When things go wrong

InTech, Dec 2004 by Fussell, Ellen

Safety standards, inside security crucial to avoid plant floor SNAFUs.

Keeping a plant productive and running smoothly is difficult enough in today's economy, but when things go wrong-whether by accidents or sabotage-manufacturers have an added challenge. Following the development of new standards and being aware of what can happen are a couple of tactics to head off disaster before it strikes.

Equipment failure

An equipment failure in the operating unit could propagate into a major loss of containment with impact to people or the environment. The purpose of the ISA-84 standard is to provide work process and requirements for what manufacturers should do-appropriate redundancy, voting, diagnostics, operation, and maintenance. Voting refers to having multiple instruments in the field. "You could have one transmitter measuring pressure, but if it failed you'd have nothing," said Angela Summers, president of SIS-Tech in Houston. "So with potential catastrophic events, you'd have more than one transmitter, so you could vote one out of two or two out of three to shut down."

The purpose of voting is to get fault tolerance. "When you look at a safety instrumented system, it's a barrier. So you have a process upset occurring," Summers said. "Pressure is building, and if it continues you'd have a rupture. The sensors are measuring the pressure to take action on the process. How many shutdown actions do you need to prevent buildup of pressure? The worse the severity of the catastrophic event, the more devices you'll typically have in the field."

To help manufacturers update their systems, the ISA SP84 committee has released a new standard, which builds on the international standard IEC 61511. It's important because it doesn't just cover the design; it covers the operations and maintenance as well, Summers said. "Other industrial standards stop at design. But if you don't maintain the system, it doesn't matter how many devices are installed. To keep things in good working order, you need to do maintenance-just like with cars. If you don't change the oil, it'll break down."

A boiler explosion in Algiers this past year did extensive damage to one plant. On 20 January 2004, a defective high-pressure steam boiler ruptured, killing more than 20 workers and injuring more than 70. A foreman in a storage depot at the complex heard "strange noises and abnormal vibrations coming from a boiler and valves before the main explosion," said an Agence France Presse article. The foreman said specialists had filed a reporf'more than a year ago" saying the boiler had defects, and the plant had completed "superficial repairs."

Older boilers like this are "always an issue any time you have a new standard come out/' Summers said. "When you have existing equipment, at what point do you look at a new standard and existing equipment and find deficiencies and work toward rectifying them?"

To prevent some of these incidents caused by process upsets, Summers said the SP84 committee is documenting the good engineering practices used throughout industry. When an instrument or piece of equipment fails, it can result in the process going beyond what's considered normal operation. The committee is documenting the good engineering practices to address the potential hazards from abnormal operation. "From what I read about the explosion, if it had been reviewed under the new ISA-84 standard, they would have found deficiencies in the design. And if those had been corrected, then the explosion would not have occurred," she said.

Other incidents result from plain old human error. "The ones we usually find out about are the big incidents, and it turns out that someone made a mistake," Summers said. "You can't write an industrial standard to prevent people from making mistakes. You can only write standards to reduce the potential for mistakes."

Differences in new safety standard

There's one key difference in the U.S. standard on safety instrumented systems and the international one: The committee has included a grandfather clause-a process of looking at existing equipment. "The grandfather clause doesn't say you have to update your existing equipment, but you do need to look at it and determine and document-based on your design, operation, and maintenance practices-that it's safe," Summers said. "If it is safe, you don't have to modify your systems to the level of the new standard. If it isn't, you need to bring it into compliance with the latest good engineering practices."

The premise behind the new standard is that it's performance- or goal-oriented versus prescriptive, said president of Houston's L&M Engineering Paul Gruhn. The goal of the new standard is not to dictate what technology you need for the level of redundancy you need. The fact that the new standard is performanceoriented means "the greater your level of process risk, the better the safety systems you need," Gruhn said. The new three-part standard also covers a higher safety integrity level-SIL 4. The old standard only went up to SIL 3. (see a related story in November 2004 InTech.) "But just because you define something as SIL 4 doesn't mean you need SIL 4 in your facility," Gruhn said, "especially when before, you didn't even need SIL 3."