ID Revision Date: 03/02/03

Section Description: Wash Tank Sump/ Sump Pump (PBH 803) Design Intention: Wash Tank Water Transfer Pump Piping & Instrumentation EXISTING SYSTEMS & PROCEDURES POTENTIAL (SAFEGUARDS) WHAT IF ..... ? CONSEQUENCES

ADDITIONAL CONSIDERATIONS

35

LSH 803 fails

Liquid overflow Pollution Fire

SOP Bund wall

Design team to automate pit sump & pump Revise existing P&ID to reflect automated sump pit & pump

36 37

LSL 803G fails Pump PBH 803 fails to start

Pump sucks air Liquid overflow Pollution Fire Liquid overflow Pollution Fire Liquid overflow Pollution Fire

LAL 803G SOP Bund wall

4 4

3 3

5 5

38

Instrument air not available

SOP Bund wall

39.

Sample point left open in error

SOP Bund wall

Design team to automate pit sump & pump Revise existing P&ID to reflect automated sump pit & pump

40.

VG-60 on line 1462 left closed

Line over pressure Pump Diaphragm rupture Liquid overflow Pollution

SOP Bund wall

17

41

Fire around the sump

Not applicable

Wellhead PSH (dual if SITP>MAWP) Operating procedures TSEs & SDVs on wellhead PAH/PSH 212, PSV 212

42

Flame arrestor blocked

Not applicable

Design team to tag flame arrestor.

S = Severity

L = Likelihood

R = Risk

Location: Escravos P&ID No.: 55-041.DHY.PI.10-2021 55-041.TNK.PI.10-3003

P&ID Title: Wash Tank ABJ-801 Wash Tank ABJ-8003

Study Date: P&ID Revision Date: 03/02/03

Section Description: Produced water Transfer System Design Intention: Produced Water Transfer System Piping & Instrumentation EXISTING SYSTEMS & PROCEDURES POTENTIAL (SAFEGUARDS) WHAT IF ..... ? CONSEQUENCES 45 PBA 567 A/b fails to start

ADDITIONAL CONSIDERATIONS

43 44

VG-60 (2 nos.) are left open in error LSL 803/B fails

None Pump continues to run Oil to water treatment facilities Pollution High water level Oil to water treatment facilities Pollution

None LSL 803A 3 4 5 Design team to check instrument tags Check Control Philosophy for the existing tank

SOP Preventive maintenance check 100% Redundancy

18

46

PBA 567 A/b fails to stop

Low water level Oil to water treatment facilities Damage to pump

LAH SOP Preventive maintenance check

S = Severity

L = Likelihood

R = Risk

Location: Escravos P&ID No.: 55-041.DHY.PI.10-0102 55-041.TNK.PI.10-3003

P&ID Title: Dehydration wash tank Dry Oil Pumps Wash Tank ABJ-803

Study Date: P&ID Revision Date: 03/02/03

Section Description: Dry Oil Transfer System Design Intention: Dry Oil Transfer System Piping & Instrumentation POTENTIAL WHAT IF ..... ? CONSEQUENCES

EXISTING SYSTEMS & PROCEDURES (SAFEGUARDS)

ADDITIONAL CONSIDERATIONS

47 48 49

Isolation valve on line 1408 (VG-60) not closed FCV 800 fails open FT 800 reading not correct

None Design team to confirm failure mode Design team to review Control philosophy with Escravos Operations & process group Operating procedure should address new pump system Operations Review pump logic Project team See comment in item 1

Incorrect production figure

50

LCV 800 fails to close

Off spec oil

Operations Surveillance Preventive maintenance check

51

LSL 803C fails L = Likelihood

R = Risk

S = Severity

19

Location: Escravos P&ID No.: 55-041.DHY.PI.10-2102 55-041.TNK.PI.10-3003 55-041.DHY.PI.10-2003 55-041.TNK.PI.10-2010

P&ID Title: KTI Charge Pumps Wash Tank ABJ-803 Coalescer#1 &2 Wet Oil Charge Pumps Coalescer#1 &2 Wet Oil Charge Pumps

Study Date: P&ID Revision Date: 03/02/03

Section Description: Wet Oil Transfer System Design Intention: Wet Oil Transfer System Piping & Instrumentation POTENTIAL WHAT IF ..... ? CONSEQUENCES

EXISTING SYSTEMS & PROCEDURES (SAFEGUARDS)

ADDITIONAL CONSIDERATIONS

52

8 valve connecting line 1453 and 1454 open L = Likelihood

Emulsion pad flows to wet oil R = Risk

SOP Operations Surveillance

S = Severity

Location: Escravos P&ID No.: 55-041.DHY.PI.10-1003 55-041.TNK.PI.10-0191

P&ID Title: Incoming Pipelines and Receivers/Pipeline Receivers from Offshore

Study Date: P&ID Revision Date: 03/02/03

Section Description: 16 Relief Line to Wash Tank Inlet Design Intention: 16 Relief line Piping & Instrumentation POTENTIAL WHAT IF ..... ? CONSEQUENCES

EXISTING SYSTEMS & PROCEDURES (SAFEGUARDS)

ADDITIONAL CONSIDERATIONS

53

Same as items 29-42

S = Severity

L = Likelihood

R = Risk

20

Location: Escravos P&ID No.: 55-041.IAS.PI.10-9604 55-041.TNK.PI.10-3003

P&ID Title: Export Area Instrument Air system / Instrument Air Distribution Wash Tank ABJ-803

Study Date: P&ID Revision Date: 03/02/03

Section Description: Instrument Air Design Intention: Instrument Air Piping & Instrumentation POTENTIAL WHAT IF ..... ? CONSEQUENCES

EXISTING SYSTEMS & PROCEDURES (SAFEGUARDS)

ADDITIONAL CONSIDERATIONS

54

No Issue raised

S = Severity

L = Likelihood

R = Risk

Location: Escravos P&ID No.: 55-041.TNK.PI.10-3003 55-041.TNK.PI.10-3011

P&ID Title: Wash Tank ABJ-803 Tank Bottoms Transfer Pumps

Study Date: P&ID Revision Date: 03/02/03

Section Description: Bottoms Tank Transfer Design Intention: Oil Manifold /Tank Bottoms Transfer Pumps Piping & Instrumentation EXISTING SYSTEMS & PROCEDURES POTENTIAL (SAFEGUARDS) WHAT IF ..... ? CONSEQUENCES . 55 No Issue raised

ADDITIONAL CONSIDERATIONS

S = Severity

L = Likelihood

R = Risk

21

3.0 SUMMARY CHECKLIST REVIEW AND ANALYSIS (API RP 14J)

22

Process Hazards Analysis Checklist: Plant Layout/Siting


Checklist Type: FILENAME:
Chklist/Rev. Date:

Research and Technology

General SITEUNIT.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#:

Prepared by:

Checklist Questions Do plant setbacks and equipment spacing comply with company, industry, or insurance requirements? Can equipment be accessed for maintenance without the need for conducting heavy crane lifts over pipeways or other in-service equipment? Is the secondary containment or drainage for storage vessels containing incompatible materials segregated to prevent adverse reactions if spills occur? Is the unit sufficiently isolated from adjacent unit(s) (e.g., by berms, drainage channels, etc.) to minimize impact if a loss of containment occurs in the adjacent unit? Have site-specific hazards such as earthquake, hurricane, lightning, and flood been evaluated? Are horizontal LPG storage vessels oriented with their ends directed away from occupied buildings and critical equipment? Is rotating machinery (i.e., pumps and compressors) located such that a seal fire will have minimal impact on adjacent or overhead equipment? Is equipment that is located adjacent to roads or other access ways adequately protected from damage due to vehicle impact? Are the egress routes (number and path) adequate to safely evacuate the unit in the event of emergency? Has the potential for simultaneously blocking all egress routes been evaluated (e.g., train crossing, main access road closed due to maintenance, etc.)? Is emergency vehicle access to the unit adequate? Is motor vehicle access to the unit adequately controlled [review installation of signs and road barriers]? Is site security sufficient to prevent unauthorized access to the unit? If applicable, are tall structures equipped with aircraft warning lights? Are electrical power supply lines for the unit routed to minimize the potential for power loss to the unit due to a fire at other units? Are redundant instrument or power cables adequately separated to prevent a single incident (e.g., fire, supporting pole failure, etc.) from resulting in failure of both cables (i.e., common cause failures)?

Y/N/NA N/A N N/A Y

Reference/Comments

Should be addressed at detail design

Y N/A N/A Y N Should be addressed at detail design

Y Y N N/A N/A N/A Site security team to address

23

Has all buried equipment (e.g., process lines, fire water lines, electrical conduit, and sewers) been identified on drawings and by aboveground markers as appropriate? Are atmospheric vents for flammable or toxic material routed to a safe location (i.e., away from personnel and ignition sources)? Does all equipment and instrumentation comply with the electrical area classification? Has equipment that is routinely operated been placed for ready access by the average size operator? Has equipment that must be operated in short time sequence (such as valve switching) been located to facilitate operator actions [i.e., minimum separation]? Is plant surface drainage sufficient to handle maximum expected runoff, including fire water runoff? Have the possible explosion, fire, and toxic material impacts to nearby occupied or critical buildings been evaluated?

To be addressed at detail design

Y Y N N/A To be addressed at detail design

Y Y

24

Process Hazards Analysis Checklist: Storage Tanks


Checklist Type: FILENAME:
Chklist/Rev. Date:

Research and Technology

Process Equipment TANKS.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#:

Prepared by:

Checklist Questions DESIGN: Is the storage tank material appropriate for the fluid properties, including maximum contaminant concentration? Is the storage tank secondary containment area of adequate size and design to hold the contents of the largest tank in the event of a tank leak or failure? Is the area around the storage tank graded to prevent pooling of product [concern for fire] or water [concern for external corrosion] at the base of the tank? Is the storage tank equipped with an appropriate water draw system capable of removing expected quantities of water, both during normal operation and when placing the tank into service? [Note: Some facilities must put the tank roof onfloat with water before introducing hydrocarbon.] Are water draw systems adequately protected against freezing? Is the storage tank adequately grounded? Has the interaction between cathodic protection systems for the tank and connected pipelines been evaluated? TANK APPURTENANCES: Is the storage tank roof (including roof seal design) compatible with the materials to be stored? If the storage tank gagewell is to be used for tank sampling, is the gagewell slotted? Does storage tank gaging/sampling equipment provide protection against vapor release/personnel exposure [concern is for personnel exposure to H2S or inert blanketing or release of flammable vapors]? For storage tanks with floating roofs, are vacuum breakers installed to prevent roof or tank damage when emptying the tank (with the roof on set on its supports)? Are the storage tank overpressure vents/vacuum breakers sized for maximum fill/emptying rates? Are floating swing lines properly ballasted for the density of the material to be stored in the tank? Are mechanical seals on tank mixers compatible with the material stored in the tank?

Y/N/NA

Reference/Comments

Y Y N To be addressed by separate project group, HES to follow up

Y Y

Y Y N SOP to address

N/A Y N/A NA

25

Does the tank mixer motor meet the electrical classification requirements of the storage tank area? PROCESS UPSETS: Has a stock leak through the tank floor been evaluated [consider the requirements for internal coating of tank floor or secondary containment with external drains under the tank floor]? Has a failure of the storage tank roof drain (i.e., leak in internal swing line or roof drain hose) been evaluated ? If the storage tank is equipped with a steam heater or bottom coils, has a heater or coil failure been evaluated [consider potential for tank damage due to possible boilover or rapid expansion in the tank]? Has loss of steam (or other heating medium) to the storage tank been evaluated? Has increased temperature (may be due to loss of product cooling or process upset) of the stock to the storage tank been evaluated [determine if upset may result in exceeding flash point of stock]? Has high vapor pressure stock to the storage tank been evaluated [may occur during startup or shutdown or be caused by upset at the upstream unit(s)]? Has loss of level in an upstream pressure vessel been evaluated? Has water carryover or contamination from the storage tank to downstream process units or outside customers been evaluated? [Note: Leaking swing line joints are a common cause for water carryover from tankage.] Has a hazardous material entering a tank that normally contains a benign material been evaluated (e.g., hydrocarbon into a water tank or sour stock into a sweet tank)? FACILITY SITING: Is adequate fire water coverage available at or near the storage tank? Is there sufficient access and an adequate staging area for fire-fighting equipment near the storage tank? Does the spacing between the storage tank and other tanks or equipment conform with applicable fire codes and local jurisdictional codes, regulations, and practices? Does the storage tanks fixed fire protection system provide sufficient water to cool the involved tank and the affected surfaces of surrounding tanks? Is the storage tanks foam system compatible with the tank design and type of stock or material stored? For storage tanks containing oxygenate blend stocks or other polar materials, is the available foam appropriate for use in the event of fire (alcohol-resistant foam required)? Are foam injection valves located outside the storage tank secondary containment area? [Note: Foam injection valves located inside the secondary containment area should be locked open when tank is in-service.] Does the storage tanks containment area grading plan consider the need to collect and remove rainwater? Has site-specific hazards such as earthquake, hurricane, lightning, and floods been evaluated? HUMAN FACTORS: Are tank suction and fill lines and valves clearly labeled, including flow direction?

N/A

N/A N/A

N/A N/A

N/A Y Y

N/A

Y N N/A N/A Other project group addressing this

Y Y

Detail design to address

26

Is the lighting adequate in the unit [consider valve manifold locations and valves requiring operation during emergency conditions, etc.]? Is the emergency lighting (light fixtures on the emergency power circuit) adequate in the unit? Are all operating valves accessible during normal or emergency operation? Are manually operated valves positioned to allow proper operation without muscle strain? Is access adequate at all valve manifolds (including battery or plot limit) for both routine and emergency operation and for maintenance? [Review requirements for changing battery or plot limit blinds.] Are drain valves located to allow personnel to monitor levels while draining? Have storage tank valve manifolds been arranged to reduce the likelihood of mismanifolding? Has valve mis-manifolding been evaluated [consider complex suction, fill, or water draw manifolds]? PROCEDURES: Do storage tank startup procedures specify a maximum fill rate until the tank liquid level covers the fill piping? [Note: possible static electricity concern] Do procedures specify the safe-fill level of the storage tank? [Note: The tank safefill level may be influenced by site-specific seismic hazards.] Do procedures specify storage tank minimum level? [Note: possible concern for floating roof tanks] Are pressure vents/vacuum breakers routinely inspected? Do procedures specify water removal (water draw) method and frequency? Is the accuracy of the automatic tank gaging systems checked routinely? Do procedures specify method and frequency for draining storage tank roofs (applies to floating roof tanks)? Do procedures prevent compromising secondary containment areas by leaving rainwater drain valves open? Do procedures specify how to either reroute or rerun off-specification product? Do procedures specify the method and frequency for sampling storage tank contents?

Y Y N Detail design to address

N/A N Detail design to address

N N N Y N/A N/A N/A N/A N/A N/A

SOP to address SOP to address SOP to address

27

Research and Technology

Process Hazards Analysis Checklist: Pumps


Checklist Type: FILENAME:
Chklist/Rev. Date:

Process Equipment PUMP.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#:

Prepared by:

Checklist Questions DESIGN: Is the pump casing design pressure greater than the maximum pump suction pressure plus the pump shutoff pressure [consider largest impeller when determining maximum pump differential]? Is the downstream piping or equipment design pressure greater than the maximum pump discharge pressure [consider largest impeller when determining maximum pump differential], or is the downstream piping or equipment protected from overpressure in the event that the pump is blocked in? If a downstream blockage would raise the pump suction pressure, is the downstream piping and equipment rated for the maximum suction pressure plus the pump shutoff pressure? If a downstream blockage would not raise pump suction pressure, is the downstream piping and equipment rated for the greater of (1) normal suction pressure plus the pump shutoff pressure or (2) maximum suction pressure plus normal pump differential pressure? Has a discharge relief valve been provided for positive displacement pumps? Is the pump adequately protected from damage when operating at low flow rates [determine if minimum flow protection is required]? Is the pump design temperature greater than the maximum operating temperature? Is the pump material selection appropriate for the expected fluid properties, including maximum contaminant concentration?

Y/N/NA

Reference/Comments

N/A

N/A

N/A

N/A

N/A

N/A N/A

PUMP AUXILIARIES, INCLUDING MECHANICAL SEAL OR PACKING: Is the selected mechanical seal or packing appropriate for the intended service, including maximum contaminant concentration? Has mechanical seal or packing failure been evaluated? N/A N/A

28

Has failure of pump heat removal equipment (e.g., lube oil coolers, gland oil coolers, stuffing box coolers, seal flush coolers, and seal flush) been evaluated [consider loss of circulation or supply and plugging of coolers]? Are pump "run" indicators (running lights or other process indicators) provided at a continuously staffed location for critical service pumps? PROCESS UPSETS: Has the pump stopping been evaluated? Has blocking in the pump been evaluated? Has loss of suction to the pump been evaluated? Has reverse flow through the pump, when it shuts down, been evaluated [assume the discharge check valve sticks open]? If the pump is provided with minimum flow protection, have failures of the minimum flow system been evaluated [consider minimum flow valve (control or manual) closed and wide open]? Has the pump stopping and the minimum flow recycle control valve open (trying to maintain minimum flow) been evaluated? For manual minimum flow recycle systems (manual valve or restriction orifice), has the pump stopping been evaluated? For parallel pump arrangements (one pump operating and an idle spare pump on standby), has leakage through the spare pump's discharge check valve been evaluated [concern is for overpressuring the spare pump suction valve and piping]? Has operation with higher specific gravity fluid, due to process upset or startup/shutdown, been evaluated [consider whether or not the pump driver is adequately sized for water if the pump will be required to transfer or circulate water during startup or shutdown]? FACILITY SITING: Is adequate fire water coverage available for the pump area? Is there adequate emergency access to the pump? Can the pump be safely isolated in an emergency? If emergency isolation valves (either manual, automatic, or remotely operated) are provided to isolate the pump, are these valves appropriate for the process service and valve location [review requirements for fire-rating of isolation valves; fail-safe position of isolation valves; and fireproofing of valve actuator, power cables, and instrument cables of the isolation valves]? If emergency isolation valves are provided, has failure of the isolation valves been evaluated [consider valves closing and valves failing to close when demanded]? For installations where critical service equipment (e.g., air-cooled heat exchangers or power/instrument cables) is located above a pump handling flammable material, is the critical equipment adequately protected in the event of fire at the pump [review requirements for fireproofing and installation of fixed water or fixed steam deluge]? If fixed water or fixed steam deluge is provided, can the valve or station that actuates the system be operated safely in the event of fire at or near the pump [consider location of valve/station or the ability to operate valve/station remotely]?

N/A

N/A

N/A N/A N/A N/A N/A

N/A N/A N/A

N/A

N/A N/A N/A N/A

N/A N/A

N/A

29

Have flexible piping components (e.g., hoses, expansion joints, and tubing) been reduced or eliminated where possible? If flexible piping components are installed, are they designed for maximum operating pressure and temperature? Are flexible connections adequately protected against possible rupture due to mechanical impact and fire? Have leaks (at mechanical seal, flanges, etc.) to the atmosphere been evaluated for pumps located in buildings or shelters [concern is for buildup of explosive atmosphere with possible fire or explosion]? For pump installations using an engine driver (gas or diesel driven) are the air intake and exhaust lines vented to a safe location? Can critical service pumps be quickly shut down from a safe location? PROCEDURES: If emergency isolation valves (either manual, automatic, or remotely operated) are provided, are procedures in place for the routine testing of these valves? For critical service pumps, are preventative maintenance procedures in place to reduce the likelihood of equipment failures that could result in hydrocarbon or toxic material releases? For pump installations with auxiliary systems (e.g., lube oil, seal oil, vibration, etc.), are alarms and shutdowns routinely tested?

N/A

N/A

N/A N/A

N/A N/A

N/A

30

Research and Technology

Process Hazards Analysis Checklist: Instrumentation


Checklist Type: FILENAME:
Chklist/Rev. Date:

Process Equipment INSTRUMT.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#:

Prepared by:

Checklist Questions DESIGN: Is the instrument specification suitable for the expected fluid properties, including maximum contaminant concentration? Is the instrument design pressure greater than the maximum operating pressure of the process system to which it is connected? Is the instrument design temperature greater than the maximum operating temperature of the process system to which it is connected? Is the instrument installation designed to allow on-line testing and calibration of the instrument? Are critical safety shutdown systems designed and installed to ensure reliability of the shutdown system [consider requirements for redundancy of components, independence from process control system, and ability to test system to ensure reliability]? Are critical safety shutdown systems designed to fail-safe? Does the design require operator action to reset the shutdown system (e.g., manual reset of isolation valves) after the shutdown system is actuated to prevent unsafe conditions due to system response when the shutdown trip condition clears? Are instrument installations that result in moment arm arrangements (multiple or heavy valves branching from the pipe) adequately designed (e.g., supported or reinforced, such as bridge welding) to prevent failure of welded connections due to vibration or mechanical impact? Are emergency shutdown switches guarded against inadvertent operation [consider location, switch operation, and guards or covers]? Are all critical service alarms routed to a continuously staffed location?

Y/N/NA

Reference/Comments

Y Y Y Y N Detail design to address

N/A

N/A Y

31

Are redundant instrument or power cables physically separated [i.e., separated to prevent a single incident, such as fire or mechanical impact, from resulting in failure of both cables]? Are instrument sensing lines adequately purged or heat traced to prevent plugging? For plugging services, does the design allow for safely unplugging the instrument on-line? Are utility instruments adequately heat traced and insulated or designed to prevent cold weather freezing and plugging? Are control valves or emergency isolation valves designed to close under maximum differential pressure process conditions? For services where the piping specification changes to a lower design rating after the control valve, is the downstream piping specification suitable for upset situations with the control valve wide open? Are the instruments suitable for the electrical area classification? PROCESS UPSETS: Has the control valve failing wide open been evaluated? Has the control valve failing closed been evaluated? Has the control valve leaking been evaluated? Has the control valve bypass left open or leaking been evaluated? For plugging or fouling services, has plugging of the flow orifice or other primary flow element been evaluated? Has operation with higher or lower specific gravity fluid (may be due to process upset or startup/shutdown) been evaluated? Has loss of power to the process unit been evaluated [determine if the process unit is designed fail-safe]? Has loss of power, including partial loss of power and total loss of power, to the process control system been evaluated? Has loss of instrument air to the process unit been evaluated [determine if the process unit is designed fail-safe]? Has inadvertent operation of the safety shutdown system been evaluated? FACILITY SITING: If emergency isolation valves (either manual, automatic, or remotely operated) are provided, are these valves appropriate for the process service and valve location [review requirements for fire-rating of isolation valves; fail-safe position of isolation valves; and fireproofing of valve actuator, power cables, and instrument cables of the isolation valves]? If emergency isolation valves are provided, has failure of the isolation valves been evaluated [consider valves closing and valves failing to close when demanded]? Are critical safety shutdown systems adequately protected in the event of fire? [Determine if the safety shutdown systems primary elements or sensors, the power and instrument cables, and the final elements such as emergency isolation block valves or equipment shutdown interlocks are adequately fireproofed, fail-safe, and/or located in a nonhazardous area.] Are the control building air conditioning and pressurization adequate to protect the electronic instrumentation? Are they adequate to prevent intrusion of toxics, flammables, or corrosive contaminants (if applicable)?

N/A

N/A N/A N/A

N/A N/A N/A N/A N/A Y Y Y Y Y

N/A

N/A N/A

N/A

32

Are control valves and associated instrumentation accessible for maintenance? HUMAN FACTORS: Can critical valves or equipment be closed or shut off from a safe location? Is the lighting adequate in the unit [consider local instrument panels, battery or plot limit valve manifold locations, equipment and valves requiring operation during emergency conditions, etc.]? Is the emergency lighting (light fixtures on the emergency power circuit) adequate in the unit? Are all instrument labels easy to read (clear and in good condition)? Are all instrument labels correct and unambiguous? Are all instrument labels located close to the items that they identify? Do all instrument labels use standard terminology (e.g., acronyms, abbreviations, equipment tags, etc.)? Are the instrument labels consistent with nomenclature used in procedures? Are all components that are mentioned in procedures (e.g., valves) labeled or otherwise identified? Do switch labels identify discrete positions (e.g., ON or OFF, OPEN or CLOSE)? Are the field instruments that are routinely monitored by operations personnel easily accessible to ensure information is read in accordance with recommended frequency [consider instruments or areas that are difficult to reach, such as climbing 40 feet of ladder or squeezing into close quarters]? Are the engineering units of similar instruments consistent [e.g., do the pump seal flush rotameters all display flow in either gpm or gph]? Are field instrument indicators routinely checked for accuracy? Are field instrument ranges appropriate for the service [e.g., avoid using a 0-2500 psig pressure gage on a 100 psig system]? Are operating ranges for process variables specified in the same engineering units as the instrument read-out or indicator (i.e., mental conversion of units is avoided)? Are calculations performed by operations personnel documented in a consistent manner and periodically checked for correctness? Does the process control system console layout allow for rapid response to upset situations? If required, does the process control system console layout allow for response by multiple personnel? Do the process control system displays adequately present the process information [consider the logical layout of process or equipment configuration information, consistent presentation of information, visibility of information from various work positions, and the logical linking of information between displays]? Do the process control system displays for similar equipment (e.g., parallel trains or similar equipment in series) present the information in a unique manner to avoid confusion? Do the process control system displays provide feedback to operations personnel to confirm operator actions? Does the feedback provide operators with logical information (e.g., is 100% valve output equivalent to valve wide open)? Are critical alarms prioritized to alert operations personnel to upset situations that require immediate response? Is the cause of "nuisance" alarms (repetitive alarms that operations personnel ignore or acknowledge without investigating) investigated and repaired in a timely manner?

N/A

Y Y

N N N N

Detail design to address Detail design to address Detail design to address Detail design to address

N N N

Detail design to address Detail design to address Detail design to address

Y N N N/A N/A Y SOP to include Detail design to address

Detail design to address

Y Y

33

Are equipment "run" indicators (running lights or other process indicators) and valve position indicators provided at a continuously staffed location for critical equipment, valves, and instruments? Are the communications facilities between process units adequate for clear and uninterrupted communications during both normal and emergency situations [e.g., telephone land lines, radio, computer network, and E-mail, and are systems redundant and/or secure]? Is the control room lighting adequate [review direct and indirect lighting]? Is the control room emergency lighting (light fixtures on the emergency power circuit) adequate? PROCEDURES: Do procedures prevent changing alarm set points without proper review and authorization? Are alarm changes (set point or priority) communicated to all affected employees? Do procedures prevent changing process control system or safety shutdown system control or logic (software) without proper review and authorization? Are process control system or safety shutdown system changes communicated to all affected employees? Do operating procedures document the alarm set points? Do the procedures specify the expected operator response to the alarm? Do the procedures specify the potential consequences if the alarm set points are exceeded (i.e., consequences of deviation)? Do operating crews communicate unusual instrument status (bypassed or out of service) in writing? Are operating crews provided with written temporary operating procedures when instruments are bypassed or out of service? Do procedures require verification that instruments that are deliberately disabled during operation (e.g., shutdown interlocks bypassed to allow testing) are placed back in service? Do procedures require control valve bypasses to remain closed during normal operation [possible concern for loss of level during upset conditions if the bypass around an LCV is open]? Do procedures specify proper response to alarm indicators (e.g., lights, horns, or whistles) during emergency situations? Are hypothetical emergency situation drills periodically performed? Are the alarm indicators routinely tested? Do procedures require routine testing of critical alarms and safety shutdown systems, including primary elements or sensors, shutdown system control and logic, and final elements such as emergency isolation valves or equipment shutdown interlocks [determine the need for on-line testing of safety shutdown systems]? Do procedures specify response to potential process control system failures [consider loss of input or output signal(s), loss of display screens (loss of view), loss of memory devices, loss of equipment or system interfaces (gateways), loss of power, loss of backup power, loss of control program, etc.]? Do procedures require physical isolation of power source(s) prior to release of equipment for maintenance work (i.e., lockout/tagout)?

N/A

34

Research and Technology

Process Hazards Analysis Checklist: Piping and Valves


Checklist Type: FILENAME:
Chklist/Rev. Date:

Process Equipment PIPING.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#:

Prepared by:

Checklist Questions DESIGN: Is the piping specification suitable for the fluid properties, including maximum contaminant concentration? Is the piping specification suitable for potential stresscorrosion cracking, hydrogen blistering, or other metallurgical concerns, as applicable? Are the piping system fabrication requirements [e.g., post weld heat treatment (PWHT), stress relieving, and nondestructive examination (NDE)] appropriate for the intended service [consider process upsets including contaminant carryover]? Is the piping design pressure greater than the maximum operating pressure [consider maximum pump or compressor discharge pressure]? Is the piping design temperature greater than the maximum operating temperature [consider loss of cooling, cooler bypassed, exothermic reaction, etc.]? Is the piping system adequately designed for thermal growth at maximum temperature [consider superheated steam, loss of cooling, cooler bypassed, steamout, etc.]? For flashing liquids, is the piping specification suitable to prevent brittle fracture [consider large pressure drop situations such as venting or draining, etc]? Is the piping system adequately guided and supported? Is the piping system adequately designed for cyclical conditions (e.g., pressure, temperature, and vibration)?

Y/N/NA

Reference/Comments

Detail design to address all piping and valves items

35

Are valve installations that result in moment arm arrangements (multiple or heavy valves branching from the pipe) adequately designed (e.g., supported or reinforced, such as bridge welding) to prevent failure of welded connections due to vibration or mechanical impact? Are piping dead legs eliminated? Is the piping system adequately designed to minimize the effects of internal corrosion or erosion [consider carryover or increased concentration of corrosive material due to process upset, accumulation of corrosive material in valve seats or drains, increased erosion or corrosion due to velocity, injection of chemicals such as anti-foulants]? Is the piping system adequately designed to minimize the effects of external corrosion [consider underground installations, insulation on cold piping, exposure to corrosive atmosphere such as salt water or cooling tower drift, upsets resulting in release of corrosive materials, etc.]? Is the piping system adequately designed for cold weather conditions? Where applicable, are freeze protection and/or heat tracing design adequate? Is the piping system adequately designed for hot weather conditions? Does the piping system allow for flushing and/or purging of lines and equipment for startup or shutdown? Are process piping connections to utility systems adequately designed and installed to prevent contamination of the utility system [review requirements for check valves, double block and bleeds, removable spools, flexible connections, and blinds]? Is the piping system adequately designed for thermal expansion of trapped process material? Is the discharge of the thermal relief device routed to a safe location? Do the repairs to the piping (materials and methods) comply with the applicable industry codes and company guidelines? PROCESS UPSETS: Have cold weather conditions been evaluated [consider water freezing in low points or in dead-end lines, materials that increase in density, etc.]? Have hot weather conditions been evaluated [thermal overpressure of blocked-in lines or equipment, etc.]? Have plugged lines or valves been evaluated? Has rapid closing of automatic valves or check valves been evaluated [determine whether or not hydraulic hammer may occur if a valve closes suddenly; for example, check valve on the discharge of cooling water supply pump when pump shuts off]? Has a valve not opening [may be due to plugging, stem failure, or valve seizing] when demanded been evaluated? Has a bypass valve (either equipment or control valves) left open or leaking been evaluated? FACILITY SITING: Is adequate fire water coverage available near the piping system (e.g., battery or plot limit manifolds and other valve manifolds)? Is there adequate access to the piping system in the event of fire or other emergency [consider battery or plot limit manifolds and other valve manifolds that contain hazardous materials]? Y N Detail design to address all piping and valves items Y Y Y Y

Y N/A

36

If the piping system contains a large inventory of hazardous material (e.g., off-plot transfer or feed lines), can the piping system be isolated in an emergency? If emergency isolation valves (either manual, automatic, or remotely operated) are provided, are these valves appropriate for the process service and valve location [review requirements for fire-rating of isolation valves; fail-safe position of isolation valves; and fireproofing of valve actuator, power cables, and instrument cables of the isolation valves]? If emergency isolation valves are provided, has failure of the isolation valves been evaluated [consider valves closing and valves failing to close when demanded]? Has flange leak been evaluated [consider leaks that may result in flame impingement on nearby piping or equipment, hydrocarbon release resulting in fire, and chemical exposure to operators]? Are the drains and vents located to minimize the potential for damage due to mechanical impact? Have flexible piping components (e.g., hoses, expansion joints, and tubing) been reduced or eliminated where possible? If flexible piping components are installed, are they designed for maximum operating pressure and temperature? Are flexible connections adequately protected against possible rupture due to mechanical impact and fire? HUMAN FACTORS: Are battery or plot limit lines/valve labels easy to read (clear and in good condition)? Is the lighting adequate in the unit [consider local instrument panels, battery or plot limit valve manifold locations, equipment and valves requiring operation during emergency conditions, etc.]? Is the emergency lighting (light fixtures on the emergency power circuit) adequate in the unit? Are all operating valves accessible during normal or emergency operation? Are manually operated valves positioned to allow proper operation without muscle strain? Is access adequate at all valve manifolds (including battery or plot limit) for both routine and emergency operation and for maintenance? [Review requirements for changing battery or plot limit blinds.] Are elevated valves accessible during normal or emergency operation (i.e., access provided by ladders/platform or chain operator)? Are valve chain operators properly maintained? Can critical valves or equipment be closed or shut off from a safe location in a timely manner? Has equipment that must be operated in short time sequence (such as valve switching) been located to facilitate operator actions [i.e., minimum separation]? Have valve manifolds been arranged to reduce the likelihood of mis-manifolding? Has valve mis-manifolding been evaluated? PROCEDURES: Do procedures require that all drain and vent valves are either plugged, capped, or blinded? Do procedures specify which blinds are to be removed and which spectacle blinds are to be turned prior to or during startup? Detail design to address all piping and valves items Detail design to address all piping and valves items

37

Do procedures require routine testing of emergency isolation valves [determine the need for on-line testing of safety shutdown systems]? Do procedures control the position of critical valves (e.g., locked or car sealed open valves beneath relief valves, equipment bypasses or isolation, and area containment drains)? Are piping systems inspected at an appropriate interval (depending upon service and history) to confirm fitness for continued service? Do procedures require new gaskets (and bolts if needed) to be installed when a flange closure is opened or broken? Do the procedures provide guidance on the proper gasket material for the process service? Do procedures require tightness-testing of all flange bolts prior to startup [concern is for flanges that were opened during shutdown or flange bolts that may have loosened due to thermal expansion and contraction]? Do the procedures provide guidance to prevent over- or under-tightening flange bolts? Do procedures specify the proper settings for pipe spring hanger supports? Do the procedures require checking the pipe spring hanger settings prior to each startup and during normal operation? Are maintenance personnel trained in the use of piping specifications? Is a process in place to verify the latest piping specification is used? For piping modifications and repairs, do procedures require verification that the repair material to be installed meets the requirements of the piping specification? Is a program in place for routine testing and inspection of pressure relief devices? Is documentation maintained regarding the test plan and results for each relief device [i.e., last test date, results from last test, next test date, etc.]? Is a program in place for routine testing of flexible piping components (e.g., hoses, expansion joints, and tubing)? Are a representative number of new and refurbished valves inspected for the proper valve packing material upon receipt from the vendor or contract shop? Do operating crews communicate unusual equipment or instrument status (bypassed or out of service) in writing? Are operating crews provided with written temporary operating procedures when equipment or instruments are bypassed or out of service? Are the hazards associated with drawing samples communicated to the personnel responsible for taking the samples and performing the sample analysis? Does the sampling procedure provide warnings and cautions about the hazards associated with drawing, transporting, and performing sample analysis? Does the sampling procedure specify the personnel protective equipment (PPE) to be worn when drawing or handling the sample? Is the minimum pressurizing temperature (MPT) of the piping systems documented and communicated to operations and maintenance personnel?

38

Research and Technology

Process Hazards Analysis Checklist: Static Electricity


Checklist Type: FILENAME:
Chklist/Rev. Date:

Facility Static.DOC August 21, 1998


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#: Checklist Questions TRAINING & COMMUNICATION Y/N/NA Reference/Comments

Prepared by:

Have personnel been alerted to the static hazards associated with the use of plastic buckets and other insulated containers? Have personnel involved with vacuum truck operations been trained in static electricity hazards and prevention methods? Have personnel involved in tank and vessel cleaning activities been trained in static hazards and prevention methods? Have personnel involved in the loading/offloading of static accumulating liquids been trained in how to recognize static electricity hazards and precautions?

Y Y Y Y

TANK TRUCK & RAIL CAR LOADING OF STATIC ACCUMULATORS For products handled at temperatures < (flash point - 15F) N/A

Diesel, lube oils and similar high flash products are often static accumulators, but do not present a high risk of static ignition unless there is a flammable mixture of air/vapor present. Switch loading is when a high flash product is loaded into a rail car or tank truck after a previous load of an intermediate or high vapor pressure product. In this case, there can be a flammable mixture of vapor and air present and hence static ignition is a concern. Do procedures include precautions to prevent switch loading? (e.g. checking the tank truck or rail car for HC gas prior to loading)
If switch loading and/or splash loading may occur, the following questions for products handled at temperatures >flash point apply. For products handled at temperatures > (flash point - 15F) 39

1.

Are tank trucks and rail cars routinely inspected for internal spark promoters? (chains, markers and probes that do not extend to the bottom of the compartment) Is the loading rack designed and operated to ensure a relaxation time of at least 30 seconds downstream of the filter? Are flow rates limited to the velocity recommended in API RP 2003?

N/A

2. 3.

N/A N/A

1 m/sec until the outlet is submerged, then the velocity (m/sec) is limited to .5/d where d is the inside diameter of the downspout (m) 4. 5. 6. 7. 8. 9. Is flow indication available so operators can check initial flow rates? Do procedures require waiting at least 1 minute before the loaded tank is gauged or sampled? Are bottom loaded cars & trucks routinely inspected for splash deflectors? Are top-loading fill pipes fitted with telescoping downspouts? For top loading, is the rack equipped with appropriate bonding or grounding cables? (Bottom loading is inherently bonded) Do top loading procedures require use of a bonding cable and extending the downspout to the bottom of the car or truck? N/A N/A N/A N/A N/A N/A

MARINE LOADING OF STATIC ACCUMULATORS Do the procedures require inerting cargo tanks before and during loading of static accumulating products? (when an inert system exists) For loading into a non-inerted barge or ship - (if receiving tanks are inerted, the following precautions are not required) 1. Have appropriate initial flow rates been established for loading products per ISGOTT Chapter 7? Initial linear velocity of flow in each tank branch pipe must not exceed 1m/sec, until the bottom structure is covered and all splashing has ceased Is flow indication available so operators can check initial flow rates? Do the procedures consider initial flow rates into multiple compartments simultaneously vs. flow rate at dock valve? Where a filter is installed in the shore pipeline, do the procedures require that the loading rate be adjusted to ensure at least 30 seconds relaxation time between the filter and the time it enters any cargo tank? Do the procedures require waiting 30 minutes after loading before dipping, ullaging or gauging? (unless a sounding pipe is used) Do the procedures prohibit the use of synthetic tapes or ropes in non-inerted barge or ship tanks? Do the procedures include bonding all metal tapes/gaging devices before introduction into the barge or ship tank? FIXED ROOF TANKS FILLING & GAUGING PROCEDURES FOR STATIC ACCUMULATORS For liquids handled at temperatures > (flash point - 15F): 1. 2. Do tank filling procedures specify a maximum fill rate until the tank liquid level covers the fill piping? Is inlet piping designed to prevent splash filling? N Y SOP to address N/A N/A

2. 3. 4.

N/A N/A N/A

5. 6. 7.

N/A N/A N/A

40

3.

Are gage wells installed in the tank? If no gage well is installed, do the procedures require waiting 30 minutes after filling before gauging or sampling the tank? Do the procedures prohibit the use of synthetic tapes or ropes in tank gauging? Do the procedures include bonding all metal tapes/gaging devices before introduction into the tank?

4. 5.

Y N/A

HYDROCARBON TANK & VESSEL CLEANING Do the procedures discuss the potential for static hazards during cleaning operations? Do the procedures require continuous HC gas monitoring? Do the procedures require bonding the wash or steaming hoses to the wall or manway? Do the procedures require that all hoses are checked to ensure that insulated metal fittings are eliminated or bonded and grounded? Do the procedures require that all ungrounded conductors be removed from the tank or vessel during cleaning? VACUUM TRUCKS Do the procedures caution against vacuuming hydrocarbons from plastic containers? Do the procedures include a discussion of the potential for static ignition due to vacuum and discharge operations? Do the procedures recommend gravity discharge whenever possible? Are the truck hoses in good condition, with no broken sections or broken grounding wires? Are all exposed metal hose fittings bonded to the truck through a bonding wire? Are hoses conductive (<1 megohm resistance)? Is the testing and inspection program for hoses adequate? Are hoses routinely inspected (externally) for scrapes, kinks, or other damage? N/A N/A N/A N/A N/A N/A N/A Y Y N Y Y

41

Research and Technology

Process Hazards Analysis Checklist: Materials


Checklist Type: FILENAME:
Chklist/Rev. Date:

General MATERIAL.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#: Checklist Questions DESIGN: Y/N/NA Reference/Comments

Prepared by:

Have carbon and alloy steel materials in sour water service been reviewed for hardness and their susceptibility to wet H2S cracking? [Note: NACE Standard MR-01-75 provides guidelines on material selection for sour services, including maximum hardness limits to prevent sour water cracking.] Have materials for piping and equipment in hydrogen service been selected or reviewed for adequate resistance to hydrogen attack in accordance with American Petroleum Institute (API) Publication 941 (i.e., reviewed using API Publication 941 "Nelson Curves")? [Note: Low molybdenum content carbon-moly alloy materials are susceptible to hydrogen attack.] Have all carbon steel vessels, other major equipment, and piping, in amine or caustic service operating above ambient temperature, been stress-relieved? [Note: Typical operating temperatures where stress-relieving is required are: 100 F for amine equipment, 120 F for caustic equipment, and 140 F for steel piping in amine or caustic service.] Have these equipment and piping services been inspected for amine or caustic stress-corrosion cracking? Is the heat tracing for carbon steel piping in amine or caustic service designed to prevent overheating and stress-corrosion cracking?

N/A

Detail design to address all materials, piping and valves items

N/A

42

Have equipment and piping in locations subject to cold weather (i.e., 20 F or less) been reviewed per API RP-920 for resistance to cold temperature brittle fracture? Have storage tanks been similarly reviewed per API RP-650? Have critical equipment items (e.g., thick-walled vessels and piping) been assigned a Minimum Pressurization Temperature (MPT) or Minimum Design Metal Temperature (MDMT), and have these limits been incorporated into the operating and maintenance procedures? Has the possibility of auto-refrigeration been evaluated for LPG and other low boiling point liquid services [concern is for cold temperature brittle fracture], and the material selection of piping and relief devices specified accordingly? Are carbon steel air coolers and air cooler outlet piping in hydrotreater reactor effluent service designed for fluid velocities of 20 feet/second or less to prevent erosion/corrosion from ammonium sulfides? Has increased metal temperature in heat exchangers and downstream piping, due to heat exchanger fouling, been considered in material selection of the exchanger and piping? Has increased temperature of downstream piping and equipment, due to bypassing heat exchangers, been considered in material selection? Has increased temperature of downstream piping and equipment, due to loss of cooling in heat exchangers (e.g., loss of cooling water, loss of air cooler fans, etc.), been considered in material selection? Is the maximum fluid velocity of rich and lean MEA or DEA, and concentrated sulfuric acid, limited in carbon steel service? [Concern is for excessive corrosion/erosion due to high fluid velocities; MEA/DEA is typically limited to 6 feet/second, and concentrated sulfuric acid is typically limited to 3 feet/second.] Has all carbon steel or monel piping and equipment in HF acid service been stressrelieved after welding? Have high-pressure hydrotreater reactors and other heavy-wall vessels and piping constructed of 2-1/4 chrome material and operating between 700 F and 1050 F been reviewed for potential temper embrittlement failure? If such failure is possible, do the operating and maintenance procedures explain the design limitation of the material [e.g., do not fully pressure the system when the metal temperature is below the alloy's maximum possible ductile-to-brittle transition temperature range, such as 300 F]? Has the material selection for auxiliary lube oil and seal oil systems considered the effects of ambient moisture intrusion, during normal and shutdown operation? [Concern is for corrosion due to water, with possible damage to mechanical seals, etc. due to corrosion products.] PROCESS UPSETS: For heaters, furnaces or boilers, designed to burn fuel containing sulfur compounds, has the possibility of acid condensation during low temperature flue gas operation been evaluated? [Concern is for corrosion of heater ducts, stacks, fans, and waste heat recovery heat exchangers due to condensed combustion products.] Has chloride stress-corrosion cracking of austenitic stainless steel piping and equipment been evaluated? [Concern is for exposure to high chloride content water, e.g., brackish fire water, water-soaked insulation containing chlorides, coastal hurricane tides, etc.] Has ammonia stress-corrosion cracking of copper-based alloys been evaluated? Detail design to address all materials, piping and valves items

43

HUMAN FACTORS: Are special materials of construction identified on process flow diagrams (PFD), piping and instrument diagrams (P&IDs), operating procedures, or other PSI documentation? Is this information kept current via the MOC process? PROCEDURES: Do procedures specify hydrotesting austenitic stainless steel equipment and piping systems with water containing less than 50 ppm chloride? [Concern is for chloride stress corrosion cracking.] Do procedures require that austenitic stainless steel equipment and piping in sour or H2S services (i.e., exposed to sulfides) be blanketed with dry inert gas when shut down, or flushed with soda ash, KOH, or ammonia neutralizing solution, before opening for inspection and maintenance? [Concern is for ambient moisture contacting sulfide scale on the surface of austenitic stainless steel, with the potential for polythionic acid stress corrosion cracking of the stainless materials.] Do procedures specify thorough water flushing of carbon steel equipment and piping in amine or caustic service before steaming out to prevent amine or caustic stress-corrosion cracking? Do inspection procedures for 1 chrome and 1-1/4 chrome equipment and piping operating above 800 F include monitoring for creep embrittlement cracking (i.e., hydrogen service, high-pressure steam, etc.)? Do warehouse procedures require testing of alloy materials for proper alloy content when received at the facility site (i.e., positive materials identification [PMI] program)? Are received materials accompanied by proper documentation (i.e., mill certificates, chemical test reports, ANSI or ASME specification, etc.)? Are materials segregated and clearly identified when stored, to reduce the possibility of incorrect material installation? Are materials stored such that they are protected from ambient conditions as necessary [i.e., austenitic stainless steel materials protected from chloride salts at seacoast locations, etc.]? Are there procedures to order, receive, document, and issue materials for ASME Code vessel or piping repairs or modifications? Do procedures specify ASME Code welder qualifications and testing? Do construction procedures specify that all equipment, piping, instruments, and structural steel are painted (or otherwise protected) to prevent external corrosion? Are the painted surfaces inspected and maintained [especially under insulation when process temperatures are below 180 - 200 F]? Are a representative number of new and refurbished valves inspected for the proper valve packing material upon receipt from the vendor or contract shop? Detail design to address all materials, piping and valves items

44

Process Hazards Analysis Checklist: Maintenance


Checklist Type: FILENAME:
Chklist/Rev. Date:

Research and Technology

General MAINT.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#: Checklist Questions DESIGN: Y/N/NA Reference/Comments

Prepared by:

Has piping and equipment been designed and installed to allow depressurization, draining, and isolation prior to maintenance work? Has access to equipment for maintenance been evaluated [review crane position and lifts; removal of heat exchanger tube bundles, vessel internals, and rotating equipment elements; location of monitoring equipment; laydown of tools and materials; etc.]? If required, are connections for in-place chemical cleaning or neutralization of equipment or piping provided? Does the piping design prevent connection of air tools to other process gas systems (e.g., nitrogen or natural gas), such as special connections to the utility air header? Are equipment and piping that are not designed for field hydrotesting clearly identified (e.g., relief headers, large overhead vapor lines, refractory lined equipment and piping, expansion bellows, etc.)? Are analyzer buildings or enclosures properly ventilated to prevent buildup of flammable or toxic materials? Alternatively, are flammable or toxic material detectors provided inside the building to alert personnel of possible danger prior to entering? Do the detectors alarm to a continuously staffed location as well as locally, outside the building? PROCEDURES and TRAINING: Are there written maintenance procedures for all routine or contemplated maintenance activities? Are the procedures appropriate for the complexity of the job task [i.e., are generic procedures used for routine or simple tasks and job specific procedures used for nonroutine or complex tasks]? Are written maintenance procedures developed for nonroutine maintenance activities prior to commencing the work? Have all personnel involved in maintaining the integrity of process equipment (including contract personnel) received appropriate training? Does the training include an overview of the process, the hazards associated with the process, and review of all generic or specific procedures applicable to the employee's job tasks?

Y Y

N/A N N/A

N/A

Y Y

45

Is the work permit system understood by all affected employees, maintenance (including contractors), operations, and engineering? Does the work permit clearly explain the approvals and communication required prior to commencing a maintenance activity? Does the work permit system require physical inspection of the job site by maintenance and operations personnel prior to commencing work [concern is for working on the wrong line or equipment, opening equipment that is still under pressure or contains toxic material, verification of the correct personnel protective equipment (PPE) required for the job task, etc.]? Do procedures require physical isolation of power source(s) prior to release of equipment for maintenance work (i.e., lockout/tagout)? Do the repairs to the piping or equipment (materials and methods) comply with the applicable industry codes and company guidelines? Do field hydrotest procedures include guidance regarding special requirements [e.g., minimum pressurizing temperature for heavy-wall vessels and piping, lowchloride test water for 18-8 stainless steel, adequate vents for large-diameter or thin-wall equipment to prevent collapse from external pressure, etc.]? For maintenance activities where pressure relief devices are isolated or removed, is backup relief protection provided? Do procedures require physical inspection of completed maintenance work by operations personnel before "sign-off" of the work or job order? Do procedures require new gaskets (and bolts if needed) to be installed when a flange closure is opened or broken? Do the procedures provide guidance on the proper gasket material for the process service? Do procedures require tightness-testing of all flange bolts prior to startup [concern is for flanges that were opened during shutdown or flange bolts that may have loosened due to thermal expansion and contraction]? Do the procedures provide guidance to prevent over- or under-tightening flange bolts? Do procedures specify the proper settings for pipe spring hanger supports? Do the procedures require checking the pipe spring hanger settings prior to each startup and during normal operation? Are maintenance personnel trained in the use of piping specifications? Is a process in place to verify the latest piping specification is used? For piping modifications and repairs, do procedures require verification that the repair material to be installed meets the requirements of the piping specification? Is the piping system's minimum pressurizing temperature (MPT) documented and communicated to? Do procedures require that 18-8 stainless steel equipment and piping in sour or H2S services (i.e., exposed to sulfides) be blanketed with dry inert gas when shut down, or flushed with soda ash, KOH, or ammonia neutralizing solution, before opening for inspection and maintenance? [Concern is for ambient moisture contacting sulfide scale on the surface of 18-8 stainless steel, with the potential for polythionic acid stress corrosion cracking of the stainless.] Do procedures for loading and unloading catalyst (i.e., reactors, driers, columns, etc.) include information regarding the hazards of the catalyst and identify the PPE required when handling either fresh or spent catalyst? Have all maintenance personnel (including contractors) been trained in the purpose and use of the facility management of change (MOC) procedure? Do all maintenance personnel understand the MOC definition of "replacement-in-kind"?

Y Y

N/A

Y Y N/A N/A

46

Do procedures require appropriate approval and supervision of crane use [concern is for lifts over equipment that contain toxic or hazardous materials, over power lines, over critical equipment, etc.]? Are lifts reviewed by a rigging specialist before they are performed? Do procedures require appropriate inspections and approvals prior to performing hot taps? Do procedures specify appropriate methods for temporary leak repair (e.g., type of clamp, material, etc.)? Do the procedures include administrative controls that require a permanent repair be made at the earliest opportunity (i.e., next shutdown)? Do procedures prevent changing alarm set points without proper review and authorization? Are alarm changes (set point or priority) communicated to all affected employees? Do procedures prevent changing process control system or safety shutdown system control or logic (software) without proper review and authorization? Are process control system or safety shutdown system changes communicated to all affected employees? Do procedures require routine testing of critical alarms and safety shutdown systems, including primary elements or sensors, shutdown system control and logic, and final elements such as emergency isolation valves or equipment shutdown interlocks [determine the need for on-line testing of safety shutdown systems]? Do procedures require verification that instruments that are deliberately disabled during operation (e.g., shutdown interlocks bypassed to allow testing) are placed back in service? Do procedures prohibit the use of pipe wrench extensions ("persuaders") on small or special valves in hazardous service [e.g., small piping valves, screwed bonnet valves, orbit valves, twin-seal valves, etc.]? QUALITY ASSURANCE: Do warehouse procedures include verification that materials received are in accordance with the purchase specification? Are special materials of construction identified on process flow diagrams (PFD), piping and instrument diagrams (P&IDs), operating procedures, or other PSI documentation? Is this information kept current via the MOC process? Do procedures require testing of alloy materials for proper alloy content when received at the facility site (i.e., positive materials identification [PMI] program)? Are received materials accompanied by proper documentation (i.e., mill certificates, chemical test reports, ANSI or ASME specification, etc.)? Are materials segregated and clearly identified when stored, to reduce the possibility of incorrect material installation? Are alloy materials stored such that they are protected from ambient conditions as necessary [i.e., 18-8 stainless steel materials protected from chloride salts at seacoast locations, etc.]? Are there procedures to order, receive, document, and issue materials for ASME Code vessel or piping repairs or modifications? Do procedures specify ASME Code welder qualifications and testing? Are a representative number of new and refurbished valves inspected for the proper valve packing material upon receipt from the vendor or contract shop? Is a program in place for routine monitoring of critical rotating equipment for excessive vibration?

N/A

Y Y

Y Y

N/A

Y N/A

Y N/A

47

Is a program in place for routine monitoring of lube or seal oil quality at critical rotating equipment [e.g., monitor for metal fragments, oil degradation, contaminants, etc.]? Is a program in place for routine testing of critical turbine overspeed trip devices? Is a program in place for routine testing and inspection of pressure relief devices? Is documentation maintained regarding the test plan and results for each relief device [i.e., last test date, results from last test, next test date, etc.]? Is a program in place for routine testing of flexible piping components (e.g., hoses, expansion joints, and tubing)? Is sufficient PPE available at all times [review the needs for normal operating, shutdown operation, and emergency response situations]? Is a cleaning and testing program in place to ensure PPE is fit for use? Are locations where clean and used PPE properly segregated and labeled? Is a program in place to periodically inspect and test cranes and equipment (i.e., lifting slings) used for lifts? Is a program in place to ensure routine testing and maintenance of critical steam traps? HUMAN FACTORS: Is all equipment labeled and clearly identified (e.g., tag number, unit number, module number, etc.)? For equipment that must be maintained while the process unit is "on-line," is safe access and egress provided for maintenance personnel (e.g., access platforms, heat shielding for elevated air coolers, furnace draft fans and soot blowers, furnace stack sampling systems and analyzers, etc.)? For maintenance activities where bulky PPE is required, has emergency access and egress been evaluated?

N/A

N/A Y

N Y Y Y N/A

Y Y

48

Process Hazards Analysis Checklist: Relief Systems


Checklist Type: FILENAME:
Chklist/Rev. Date:

Research and Technology

General RELIEF.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#: Checklist Questions DESIGN: Y/N/NA Reference/Comments

Prepared by:

If applicable, are relief systems, relieving devices, and flares designed in accordance with the latest versions of American Petroleum Institute (API) Recommended Practices (RP) 520 and 521? [Note: API RP-520 was revised in 1990, changing the relief valve sizing equations.] Has the relief system design capacity been verified, if necessary, for all unit modifications, expansions, and debottlenecking projects? Are relief system calculations current and available for review? If rupture disks are installed under relief valves, does the relief valve sizing consider flow restriction (i.e., derate) caused by the rupture disk? Have the relief valve inlet and outlet branch connections been properly reinforced to prevent vibration failure due to the relief valve opening [severe vibration may occur when relieving from a high pressure system, or in high- capacity relief valves]? Are the inlets and outlets of all relief valves free-draining to prevent trapping liquid? Are all relief headers free-draining to the relief collection or knock out (KO) drum? Are relief header block valves installed to prevent blockage in case of an internal valve component failure [e.g., are gate valves in relief headers installed with the stem in the horizontal plane to prevent dropping the gate if the valve stem fails by cracking or corrosion]? Are drains from flare stack molecular or other vapor-phase gas seals left open and designed to be free-draining to prevent accumulation of liquids that could plug the seal and flare stack? Are the drain lines from vapor or liquid seals winterized to prevent freezing? Does the sizing of the drain line consider the possibility of plugging due to corrosion products? Is each ASME Pressure Vessel or Boiler Code vessel protected by a Codeapproved relief device? Are the relief headers designed to accommodate the maximum piping expansion anticipated for the highest temperature relief condition? Are the relief headers provided with continuous fuel gas or natural gas purge to ensure that oxygen cannot accumulate or be drawn into the system? [Concern is for an explosive mixture forming in the relief system.]

N/A

N/A N/A

N/A

N/A

N/A

N/A N/A N/A

49

Is the relief system adequately designed to minimize the effects of internal corrosion or erosion [consider venting or relief of sulfur compounds, chloride or fluoride compounds, caustic, amine, etc., with the potential for corrosion, stresscorrosion cracking, and other materials problems]? If the relief system handles heavy oils (residuum, vacuum bottoms, etc.), are branches and headers designed to prevent plugging [e.g., heat tracing, heated "gut" line, flush oil, heating coils at the KO drum, etc.]? Have flexible piping components (e.g., expansion joints and bellows) been reduced or eliminated where possible? If flexible piping components are installed, are they designed for maximum relief pressure and temperature? Are flexible connections located to minimize damage and possible rupture due to mechanical impact or fire? Are flexible connections designed to minimize collection of liquids and corrosion products in the bellows or piping run? Is relief header sizing based on the maximum relieving capacity of each relief valve? [Selecting the next largest orifice size may significantly increase the relief valve capacity over the minimum required by the process, possibly impacting the relief system design capacity.] Has the possibility of auto-refrigeration been evaluated for LPG and other low boiling point liquid services [concern is for cold temperature brittle fracture], and the material selection of piping and relief devices specified accordingly? PROCESS UPSETS: Have cold weather conditions been evaluated [consider water freezing in relief header low points or in dead-end lines, materials that increase in density, etc.]? Are flare combustion controls, including pilot burner flame front generators, provided with a reliable, uninterruptable source of electric power? [In a general power failure, the flare may be required to remain in operation to safely dispose of flammable materials.] Has rapid closing of relief valves been evaluated [determine whether or not hydraulic hammer may occur if a relief valve closes suddenly, for example, if a high-pressure liquid relief valve on the discharge of a pump slams shut after opening]? Has rapid closing of automatic valves or check valves been evaluated [determine whether or not hydraulic hammer may occur if a valve closes suddenly; for example, check valve on the discharge of cooling water supply pump when pump shuts off]? Has the need for redundant relief valves been evaluated [e.g., dirty or fouling services requiring frequent testing and inspection of relief valves, critical services where failure of relief valves to reseat may result in significant production loss, etc.]? FACILITY SITING: Have credible worst-case releases of hazardous materials from extinguished flares, atmospheric process or tank vents, or from relief valves that exhaust to the atmosphere been evaluated [concern is for ground-level concentrations of toxic or flammable materials]?

N/A

N/A

N/A

N/A

N/A

N/A N/A

N/A

50

Has the maximum heat release from the flare during credible worst-case relief scenarios been evaluated with respect to ground-level personnel, nearby tankage and equipment, and traffic on adjacent roads? [Depending upon the location and height of the flare stack, concern is for significant flare tip heat releases that may endanger operating or maintenance personnel in the area, or that may cause overheating of flammable materials stored nearby. When maximum relief cases are redefined during the lifetime of the facility, the potential risk to nearby personnel and equipment should be evaluated based on the maximum heat that may be released from the flare stack.] Is there adequate emergency access to the flare stack and adjacent equipment in the event of fire [consider burning liquids from flare tip, igniting grass around base of stack]? HUMAN FACTORS: Are relief system and flare alarms and instrument readings displayed at a continuously staffed location? Is lighting at the relief drum and flare stack control stations adequate? Are all flare and relief system operating valves and controls accessible during normal or emergency operation? Are relief system controls and instruments identified with permanent signs or tags? Are flare seal drain valves located to allow monitoring the filling and draining of the flare seal and ensure the safety of personnel [consider potential exposure to sour gas, sour water, LPG, benzene, etc.]? PROCEDURES: Is a program in place for routine testing and inspection of pressure relief devices? Is documentation maintained regarding the test plan and results for each relief device [i.e., last test date, results from last test, next test date, etc.]? Is a program in place for the routine replacement of rupture disks at the end of their useful lives, as recommended by the rupture disk manufacturer? Is documentation maintained regarding the replacement plan? Are procedures in place to document critical process safety information for each relief valve and rupture disk: sizing criteria (vapor, liquid, and mixed phase); maximum relieving material flow rate; fluid properties (molecular weight, density, viscosity, temperature, etc.); set pressure; equipment protected; design relief case (blocked discharge, fire, utility failure, etc.); flange size and rating (inlet and outlet); orifice size; and relief valve or rupture disk manufacturer and model number? Do procedures require that changes to relief valve set pressures are reviewed through the Management of Change process? Do procedures prevent unintentional closure of block valves upstream or downstream of relief valves [e.g., chain-locked or car-sealed open valves, operator checklists, three-way/non-closing valves, etc.]? Do procedures require all relief valve bypasses to be closed during startup? Do maintenance procedures specify proper rupture disk installation, including bolt tightening and disk orientation with respect to flow? Do procedures prevent the accidental filling of relief headers with liquid if they are not designed to support the weight of a liquid-filled line?

N/A

N/A

N/A N/A N/A N/A N/A

N/A

Y Y

N/A N/A N/A

51

Do operating crews communicate unusual equipment status (bypassed or out of service) in writing (e.g., relief bypass valves that are open during normal operation)? Are operating crews provided with written temporary operating procedures when equipment is bypassed or out of service? Are the hazards associated with atmospheric relief valve, tank, or process vents documented and communicated to personnel whose duties take them into the vicinity of these vents [e.g., high noise levels from high-pressure boiler safety valves, toxic or flammable vapors from tank or process vents, etc.]?

52

Process Hazards Analysis Checklist: Emergency Response


Checklist Type: FILENAME:
Chklist/Rev. Date:

General ER.DOC January 1, 1996


Chevron Research and Technology Company

Review Date: PHA Leader: Location: Unit/Project: MOC#: Checklist Questions Y/N/N A Y Reference/Comments

Prepared by:

Is there a written emergency response plan for this unit that addresses credible emergency scenarios (e.g., toxic material releases, fire, explosions, sabotage, bomb threat, etc.)? Are copies of the written plan readily available to all affected personnel? Does the emergency response plan include an incident command structure (or other authority and communication structure) that outlines personnel responsibilities during emergency situations? Does the emergency response plan specify evacuation routes and personnel assembly or refuge areas? Does the emergency response plan contain emergency notification requirements, including a list of contact names and phone numbers, for both company and outside responders? Is this list up-to-date? Does the emergency response plan identify essential personnel who must remain on-site during an emergency [confirm that a sufficient number of trained people who are knowledgeable in the hazards of the process and emergency response are available at all times, either on-site or via rapid call-out]? Does the emergency response plan identify the resources (personnel and equipment) available from outside sources (i.e., community fire departments, mutual-aid partners, etc.)? Does the emergency response plan include procedures to account for all personnel following an incident, including employees, contractors, and visitors? Do procedures specify proper response to warning sirens, whistles, or horns? Are these warning devices routinely tested? Does the emergency response plan specify which communication channels are restricted for use by emergency responders during an incident? Does the emergency response plan include provisions for off-site traffic control and access for off-site responders? Does the emergency response plan specify the reporting requirements for the various incidents that may occur at the facility, including reporting to facility and company management as well as to outside agencies? Has an incident command center, stocked with necessary reference information (e.g., emergency response plan, site and community maps, call-out lists, etc.) and communication systems been established? For large facilities, is this information available at multiple locations?

Y Y

Y Y Y Y Y

53

Are hypothetical emergency drills routinely conducted? Do outside sources (i.e., community fire departments, mutual-aid partners, etc.) participate in the hypothetical drills? Are procedures in place to critique the response to hypothetical drills and resolve the recommendations from these reviews? Is a program in place to verify all affected personnel receive initial and refresher training in the emergency response plan? Is the refresher training provided on an annual basis and whenever updates to the plan are made? Has the adequacy of the outside agency response program been evaluated [consider familiarity with the hazards of the process, knowledge on how to respond to emergency situations, physical condition of outside agency members, etc.]? Has the adequacy of the outside agency equipment been evaluated [consider availability and adequacy of fire-fighting equipment, including foam, adequacy and integrity of personnel protective equipment, and amount of equipment available]? Do procedures specify the method and frequency for inspection, maintenance, service, and testing of emergency response equipment (i.e., fire suppression and extinguishing systems, personnel protective equipment, etc.)?

54

Process Hazards Analysis Checklist: Utilities


Checklist Type: FILENAME:
Chklist/Rev. Date:

Research and Technology


Review Date: PHA Leader: Location: Unit/Project: MOC#:

General UTILITY.DOC January 1, 1996


Chevron Research and Technology Company

Prepared by:

Checklist Questions DESIGN: Is there a design standard for safe connection (both permanent and temporary) of utilities to process streams, including safeguards to prevent backflow into the utility system, and proper isolation of the utility from the process when it is not in use? Are lower-pressure steam systems, which are supplied with steam by let-down stations from higher-pressure systems, provided with suitable over-pressure protection [i.e., is the pressure safety valve (PSV) on the lower pressure line sized for the let-down control valve in the full open position]? Have steam traps been designed for all credible operating scenarios [e.g., startup, extreme cold weather, upset conditions, etc.]? Have existing steam traps that frequently fail been evaluated for proper sizing or application? If utility system PSVs relieve to the atmosphere, is it possible for heat exchanger tube leaks (or other process leaks into the utility system) to create a hazard at the utility relief valve vent outlet (concern is for hydrocarbon or toxic material release to atmosphere, may want to consider routing PSV discharge to closed relief system or safe location)? Are all steam-generating heat exchangers designed and/or operated with routine manual or continuous blowdown to prevent sludge from accumulating in the shell [concern is for sludge buildup resulting in tube or tubesheet failure]? Have high-pressure steam system PSV installations been designed to adequately resist the thrust moment imposed on the piping when the PSV opens? Is the PSV vent pipe located to exhaust steam away from platforms and other occupied areas? Is the PSV vent pipe drained to remove accumulated rainwater, which could be heated by the exhaust and expose personnel when it falls? Has personnel exposure to the noise of an atmospheric relief been evaluated? Are all critical utility service indicators and alarms routed to a continuously staffed location? Are redundant main power lines or cables physically separated [i.e., separated to prevent a single incident, such as fire or mechanical impact, from causing the failure of redundant lines or cables]? Are utility instruments adequately heat traced and insulated or designed to prevent cold weather freezing and plugging?

Y/N/NA

Reference/Comments

N/A

N/A

N/A

N/A

N/A

N/A

N/A

N/A

55

Is the utility piping system adequately designed for thermal growth considering the maximum possible temperature [e.g., superheated steam with maximum possible superheat, or steam made up from desuperheated high-pressure steam through a let-down station and the desuperheater fails closed]? For services where the utility piping specification changes to a lower design rating after a control valve, is the downstream piping specification suitable for upset situations with the control valve wide open? Are safety showers and eye wash stations and their water supplies protected from freezing in cold weather or from overheating the water due to sun radiation? Are data sheets and other process safety information (PSI) for critical utility equipment and piping current, complete, and accurate? Are they readily available to the operators? [Note: Include PSI for vendor-supplied equipment, such as chemical injection pumps, PSVs, etc.] PROCESS UPSETS: Has loss of each pressure level of steam (e.g., low, medium, and high pressure) to the process or utility unit(s) been evaluated? Has loss of boiler feedwater to the process or utility unit(s) been evaluated? Has loss of cooling water to the process unit(s) been evaluated [determine whether or not the process unit(s) are designed fail-safe]? Has loss of the main fire water supply to the process or utility unit(s) been evaluated [determine whether or not there are alternative sources of water to fight fires--cooling tower basins, nearby waterways or ponds, etc.]? Has loss of normal plant power, including partial loss of power and total loss of power, to the process or utility unit(s) been evaluated? [Note: Include evaluation of power to emergency communications, emergency lighting, control room HVAC, flare pilot flame front generation panel, field solenoid trip valves, electronic governors for machinery, security gates, emergency block valve MOVs, etc.] Has loss of emergency power [from an emergency generator and/or uninteruptable power supply (UPS)] to the process or utility unit(s) been evaluated [determine whether or not the process or utility unit(s) are designed to be fail-safe; e.g., has the distributed control system (DCS) software been configured to open/close control valves or to leave them in their last positions if total power is lost to the DCS]? Has loss of instrument air to the process or utility unit(s) been evaluated [determine whether or not the process or utility unit(s) are designed to be failsafe]? Has loss of plant or utility air to the process or utility unit(s) been evaluated? Has loss of natural gas or fuel gas to the process or utility unit(s) been evaluated? Has a momentary dip in the pressure of the fuel gas supply to fired heaters or boilers been evaluated [determine if loss of burner(s) flame may occur, followed by buildup of flammable mixture and possible explosion]? Has high fuel gas pressure been evaluated [may be caused by fuel gas pressure regulator failure]? Has contaminants (e.g., H2S, amine, caustic or solids) or the wrong concentration (e.g., low or high BTU-content components) in the fuel gas or fuel oil supply to the fired heaters or boilers been evaluated? Has liquid hydrocarbon carryover into the fuel gas supply to fired heaters or boilers been evaluated?

N/A

N/A

N/A N/A

N/A N/A N/A N/A

N/A

N/A

N/A

N/A N/A N/A

N/A N/A

N/A

56

Has loss of nitrogen to the process or utility unit(s) been evaluated? Has a leak in a process unit to a utility stream that returns to the Utilities Area been evaluated [e.g., cooling water exchanger tube leak to returned water, steam heater tube leak to condensate, etc.]? Has excess or loss of chemicals in the utility stream been evaluated, including evaluation to downstream process units [consider excess or loss of: chlorine or other biocide, water treating chemicals for boiler feedwater (BFW) and cooling water, oxygen scavengers and filming amines for steam, etc.]? FACILITY SITING: If emergency isolation valves (either manual, automatic, or remotely operated) are provided to isolate utility supply headers, are these valves appropriate for the service and valve location [review requirements for fire-rating of isolation valves; fail-safe position of isolation valves; and fireproofing of valve actuator, power cables, and instrument cables of the isolation valves]? If emergency isolation valves are provided, has failure of the isolation valves been evaluated [consider valves closing and valves failing to close when demanded]? Has an accidental release of hazardous materials that could result in a hazardous airborne cloud been evaluated [e.g., chlorine, ammonia, hydrogen sulfide, etc.]? Are chemical injection facilities that could be hazardous to personnel or the environment identified (by signs, color coding, pavement striping, etc.)? Are chemical spills prevented from entering the storm water or oily water drain systems? Has the need for safety showers and eyewash stations to be situated nearby been evaluated? Has the need for alarming the activation of safety showers and eye wash stations been considered [i.e., are facilities remote from frequented areas, potentially preventing awareness of an incident and delaying assistance to personnel who activate emergency stations]? For process units handling flammable materials, are critical utilities (such as power and instrument cables, cooling water, instrument air, etc.) adequately protected in the event of fire? Are they routed away from likely sources of leaks and fires (such as fired heaters and pump rows), adequately fireproofed, or located in a nonhazardous area? Are utility header valves and associated instrumentation accessible for maintenance? Are the Utilities Area control building air conditioning and pressurization adequate to protect the electronic instrumentation? Are they adequate to prevent intrusion of toxics, flammables, or corrosive contaminants (if applicable)? Has control building utility supply failure (including HVAC failure), coincidental with a release of hazardous materials in the process unit or from a nearby process unit, been evaluated? HUMAN FACTORS: Can critical utility valves or equipment be closed or shut off from a safe location? Is the lighting adequate in the unit [consider local instrument panels, battery or plot limit valve manifold locations, equipment and valves requiring operation during emergency conditions, etc.]? Is the emergency lighting (light fixtures on the emergency power circuit) adequate in the unit? Are utility lines and valves clearly labeled, including flow direction?

N/A N/A

N/A

N/A

N/A N/A N/A

N/A

N/A

N/A N/A

N/A

N/A N/A

N/A

57

Are the utility field instruments that are routinely monitored by operations personnel easily accessible to ensure information is read in accordance with recommended frequency [consider instruments or areas that are difficult to reach, such as climbing 40 feet of ladder or squeezing into close quarters]? Are the engineering units of similar instruments consistent [e.g., do the steam and boiler feedwater meters all display flow in gpm or lbs/hr, and the fuel gas and nitrogen meters in SCFH or SCFD]? Are field instrument indicators routinely checked for accuracy? Are field instrument ranges appropriate for the service [e.g., avoid using a 0-500 psig pressure gage on a 50 psig steam system]? Are the communications facilities between the Utilities Area and other process units adequate for clear and uninterrupted communications during both normal and emergency situations [e.g., telephone land lines, radio, computer network, and Email, and are systems redundant and/or secure]? Is the control room lighting adequate [review direct and indirect lighting]? Is the control room emergency lighting (light fixtures on the emergency power circuit) adequate? PROCEDURES: Do procedures prohibit connection of drinking or potable water supply lines to any process or other utility system, even temporary connections during shutdowns and maintenance work? [Note: Drinking water should only connect to sinks, drinking fountains, sanitary facilities, safety showers, and eye wash stations.] Do procedures control connection of fire water to process systems or to other utility systems [e.g., to provide water for hydrotesting piping and equipment systems]? Do procedures prohibit connecting air tools to any other utility except to a compressed air system? [Note: Use of nitrogen for air tools in a confined space, for example, may expose personnel to nitrogen asphyxiation.] Do procedures prohibit use of hose connections on process systems [e.g., air hose connection on fuel gas system]? Do procedures specify that all blinds and drop-out spools in utility connections to process equipment are turned to their "safe" position before introduction of hazardous materials at startup of a process or utility unit [e.g., pre-startup checklist, etc.]? Do emergency procedures include loss of steam? Do emergency procedures include loss of normal electric power? Do emergency procedures include loss of cooling water? Do emergency procedures include loss of instrument air? Do emergency procedures include loss of natural gas or fuel gas? Do emergency procedures include loss of boiler feedwater? Do procedures specify response to potential process control system failures [consider loss of input or output signal(s), loss of display screens (loss of view), loss of memory devices, loss of equipment or system interfaces (gateways), loss of power, loss of backup power, loss of control program, etc.]?

N/A

N/A

N/A N/A N/A

N/A

N/A

N/A

N/A

N/A N/A

N/A N/A N/A N/A N/A N/A N/A

58

Is there a procedure or program to place winterization measures in service before cold weather arrives [e.g., steam traps and tracing, electric tracing, insulation, etc.]? Are steam traps routinely inspected and repaired or replaced? [Note: Concern is for flooding equipment or tracers, leading to loss of heating, with potential for freezing, rupture, and loss of containment.] Do procedures prevent the use of utility hoses for temporary process piping? Is there a procedure for routine inspection of utility hoses?

N/A

N/A

N/A N/A

59

Process Hazard Analysis WRAP-UP DISCUSSION CHECKLIST

A. Safety/fire protection (consider the participation of a specialist from the Safety Department for this discussion) 1. 2. Is the fire water supply adequate? What is the reliability of the fire water supply pumps? Y Review the availability of fixed fire equipment, such as hydrants, monitors and hose reels. Are the number and location of fixed equipment adequate? Y Are the areas with high risk of fire accessible from portable fire equipment, such as pumper trucks? Y Is training provided? Adequate? Drills conducted with plant equipment? Y Are hazard communications, such as material safety data sheets (MSDS), available to employees? Y Are the emergency shutdown (ESD) systems routinely tested? By whom and how often? Are there any hazards associated with testing the ESD systems? Y Is the electrical area classification of the process unit appropriate for the materials processed? Is new equipment reviewed for compliance with the electrical area classification? Y Is self contained breathing apparatus available and is training provided? Y Are showers/eyewashes tested and alarmed? Y Y

3. 4. 5. 6.

7.

8. 9.

10. Is an Industrial hygiene program in place? What areas are covered? 11. How is Asbestos abatement handled in the plant? N/A

12. Are Noise surveys conducted? Are high noise areas identified? Is protection provided? Y 13. Is Lighting adequate for all work areas in the plant? Y 14. Is Ventilation for labs and sample areas adequate? Y 15. Are special safety areas clearly delineated (noise, chemicals, etc.)? Y B. Emergency response (consider the participation of a Safety Engineer for this discussion) In-plant Emergency Response Plan 1. Describe your emergency response training program for in-plant personnel. 2. 3. Which in-plant personnel are expected to respond to an accidental release? Describe the PPE (protective clothing) that personnel would wear to respond to an accidental release. Where is the PPE located and who maintains it? What medical training is provided to in-plant personnel for response to injuries? What evacuation plans are in place? Process Hazard Analysis Workshops 2/27/2004 60

4. 5.

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis WRAP-UP DISCUSSION CHECKLIST


6. Are hypothetical drills conducted? Are all employees in area involved?

7.

Review injury reports of this unit over the last five years (may be reviewed in conjunction with discussion regarding previous incidents)

C. Procedures 1. Are the operating procedures for this unit currently up-to-date? Do they cover startup, shutdown, normal operation and emergency situations? Are they accessible to all employees who are expected to use them? TO BE REVISED ASAP Are there any procedures of particular concern that were not discussed during the detailed PHA review? N Are there any procedures that seem to be done incorrectly on a regular basis by less experienced personnel? N Are maintenance procedures available and up-to-date? Y Are drawings and sketches used to clarify written text? Y Do the procedures include explanation of expected system responses for operator actions? Y Are there incidents that regularly occur on startup or shutdown that are not addressed in the procedures? storage and handling? personnel exposure hazards? Are procedures available that cover loading/unloading for: 1. static electricity? quality control? personnel hazards? reactivity concerns? regulatory compliance?

2.

3.

4. 5. 6. 7.

8.

control of drivers? regulations?

D. Loss of Utilities Review and document the global loss of the following utilities that apply to the process unit being analyzed. Note that local loss of utility, such as loss of power, instrument air, or cooling water, to a single piece of equipment or control valve is typically covered during line-by-line analysis when reviewing the equipment or controls that require that utility. The intention of the general discussion is to identify system interactions that may be hazardous, such as requiring an operator to block in equipment to prevent backflow or remove heat to prevent overpressure. Each utility outage should be documented separately. Where loss of a particular utility has significant consequences, review and document the reliability of the utility supply system. Where applicable, review loss of: Instrument AirElectricity Plant or Utility AirSteam (150 PSI, 450 PSI, 850 PSI, etc.) Cooling WaterNitrogen or Inerting Gas Fuel Gas Chevron Research and Technology Fire and Process Safety Team
Wrapup.doc

2.

3.

Process Hazard Analysis Workshops 2/27/2004 61

Process Hazard Analysis WRAP-UP DISCUSSION CHECKLIST


E. Siting/control room location (discussion should be documented to ensure compliance with OSHA Regulation 29 CFR 1910.119) 1. 2. Are there any concerns about control room siting relative to releases in adjacent units? N Is the control room pressurized? Is inlet air filtered and/or treated? Is loss of control room pressurization monitored by an alarm system? Is the control building capable of withstanding blast overpressure resulting from credible release and subsequent explosion in the area? Y Do feeders on critical control instruments and power supplies enter the building overhead or underground? Are control room fire suppression systems compatible with both humans and instrumentation? Y

3.

4. 5.

F. Previous Incidents (discussion should be documented to ensure compliance with OSHA Regulation 29 CFR 1910.119; consider the participation of a specialist from the Safety Department for this discussion) 1. 2. 3. 4. Confirm that the facility has an incident investigation procedure. Y

Review incident reports of this or similar units at the facility over the last five years. Review incident reports of this or similar units at other facilities of which team members have knowledge. Discuss the history of near-miss incidents in this or similar units that may not be documented but of which the team has knowledge. Have recommendations from previous incident s been implemented? Y Are previous incidents with severe consequences likely to occur again, given the current practices and procedures? N Are there any operating or maintenance procedures that may present a specific hazard? N Are there cases where valve arrangements are confusing? N Are there areas where correct procedures (PPE, isolation) are so difficult that a person may attempt to shortcut, resulting in hazardous material release or personnel injury? Y Are there any areas where routine operator monitoring is so difficult (climbing 40 feet of ladder, squeezing into close quarters) that an operator may ignore the reading? Are there any instances where instruments (board or local) necessary for safe operation of the plant, or routine adjustments, are poorly placed and difficult to see? N Are there any nuisance alarms that the operators either routinely ignore or disable? N Are field manifolds or local panels adequately labeled? Is the lighting in the area sufficient? Y Describe the Critical Equipment Program Describe the Corrosion/Erosion Monitoring Program Process Hazard Analysis Workshops 2/27/2004 62

5. 6.

G. Human Factors (discussion should be documented to ensure compliance with OSHA Regulation 29 CFR 1910.119) 1. 2. 3.

4.

5.

6. 7. 1. 2.

H. Testing and Inspection (consider the participation of a specialist from the Inspection Department for this discussion)

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis WRAP-UP DISCUSSION CHECKLIST


3. 4. 5. 6. 7. 8. 1. 2. 3. 4. 5. 6. Describe the Instrument List and Testing Frequency Describe the PSV Testing Program Describe the Shutdown Schedule Describe NDT Frequency and Tests Describe how Suitability of Materials for Intended Service is Determined Describe the Documentation System Do written maintenance procedures exist for repair of equipment in this plant? Y Describe procedures used for equipment isolation, lockout/tagout and confined space entry. Describe how maintenance workers are trained on new systems introduced into this plant. Is equipment designed for draining, neutralization, and purging? Describe the vehicle entry system in place for this plant. If there are hazards associated with the unit (such as H2S, NH3, CL2, LPG or H2SO4), how are the hazards of the unit communicated to the valve repair personnel? Are there any process hazards created by hot weather during the summer (inadequate cooling)? Are there any problems created by freeze-up during the winter? Are there any concerns about flooding? Are there any concerns about earthquakes or other natural disasters? Is seismic activity a concern in this area? For what seismic zone is the plant designed? Are there any concerns about sabotage? Is this plant accessible from the fence line?

I. Maintenance (consider the participation of a specialist from the Maintenance Department for this discussion)

J. External Events 1. 2. 3. 4. 5. 6.

7.

Any other external events that might have effects on the plant?

K. Previous hazards analysis studies (discussion should be documented to ensure compliance with OSHA Regulation 29 CFR 1910.119) 1. If the present PHA analysis is the initial analysis that is intended to comply with the OSHA Regulation, document that this is the initial PHA analysis and that no previous PHA analysis has been performed. NO PREVIOUS PHA Have the hazards identified in previous PHA analyses been adequately addressed in this analysis? N/A Have the recommendations from previous PHA analyses been resolved? N/A When was the previous PHA analysis performed? N/A

2. 3. 4.

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 63

5.0 ADDITIONAL CONSIDERATIONS AND ACTION PLAN


5.1 DESIGN REVIEW ADDITIONAL CONSIDERATIONS 5.2 WHAT IF ADDITIONAL CONSIDERATIONS 5.3 CHECKLIST ADDITIONAL CONSIDERATIONS

5.1 DESIGN REVIEW RECOMMENFDATIONS

Section Description: General

Item 1.

Issue Raised Design flexibility to allow use of Tank 3 for both wash tank and storage service Installation of 8 emulsion pad take off to be through a spreader between 4 & 5ft height Why are steel pads required ? ( see design review item 11) Have we combined tank repair work with the wash tank conversion project Is provision made to determine sand build- up in the new wash tank Where is waste heat recovery from? Is control and safety system separated Is design team considering adding sampling points close to the wash tank 8 emulsion pad draw off from Tank 01 not provided presently Why is the water line maintained at 4ft level and not increased to 5ft for instance Is it possible to have two (2) nozzles for the Agar probe with possibility of alternating between the two if required. Wash tank Instruments function

Additional Considerations

2.

Detail design to continue with this concept Existing provision to be reviewed

Action By Design Team

P&ID No.

Design Team

3. 4.

5.

To be reviewed at detail design Review to be carried out to determine what has been covered To be considered

Design Team Design Team

Design Team

6.

7. 8.

PE to discuss with operations and advise design team To be addressed by ensuring separation To be considered

Project Engineer Design Team Design Team

9.

PE to review and advise design team PE and Operations to evaluate and advise design team Nozzle can be provided at two points if desired installation.

Project Engineer Project Engineer Design team

10.

11.

12

Project Team Instruments function (Control and Operating philosophy) to be


Process Hazard Analysis Workshops 2/27/2004

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

65

13

Spectacle blind

14 15 16

17 18 19

LSL 803A not clouded as new Instrument Installation of corrosion coupon Line from turndish is 1 in new design whereas 2 I the existing Temperature Indicator on inlet and outlet lines Notes to indicate valves in the bottom lines as NC Is LTI 803B (Internal hanging Fisher LG) required Monitoring/Sampling of SRB growth to determine if growth from the tank or from the field As Built drawings

reviewed with Process and Operation group Spectacle blind to be added to all lines common to storage and wash tank service to prevent co-mingling New instruments to be clouded Provision to be explored To be checked

Project Team

Design Team Design Team Design Team

To be included To be implemented To be reviewed with Operation and Process group To be reviewed with Operation and Process group After detail design and construction

Design Team Design Team Design Team

20

Design Team

21

Project team

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 66

5.2 WHAT IF RECOMMENFDATIONS


Section Description: Wash Tank Designs Tie-Ins Design Intention: Wash Tank ABJ-803 Piping & Instrumentation

Note: Considerations with a final risk ranking of 1, 2 or 3 are highlighted in green Item 1. What If.? VG-60 0nline 1455 left open Additional Considerations Spectacle blind to be provided. Action By Design Team P&ID No. TNK.PI.103003 TNK.PI.103003

2. VG-60 on line 1042 fail close (Internal mechanism drop to close valve) Offshore send excess gas

3.

4. 5. 6.

Isolation valves on all outlet lines faulty (Maintenance) Presence of H2S LTI 803A/LSL 803/803B fails

7.

LSH 803 fails

8.

LIT 803 gives false reading

9.

LAH 803 fails to alarm

10.

Tanks hit by Lightning

11.

One or more sample points blocked

LOTO provision Consider Installing a RO or a Globe valve downstream of the ball valves Convert PSVs to PVSVs. Communication between Platform and Offshore Maintenance Access to be provided On-line monitors to be provided Control & Operating philosophy to be reviewed Ensure clean out connection is accessible Control & Operating philosophy to be reviewed Control & Operating philosophy to be reviewed DPR to check DPR regulation and advise design team Ladder rung to be provided to access sampling points

Design Team

Project Team

TNK.PI.103003

Project Team Design Team Project Team

TNK.PI.103003 TNK.PI.103003 TNK.PI.103003 TNK.PI.103003 TNK.PI.103003 TNK.PI.103003 TNK.PI.103003 TNK.PI.103003

Design Team

Project Team

Project Team

Project Engineer Design Team

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 67

12.

13.

No maintenance access for PSVs and flame arrestors on tank top Fire on tank 3 or adjacent tank

To provide maintenance access SOP to address

Design Team

TNK.PI.103003

Process/Operat ion Group

Section Description: Wash Tank #1 Interface Tie-IN with wash Tank #3 Design Intention: Wash Tank #1 Interface with Wash Tank #3 Piping & Instrumentation

14.

High pressure from relief line (AT 1461) Rupture disc or line open

15.

Relief line opens to both tanks

Project Team Integrate rupture disc monitoring to EDMAC Incorporate CSO/CSC when switching between two wash tanks to SOP To provide spectacle blind on CSC/CSO Revision of SOP

Section Description: Wash Tank Sump/Sump Pump (PBH 803) Design Intention: Wash Tank Water Transfer Pump Piping & Instrumentation

16.

LSH 803 fails

Pit sump & pump to be automated. Existing P & ID to be revised to reflect automated sump & pump Flame arrestor to be tagged

Design Team

TNK.PI.103003 SMP.PI.100191

17.

Flame arrestor blocked

Design Team

TNK.PI.103003 SMP.PI.100191

Section Description: Produced Water Transfer System Design Intention: Produced Water Transfer System Piping & Instrumentation

18.

LSL 803/B fails

Instrumentation tags to be checked Control & Operating Philosophy to be reviewed

Design Team

DHY.PI.103003 TNK.PI.102021

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 68


Section Description: Dry Oil Transfer System Design Intention: Dry Oil Transfer System Piping & Instrumentation

19.

FCV 800 fails open

Consider installing a check valve downstream PSV

Design Team

DHY.PI.100102 TNK.PI.103003

20.

LCV 800 fails to close

SOP to address new pump system. Pump logic to be reviewed

Project Team

DHY.PI.100102 TNK.PI.103003

Section Description: Instrument Air Design Intention: Instrument Air Piping & Instrumentation

21.

Four (4) different tie-in points

Tie-in points to be reviewed with Process & Operations group

Project Team

IAS.PI.109604 TNK.PI.103003

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 69

5.3 CHECKLIST ADDITIONAL RECOMMENFDATIONS


Section Description: Storage Tanks Design Intention:

Item 1.

2.

3. 4.

5.

6.

7.

Checklist Questions Is the area around the storage graded to prevent pooling of product (concern for fire) or water (concern for external corrosion) at the base of the tank? Does storage tank gaging/sampling equipment provide protection against vapor release/personnel exposure [concern is for personnel exposure to H2S or inert blanketing or release of flammable vapors]? Are tank suction and fill lines and valves clearly labeled, including flow direction? Do procedures specify storage tank minimum level? [Note: possible concern for floating roof tanks] Have storage tank valve manifolds been arranged to reduce the likelihood of mismanifolding? Has valve mis-manifolding been evaluated [consider complex suction, fill, or water draw manifolds]? Do storage tank startup procedures specify a maximum fill rate until the tank liquid level covers the fill piping? [Note: possible static electricity concern] Do procedures specify the safe-fill level of the storage tank? [Note: The tank safe-fill level may be influenced by site-specific seismic hazards.]

Additional Considerations Separate project group to address.

Action By HES

HES to follow up SOP to address Operations/


Process group

Detailed design to address Detailed design to address SOP to address

Design Team Design Team

Operations/
Process group

SOP to address

Operations/ Process group Operations/


Process group

SOP to address

Section Description: Instrumentation Design Intention: Chevron Research and Technology Fire and Process Safety Team
Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 70

Item 1.

2. 3. 4. 5.

6.

7. 8

9 10

11

Checklist Questions Are critical safety shutdown systems designed and installed to ensure reliability of the shutdown system [consider requirements for redundancy of components, independence from process control system, and ability to test system to ensure reliability]? Are all instrument labels easy to read (clear and in good condition)? Are all instrument labels correct and unambiguous? Do switch labels identify discrete positions (e.g., ON or OFF, OPEN or CLOSE)? Do all instrument labels use standard terminology (e.g., acronyms, abbreviations, equipment tags, etc.)? Are the instrument labels consistent with nomenclature used in procedures? Are all components that are mentioned in procedures (e.g., valves) labeled or otherwise identified? Are all instrument labels located close to the items that they identify? Are the field instruments that are routinely monitored by operations personnel easily accessible to ensure information is read in accordance with recommended frequency [consider instruments or areas that are difficult to reach, such as climbing 40 feet of ladder or squeezing into close quarters]? Are field instrument indicators routinely checked for accuracy? Are field instrument ranges appropriate for the service [e.g., avoid using a 0-2500 psig pressure gage on a 100 psig system]? Do the process control system displays provide feedback to operations personnel to confirm operator actions? Does the feedback provide operators with logical information (e.g., is 100% valve output equivalent to valve wide open)?

Additional Considerations

Action By

Detailed design to address

Detailed design to address Detailed design to address Detailed design to address Detailed design to address

Detailed design to address Detailed design to address Detailed design to address

SOP to address Detailed design to address Detailed design to address

Operations/
Process group

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 71

Section Description: Piping and Valves Design Intention:

Item 1.

Checklist Questions Materials, Piping and Valves checklist questions to be addressed at detailed design

Additional Considerations

Action By Design Team

Section Description: Static Electricity Design Intention:

Item 1.

Checklist Questions Do tank filling procedures specify a maximum fill rate until the tank liquid level covers the fill piping?

Additional Considerations SOP to address

Action By Operations/ Process group

Section Description: Emergency Response Design Intention:

Item 1.

Checklist Questions Are the operating procedures for this unit currently up-to-date? Do they cover startup, shutdown, normal operation and emergency situations? Are they accessible to all employees who are expected to use them?

Additional Considerations SOP to address

Action By Operations/ Process group

Chevron Research and Technology Fire and Process Safety Team


Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 72

6.0 REFERENCES
API RP 14 C - Recommended Practice for Analysis, design, Installation, and Testing of Basic Surface Safety Systems for Offshore Production Platforms. API RP 14 E - Recommended Practice for Design and Installation of Offshore Production Platform Piping Systems. API RP 14 J Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities. API RP 500 - Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class I, Division 1 and Division 2.

7.0 RISK RANKING TABLE.


Chevron Research and Technology Fire and Process Safety Team
Wrapup.doc

Process Hazard Analysis Workshops 2/27/2004 73

LIKELIHOOD OF OCCURRENCE
WITH SAFEGUARDS

FREQUENT

OCCASIONAL

SELDOM

UNLIKELY

1
This incident has occurred at this facility and/or is reasonably likely to occur at any time.

2
This incident is likely to occur at this facility within the next 15 years.

3
This incident has occurred at a similar facility and may reasonably occur at this facility within the next 30 years.

4
Given current practices and procedures, this incident is not likely to occur at this facility.

SEVERITY OF CONSEQUENCES
WITHOUT SAFEGUARDS

MAJOR

SAFETY - Fatality or permanently disabling injury. OPERABILITY - Major or total


destruction to process areas; plant downtime in excess of 30 days.

ENVIRONMENTAL & COMMUNITY IMPACT - One or more severe injuries;


significant release with serious long-term off-site impact.

SERIOUS

SAFETY - Severe injury. OPERABILITY - Major damage to


process areas with up to 30 days plant downtime. ENVIRONMENTAL & COMMUNITY IMPACT - One or more injuries or possible evacuation; significant release with serious environmental impact.

MINOR
possible lost time.

SAFETY - Single injury, not severe, OPERABILITY - Some equipment


damage with possible downtime.

ENVIRONMENTAL & COMMUNITY IMPACT - Odor or noise complaint from


the public. Release that results in some Agency notification or violation.

INCIDENTAL

SAFETY - Minor injury or no injury. OPERABILITY - Minimal equipment


damage with negligible plant downtime.

ENVIRONMENTAL & COMMUNITY IMPACT - No impact off site.


Environmental recordable event with no agency notification.

LEGEND: 1 = Very High Risk; Additional Consideration Required 2 = High Risk; Additional Consideration Required 3 = Moderate Risk; Additional Consideration Recommended

4 = Possible Risk; Additional Consideration at Discretion of Team 5 = Negligible Risk; Additional consideration Not Require