P. Deshai C. Botheju

195

If you think safety is expensive, try an accident ! ( original quote from Stelios Haji-Ioannou).
The picture shows that even a so called "good regulator" sold in SL is rated for a max 7.5 bar pressure. Some of the other "cheap" LPG pressure regulators sold in SL have been found to be rated for just 5 or 6 bar. Meanwhile, one German pressure regulator manufacturer contacted me very recently and told me that it's very normal for their "low pressure LPG regulators" to be rated for a maximum inlet pressure of 16 bar. Now this says a whole lot about "Sri Lanka's problem" when it comes to domestic LPG accessories and the recent explosions. Remember that when the LPG cylinder contains 50 % propane and 50 % butane, the headspace pressure will be close to 7.2 barg at 37.8 deg C (i.e. 100 deg F). Also note that in many places, people keep their cylinders close to their burners and the surrounding air temperature can easily exceed 35 deg C (especially the case with roadside shops, restaurants, etc. - mostly due to space limitations). N.B. In case the cylinder is filled with 100 % propane, the cylinder pressure will reach almost 12 barg at 37.8 deg C temp.

Experience Transfer Stories (03) - Degradation of (process) safety cultures (part 1)

The concept of safety culture can be defined in many different ways. A working definition can be given as “a set of commonly accepted norms within an organization dictating the perceptions, attitudes, values, and behaviors towards the safety of humans, environment, and the other assets (Botheju et al., 2015)”. No need to have a detailed discussion of this definition in order to grasp the scope of this brief article.

Safety culture spectrum can be categorized into 2 broader regions: Positive safety cultures, and negative safety cultures. A positive safety culture contributes to the overall safety within an organization. Negative safety cultures lead to regular accidents and incidents; poorer safety performance overall. We can look into more details of the differences between these two types of safety cultures in a different occasion. The aim of this text is to briefly discuss about the deterioration of safety cultures.

Even the best safety cultures in the world can be deteriorated, unless they are actively maintained. That is a key phrase: “active maintenance of the safety cultures”. According to our personal experience, there are many reasons for degrading safety cultures. Let’s look into few of them.

1. Complacency - A long period of relatively high safety:

When a certain safety culture develops into a highly positive state, then that organization reaches a long period of high safety performance, indicated with a very few or no accidents. Then everything seems to be working fine. Nothing seems to be going wrong for a long period of time. This is when it onsets a course of cultural shift. A time of complacency starts to infest the organization. People tend to believe that the expenses made on safety systems can be reduced; or they can “cut corners” out of safety expenses. As a result, major deficiencies in the process designs can occur within a short period of time, OR, greater reduction of care will infest the work procedures and safety barriers. This situation will then lead to a series of significant incidents or accidents, or even a major accident. When that happens, everybody understands that a (major) course correction is needed. And the organization attempts to re-converge towards a positive safety culture. This cycle will repeat itself. For those organizations having a greatly developed positive safety culture, this cycle is not very visible – but still happens within a certain control margin. For those organizations with negative safety cultures, this cycle becomes extremely visible. Sometimes, the cycle becomes so self-destructive that many organizations facing major disasters will simply go out of business at the first run of the cycle. Other organizations may survive through several cycles of improving and degrading safety periods. The best (positive) safety cultures shall clearly understand this cycle and fine-tune their safety management system to recognize the first signs of this self-complacency and will take actions to reduce the amplitude of this cycle.

We will meet in a 2nd part of this article to discuss more reasons for degrading safety cultures. Until then, always remember that “Even the best safety cultures in the world can deteriorate unless they are actively maintained”. The author has seen this happening during his career.

Experience Transfer Stories 02 –Functions, Task, and Workload Assessments for Process Plant CCRs.

Existing process plants undergo modifications at various stages in their life cycle. These modifications include various additions to their CCR (central control room) functions. Often these changes are perceived as minor. However, these changes over time adds up and gradually increase the workload of the CCR operators. Therefore, it is important to conduct Functions, Tasks, and Workload assessments for the CCR as part of every process plant modification project. The failure to do that will result in an overloaded, stressed, ans non-optimal CCR which then can easily lead to accidents initiated by human error, OR leads to making wrong responses to a developing incident.

Figure below shows a typical (but simplified) Functions and Tasks Assessment template used often in the North Sea Oil and Gas sector. As can be seen there, each new modification scope (i.e. new process units or equipment) is separately analyzed with respect to its CCR scope (functions). The CCR operators work tasks at different operational modes with respect to that unit (such as start up, normal operation, process upsets, shut down, cleaning, switch-over, maintenance, etc.) are separately recognized. At the end of this exercise carried out in a workshop with the participation of key discipline design engineers as well as plant operators and plant management, a clear picture emerges with respect to the additional CCR functionalities and work tasks created by the modification scope. Now, from this point onwards, it is easy to recognize the additional work loads. Based on that, and also considering the available resources, decisions can be made to either increase the existing manning level at CCR, or to introduce more automation in the process design. The decisions are then in turn fed back to the engineering design team to implement in the plant modification design.

The responsibility of correctly conducting this Functions, Tasks, and Workload assessment rests with the Safety Engineering & Management discipline. Also ensuring proper participation of required engineering design disciplines (Process, Instrumentation, Electrical, HVAC, Piping, etc.) and other resources (plant operators, management, safety delegates, etc.) in the workshop is a part of this responsibility.

Experience Transfer Stories (01) –Hazardous Pyrophoric Substances !

Two years ago, on one of the offshore platforms processing oil and gas in the North Sea, a fire incident occurred during maintenance activities related to a large inlet separator vessel. The plant was on a revision stop (turnaround) at that time. Replacing the inlet internals of this vessel was a part of the turnaround schedule.

Before the fire broke out, the vessel had been depressurized, drained, isolated, and vented. The plan was to send maintenance operators into the vessel after it was fully vented. The sudden fire lasted about 3 hours before being fully extinguished, and was restricted to the vessel itself. No person was harmed. However, consequences could have been more severe if the fire occurred when the operators were inside the vessel.

Investigation revealed that the fire was caused by pyrophoric iron sulfide deposits present within the separator vessel. Iron sulfide is deposited out of the reservoir fluid and over time it builds scales or deposits on the vessel internals. As long as the vessel is closed to the outside environment, such deposits stay dormant. When the vessel is open (e.g. being vented for maintenance), air /oxygen reacts with dry iron sulfide deposits to start a highly exothermic oxidation reaction (FeS + O2 -----> Fe2O3 + S + Heat). This exothermic reaction can start a fire and it can be further fed by the remaining oil residues in the vessel. This kind of self-igniting Pyrophoric substances is a less well-known hazard in the process industry.

Safeguards include;
- Make operators aware of such self-igniting pyrophoric substances that can be found inside process vessels /process equipment.
- Do more thorough insitu cleaning of vessels before opening (e.g. using internal water jets).
- Keep vessels wet while they are open (do not let complete drying out if such deposits are suspected).
- Use a fire guard on watch, or use temporary fire detectors (flame detectors) during the maintenance interval.
- Risk assessment related to the vessel entering (by operators) should include this type of fire hazards and prepare accordingly.
- Additional firefighting means must be available if this type of fire risk is present during maintenance (e.g. overhead deluge nozzles, fire hoses, portable extinguishers, possibility to flood the vessel, quick closing and cutting off the air supply, etc.)
- Other necessary measures based on the risk level (such as ?).
Are you able to find some other pyrophoric substances that may be encountered in the process industry (like iron sulfide) ?

This was something I presented a few weeks ago. Thought as useful to share. See the impacts on a fish embryo exposed to a simulated crude oil contamination in the sea. The spinal cord is deformed, heart area very different, and the head and the mouth are deformed. This fish larva will not survive. This is exactly what we are talking about when marine oil pollution is on the discussion. Every drop of oil or chemical that is being released to the environment has consequences somewhere.

Nuclear power has been tarnished by some "risk perception" based thinking (due to a few high profile accidents). The actual risk can be very different compared to the "risk perception".
As long as proper safety philosophies are used in design, and prudent operation is maintained, Nuclear Power can be a safe, economical, and climate friendly energy alternative.

https://www.dw.com/en/un-experts-find-no-harmful-effects-from-fukushima-nuclear-disaster/a-56820805

Importance of Human Factors – Lessons to be learnt from United Airlines Flight 328 in-flight engine fire incident:
Update to our previous post: The investigation has now proposed that the likely initiating even could have been the fatigue failure of one turbine fan blade; and then the imbalance of the high speed turbine caused extreme vibrations and eventually other engine parts started shearing off from the engine and exited through the engine cowling (engine cover) – as high speed projectiles (like bullets). Passengers reported this as an initial loud bang, before the fire started. As per the engine fire check list, pilots had shut down the engine and (most likely) activated the engine fire extinguishers. But these extinguishers are effective only for a limited duration. And the continuous fire on the engine (as seen in the videos) was most likely due to the damaged fuel lines still leaking fuel. The pilot and the copilot handled this extreme workload situation very professionally; shutdown the engine, activated engine fire extinguishers, completed the checklist, turn the aircraft towards the functional engine, navigated back and landed successfully. If they hadn’t maintained their cool, this incident could have easily turned into a fatal catastrophe (as we have seen in numerous other air accidents). This is exactly how process plant control room operators are supposed to work when faced with a potentially hazardous situation within the plant; keep your cool, follow the procedures, use common sense, collaborate with the colleagues, communicate effectively, do your job that you are supposed to do and keep everybody safe at the end of the day. Process Engineers and safety management shall make sure that, this is the way their CCR operators would function. The process plant CCRs are in fact quite analogous to an aircraft cockpit in this sense. The same human factor principles apply in both cases. Note that the process industry is also a safety critical industry just like the aviation industry. These safety critical industries usually learn lessons from each other’s failures.

Looks like there had been a fuel-vapour explosion within the engine at the onset of the fire. Aircraft engines are basically gas turbines. Gas Turbine fires are quite known in the offshore oil & gas industry as well (power generation turbines, and direct turbine driven machinery). There are dedicated fire detection and extingishing systems installed within industrial gas turbines; so does aircraft engines. (but an initial explosion would render such systems inoperable).The main difference here is that the fire could damage the wings or the airframe, or could damage aircraft control hydraulics. Damaged fuel lines is a frequent cause for aircraft engine fires. Normally, the first step is to cut-off the fuel supply to the engine on fire. However, as per accident statistics, it is very rare for an engine fire to end up as a fatal air crash.

https://www.dailymail.co.uk/news/article-9282215/United-Airlines-flight-makes-emergency-landing-dropping-debris.html#v-9045817133520303965

Noise Measurements and Human Noise Perception
(check out http://safetyatdeshaibotheju.blogspot.com/)

The Swiss Cheese Model is one of the Holy Grails in Safety Engineering, that is being used to teach risk reduction barriers and independent layers of protection. Now, it's very interesting to see how we could use this model to illustrate safeguards against COVID-19.