Refer: Guidelines for Engineering Design for

Process Safety, Second Edition by Center for

Chemical Process Safety Copyright © 2012
American Institute of Chemical Engineers, Inc.
General Designs
1. BASIC PROCESS CONTROL SYSTEMS
• The Basic Process Control System (BPCS) responds to input signals from the process
and its associated equipment, other programmable systems, and / or an operator
and generates output signals causing the process and its associated equipment to
operate in the desired manner. The primary function of a BPCS is business and
production goals, especially uptime, production, and quality.
• The BPCS consists of many hardware and software components and relies heavily on
communication equipment to access and display process information. The BCPS logic
solver is often referred to as the "controller" and can utilize pneumatic, hydraulic,
electrical, electronic, or Programmable Electronic (PE) technology. A modern PE-based
BPCS provides nearly seamless integration of controllers and operator displays. PE
technology enables complex control algorithms, such as advanced process controls,
sequencing, predictive controls, and batch reactor recipe management
1.1 Alarm Management
The need for an alarm is usually specified by process design and good engineering principles.
Alarms may originate from Operations personnel, from a process hazards analysis, or as a result
of a team's investigation of an incident. Typical alarms include: • A Warning Against Operational
Error - An alarm can be justified if an operational error will lead to a plant upset or equipment
damage. The upset will be such that the control scheme will not be able to bring the plant back
to normal condition.
• Equipment Malfunction - Malfunction of equipment can lead to plant upset which the plant
control scheme may not be able to correct. For example, a pressure control valve in an overhead
vapor line which gets stuck in the closed position may cause the pressure in the system to rise
and result in the lifting of a relief valve.
• Equipment Protection - The malfunction of a system which can lead to damage to the
associated (or downstream) equipment, for example, high temperatures on a product rundown
line that may exceed a tank design limit.
• Signal a Shutdown of Major Equipment - The shutdown of a certain piece of equipment will
cause major plant upset and will require substantial operator intervention to mitigate the effect
of the shutdown. High Furnace Tube Skin Temperature - Refinery furnace tubes may be provided
with skin temperature indicators. Skin temperature indicators should have high temperature
alarms and should be set at the Maximum Allowable Skin Temperature (MAST).
• Minimum Flow for Rotating Equipment - For centrifugal pumps, an alarm
should be provided to warn of an operation with less than minimum safe
flow.
• Flammable and Toxic Gas Detectors - Flammable and toxic gas detectors
or those devices which indicate immediately dangerous to life and health
should be configured with an alarm to warn personnel in the affected area.
With the ability to make every signal into an alarm in a BPCS, operator
information overload is a genuine safety concern. ANSI / ISA 18.2-2009,
Management of Alarm Systems for the Process Industries, Instrumentation,
Systems, and Automation Society, is a standard that provides guidance and
requirements for the design and implementation of an effective alarm
system. Proper alarm design will follow a rationalization and prioritization
process to determine the need for the alarm, the required response for the
alarm, and the priority of the response.
 1.2 Testing Instrumentation
• Process control and safety shutdowns should be provided during all modes of
operation, not only in the normal, steady state operating mode. Properly
designed automated systems include provisions for functional testing of the
entire function, as well as for calibrations of individual devices, such as sensors.
Functional tests may be performed online or offline depending on the function,
test facility design, and mechanical integrity plan.
• Periodic testing of the complete function should include the final element(s). To
do so without creating transient or frequent unit / plant shutdowns, it is often
necessary to perform functional tests of the final elements during shutdown
periods when the process is offline. Depending on the nature of the plant
response, it may be possible to initiate a planned shutdown by tripping the final
elements. This should be attempted only if the resulting shutdown will be orderly
and stable and will not cause transients in other process parameters that are
outside their normal limits
• Periodic testing is essential for ensuring that automated systems have
adequate reliability and dependability. Test records should be maintained to
support reliability analysis, tracking, and auditing. The importance of testing
and documentation is illustrated in the following example: a 15-year-old
heater was designed to automatically shut down and provide an alert in the
central control room in response to high heat transfer oil pressure, high tube
wall temperature, low fuel gas pressure, and flame-out. After a fire destroyed
the heater, it was determined that there were no records documenting initial
validation (acceptance test), periodic proof testing, or preventive
maintenance. It was further determined that there was no systemic program
in place to periodically test the instrumented functions
2. PROCESS DESIGN / PROCESS
CHEMISTRY
2.1 Process Equipment Safe Operating Limits
The zones of operation are defined as:
• Normal Operating Zone - The minimum or maximum values of a critical operating
parameter that define the boundaries of normal operations.
• Troubleshooting Zone - An area that provides time for troubleshooting so that operations
personnel can make adjustments in time to return critical operating parameters to the
normal operations zone. Human factors and process response time generally indicates zone
size. Immediate actions and in some cases predetermined actions to avoid Safe Operating
Limit (SOL) deviation are taken in this zone.
• Buffer Zone - The upper and lower area of the known safe zone provides a buffer to
ensure no critical operating parameter can reach the unknown / unacceptable operation
zone. Factors that influence buffer zone size may include engineering judgment, reliability
of instrumentation, operating experience, probability and consequence of human error, etc.
A process will not be intentionally operated in this zone.
• Safe Operating Limit (SOL)- A value for a critical operating parameter that
defines the equipment or process unit safe operating envelope beyond which
a process will not intentionally be operated due to the risk of imminent
catastrophic equipment failure or loss of containment. Operational or
mechanical corrective action ceases and immediate predetermined actions
are taken at these critical operating parameter values in order to bring
equipment and process units to a safe state.
• Unacceptable or Unknown Operation Zone - An area beyond the Safe
Operating Limit (SOL). A process will not be intentionally operated in this zone.
• Examples of operating parameters might include:
• High or low pressure High and low level
• High and low temperature
• High and low pH
• High and low flow
Each SOL should be documented in plant Process Safety Information (PSI). Typically,
SOL information is presented in table layout and includes the following:
• Description of critical operating parameter that provides instrument tag name
• Minimum and / or maximum normal operating limits (i.e., pre-SOL alarm point)
and units of measure
• Minimum and / or maximum SOLs and units of measure
• Technical basis for SOL
2.1 Consequences of Deviation
Consequences of deviation are generally associated with SOLs. The consequence
would be the impact of fire, explosion, and loss of containment if immediate action
was not taken. For each SOL, there will be immediate actions required (manual or
automatic) to correct deviation within a predetermined time limit. This could be as
simple as an open bypass valve around the control valve to divert feed and shut
down the unit. Normally, the steps to correct are actions that operation personnel
perform. The actions can be taken by either the board operator or an outside
operator.
 3. PLANT SITING AND LAYOUT
• Siting and layout appear to be synonymous; however, they are slightly different. Siting is the
process of locating a complex, site, plant, or unit. Layout is the relative arrangement of equipment
or buildings within a given site.
• The arrangement of process units and buildings are crucial factors in the safety and economics of
a chemical plant. The plant layout (plot plan) should incorporate safety while providing access for
operations and maintenance. Some of the safety benefits of a good layout are:
• Minimization of:
Explosion damage, since explosion overpressure falls off rapidly with distance from the center of
the explosion
Thermal radiation damage, as the intensity of thermal radiation also falls off with the distance
• Easier access:
For emergency services, such as firefighting
To equipment for maintenance and inspection
• Efficient and safe construction
• Reduction of onsite and offsite personnel exposure to incident consequences
3.1 Site Layout
• Preliminary identification of various hazards during early planning stages of the project
will help establish proper layout at the beginning of the project and prevent design
rework later. Good layout can reduce the effects of some of the controllable factors,
such as liquid spills, and uncontrollable factors, such as exposure to natural hazards,
site slope, and wind direction and force, that contribute to losses.
• As a general guideline, the layout of the units is based on the flow principle so that the
material flow follows the process flow diagram. The goal is to minimize the transfer
of materials for both economic and safety reasons and allow a release to be
contained at its source. Plant layout is largely constrained by the need to observe
minimum safe separation distances.
• Design considerations for layout and spacing include:
A maximum block size limitation with adequate spacing between the blocks allows
access for firefighting
Adequate overhead and lateral clearance for pipeways, pipe racks to prevent possible
damage by large moving vehicles, cranes, and trucks
• Two methods exist for determining minimum separation distances within
chemical process plants. The first method is to use recommended
separation distances for generic plant hazards.
• The second method for determining minimum separation distances is
calculating the amount of heat received by an object from a fire involving
the actual hazards in question. While this method generally results in more
realistic separation distances, the calculations are often complex and should
only be performed by persons familiar with the concepts involved.
• In addition to radiant heat exposure, other factors which should be
considered in determining separation distances and plant layout include
topography, prevailing winds for normal and accidental vapor / gas releases,
liquid drainage paths for accidental liquid spills, location of fire protection
equipment, and accessibility for emergency vehicles. Specifically for toxics,
dispersion modeling can be used to assist in the location of buildings and the
need for shelter-in-place
3.2. Unit Layout
Unit layout is the arrangement of equipment within a particular block on the
site. Process units are usually grouped because they are generally more
hazardous than central services. The unit layout also depends on whether the
unit uses single- or multi-stream operation. Space for future expansion of
plant equipment or pipe work as well as access for installation is another
factor to consider. Large vessels and equipment needing frequent
maintenance or cleaning should be located close to unit boundaries for ease
of access by cranes. Plant items such as heat exchangers and reactors that
need removal of internals should be provided with necessary space and lifting
arrangements. An incident occurred in Texas City when a heat exchanger was
being lifted over a storage tank of toxic material. The heat exchanger fell,
resulting in a significant offsite release of toxic material
Some further considerations in unit layout are:
• Location of fired heaters in relation to units with flammable
materials.
• Separation of equipment that is a potential source of explosions,
such as chemical reactors, by blast-resistant walls, if increased
spacing is not practical.
• Location of pumps handling flammable material. These items are
frequent sources of releases and should not be grouped in one
single area. They should not be located under vessels, air-cooled
heat exchangers, or pipe racks.
• A model review (built or 3d CAD model) is generally conducted to
review the layout and spacing.
• The design should consider the effects of congestion and confinement on
the potential for aggravating an explosion event. To this end, it is
preferable to space equipment as far apart as possible and to avoid
confinement where possible (e.g., use grated decks rather than solids
decks).
• The greater spacing also improves access for emergency responders,
personnel trying to escape from a hazard, etc. - although greater spacing
also costs more in piping (and, in principle, provides more surface area
from which a leak could occur in the first place) and costs more in land.
• When determining unit layout, consideration should be given to potential
spacing needs during periodic and major shutdowns and turnarounds.
• Additional equipment laydown, staging, and cleaning are often needed to
reduce need for excessive movement of equipment and materials during
these periodic events.
3.3 Storage Layout
Layout of hazardous materials storage areas requires careful attention. Typically a far
larger quantity of material is held in storage than in process. Some of the important
aspects of storage layout are:
• Storage tanks should be arranged in groups so that common dike and firefighting
equipment can be used for each group.
• Keeping storage tanks away from process areas since a fire or explosion in a
process unit may endanger the large inventory of the storage tank.
• Storage tanks should be diked in accordance with NFPA 30 (REFER BOOK). Piping,
valves, and flanges should be kept to a minimum when located within dikes. Valves,
manifolds, and piping should be installed outside dikes or impounding areas.
• The effect of intensity of thermal radiation from an adjacent tank on fire should
be considered in spacing the tanks. Tolerance of tanks to thermal radiation can be
increased by insulating or fireproofing the tank shell and providing water cooling
arrangements.
• Secondary containment systems are considered passive protective
systems. They do not eliminate or prevent a spill or leak, but they
can significantly moderate the impact without the need for any active
device. Containment systems can actually be defeated by manual or
active design features. For example, a dike may have a drain valve to
remove rainwater, and the valve could leak or be left open
3.4 Occupied Building Location
Many of the fatalities and serious injuries resulting from process
safety incidents are caused not by direct consequences of the actual
incident but by damage to buildings where personnel work or
congregate (occupied buildings). Therefore placement of occupied
buildings within a facility is critical to minimizing the consequences
of an incident and the overall risk a facility presents to personnel.
4. MATERIALS OF CONSTRUCTION
Equipment service life is influenced by many factors, such as materials of construction,
design details, fabrication techniques, operating conditions, and inspection and maintenance
procedures. Material failures, while relatively infrequent, can be extremely severe, resulting
in catastrophic accidents. The best way to reduce the risk of material failure is to:
• Fully understand the internal process, the exterior environment, and failure modes
• Select materials for the intended application
• Apply proper fabrication techniques and controls
• Follow good maintenance, inspection, and repair techniques
Corrosion refers to the degradation or breakdown of materials due to chemical attack.
Corrosion is one of the most important process factors in material selection and yet the
most difficult to predict. In general, equipment service life can be predicted from well-
established general corrosion data for specific materials in specific environments.
However, localized corrosion is unpredictable, difficult to detect, and can greatly reduce
service life.
4.1 Properties of Materials
The basis for selection is performance under design conditions, that is, how the material will function in the
process environment, not only at standard operating conditions but also under startup, shutdown, and upset
conditions.
The behavior of a material in a process environment is determined by its physical, chemical, and mechanical
properties. These properties determine how the material will be affected by process chemicals as well as how
the material will affect the process.
Some properties and their effects are:
• Thermal expansion (especially differences in expansion of different components; e.g., vessel and cladding)
• Melting point or range (affects weldability, hot forming; e.g., hot-short cracks may become focal points for
corrosive attack and mechanical failure)
• Brittle fracture of carbon steel when exposed to low temperatures
• Acid / base resistance
• Resistance to solvents
• Susceptibility to various types of corrosion
Metals and alloys are often subjected to heat treatment to improve mechanical properties and corrosion
resistance or to bring about thermal stress relief. Heat treatment can be done before fabrication to get better
mechanical properties (e.g., increase ductility and impact strength) and corrosion resistance or done after cold /
hot work to reduce the residual stress.
4.2 Corrosive Environments
• If the range of process conditions is accurately specified by the process
engineer, the materials engineer can generally select suitable materials of
construction without additional testing. However, upsets and impurities, trace
elements, and contaminants are likely to cause most of the problems; therefore,
any potential contact with impurities, in all process fluids, ambient environment,
utilities, etc., and for all operating scenarios, should be identified to the materials
engineer.
• Both the external (ambient) and internal (process) conditions in contact with
materials need to be examined. The external environment, that is, the ambient
conditions in the plant, may be corrosive. Atmospheric pollutants include
corrosive species as well as those which may have adverse catalytic effects upon
other pollutants (e.g., coal dust). Contaminants in soil or groundwater as well as
naturally occurring variations in groundwater composition and pH should be
considered for equipment or pipelines in contact with the ground.
The internal environment is defined by the process, its chemistry, and its conditions. The process
engineer should provide the materials engineer with sufficient information about the process,
ambient conditions and utilities, for startup and shutdown as well as routine operations, to ensure
adequate selection, especially for corrosive service.
Preliminary materials selection is usually based on process conditions, such as:
• Process chemicals, including the major and minor constituents of each process stream, trace
contaminants, pH, and oxidizing or reducing agents and water content. For example, styrene will
leach copper, and thus materials in contact with styrene are generally specified to not contain
copper. Additionally, chlorine can lead to stress corrosion cracking in stainless steel.
• Operating conditions, including temperature, pressure, velocity, and solids content.
• Process variations, including operational excursions in process chemistry, temperature, or pressure;
excursions associated with startup or shutdown conditions. The order in which the conditions occur
can be important (e.g., purging / cleaning with steam may constitute a temperature excursion.
• Contaminants in feedstock, process intermediate, product, or utility. Contaminants introduced by
small or midsized internal leaks in heat exchanger tubes or other internals. Impact of contaminants
on gaskets and packing and seals.
• Catalysts: Metal ions in the material may affect either the chemistry of the process itself or the
product quality. For example, nickel is known to catalyze many synthesis reactions and its inclusion
can result in unwanted side reactions.
4.3 Pitfalls in Material Selection
• Process criteria often determine materials of construction for pressure vessels, heat
exchangers, valves, piping, pumps, tanks, and instrumentation. These requirements
should be adequately documented in complete equipment or instrument data sheets.
Fabrication and corrosion control techniques should also be specified.
• Specific types of process equipment have characteristic corrosion problems.
Bimetallic heat exchangers are frequently subject to electrolytic corrosion,
particularly where the two metals are in contact. Distillation or extraction columns
have corrosion problems associated with the presence of distinctly different
environments at different locations in the same vessel. Pumps, some piping
configurations, and valves are subject to a higher incidence of velocity effects
(erosion).
• If corrosion testing is performed to provide a basis for material selection or
fabrication techniques, the test conditions should be as close as possible to the actual
(design) service environment. Velocity of process fluids, for example, may be
overlooked, but it is just as important to test as composition, concentration,
temperature, pressure, and time factors.
• If operating or failure conditions differ from design conditions, the original
material selection might not be valid. Design bases should be fully and clearly
documented and communicated to the operators (through procedures, training,
etc.); inadequate documentation frequently causes confusion and can invalidate
any management of change procedure.
• Requirements may be imposed upon the manufacturer and the supplier to
ensure that the materials are accurately represented. A big problem is traceability
of materials. Manufacturers may be required to attest that the material is in
accordance with the material specification. Materials certification or a certificate
of conformance may be required to provide the paperwork certifying the
materials are as specified. If further work is done on the material, the
manufacturer may also have to provide a certified material test report, verifying
the quality of welding or other treatments. Some means of identification, for
example, lot number, weld number, or heat number, is required to trace the
material to the manufacturer. The ASME Boiler and Pressure Vessel Code
contains guidance on material segregation, traceability, and alloy verification.
 5. CORROSION
• Corrosion is chemical attack on a metal. Corrosion may occur at a uniform, predictable rate or
it may be localized, on the surface or as a subsurface phenomenon. The following discussion of
corrosion, although normally thought of in terms of the internal, i.e., process environment, also
applies to external surfaces of equipment and piping.
5.1 General Corrosion and Metallurgical Changes
General corrosion means the entire surface loses metal uniformly due to attack by chemical or
electrochemical reaction. Reaction with gases present in the process may cause oxidation,
sulfidation, reactions with halogens and hydrohalides, and various other types of corrosion. The
corrosion rate is predictable, based on previous experience and can be compensated for by adding
a corrosion allowance to the wall thickness of piping and equipment. For example, for carbon
steel 1/16 inch or more is added for typical project life. The National Board Inspection Code
provides an explanation and formula for determining corrosion allowance. Decarburization and
carburization are other metallurgical changes, although there is no metal loss or surface change.
5.2 Stress-Related Corrosion
5.2.1 Stress Corrosion Cracking
Every alloy is subject to Stress Corrosion Cracking (SCC) in some environment; however, chloride
stress corrosion cracking is commonly associated with stainless steel. The majority of SCC problems
are associated with stainless steels and aqueous chloride salts, but both sulfide and chloride stress
cracking are common in the process industry. It occurs when material has been under tensile stress
in an environment containing sulfide compounds or chloride salts for a period of time. For example,
salt water, brackish water, and chlorinated city water have chlorides and, in most cases, are not
compatible with stainless steel.
5.2.2 Corrosion Fatigue
Corrosion fatigue can be defined as a combination of normal fatigue and corrosion that causes
failure at stress levels far below the design endurance limit of the metal involved. Corrosion fatigue
resistance is remarkably decreased by an increase in the stress cycle frequency, even in the low
frequency ranges. Compressive stresses will not cause corrosion fatigue.
Corrosion fatigue is influenced by:
• Environmental factors, such as temperature, pH, oxygen content, and composition of process fluids
• Mechanical factors, such as vibration
6. CIVIL / STRUCTURAL / SUPPORT DESIGN
6.1 Site Preparation and Analysis
Preparation of the site, governed by plot plans and grading and paving drawings, will
establish the safe placement of the plant, provide for drainage and runoff containment, and
define environmental considerations to be addressed.
6.1 Geotechnical Studies: Geotechnical investigations will establish excavation
requirements, types of foundations required, and site drainage requirements. Any existing
hazardous conditions discovered during site selection, such as contaminated soil, buried
waste pits, etc., should be addressed in accordance with environmental regulations.
6.2 Surface Drainage: There are two key process safety considerations with respect to
surface drainage. One is the potential for hazardous flammable, explosive, or toxic
materials to enter the normal surface water drainage and collection system; another is
adequate collection, treatment, and disposal of firefighting water. Each facility should
have a well-drained working surface and a drainage system to carry off storm water
and / or spills to a holding area or treatment facility. Local, state, and federal regulations
should be consulted to determine drainage or treatment required.
7. Thermal Insulation
Insulation may be applied to a surface to perform one or more functions, such as
temperature control (heat conservation or freeze protection), personnel protection,
condensation prevention, or sound attenuation. The major process safety issues related
to thermal insulation are:
• Fire exposure protection of equipment and piping Corrosion under wet
insulation
• Spontaneous ignition of insulation wet with flammable or combustible liquids
7.1 Properties of Thermal Insulation
Thermal Performance Insulation is used to prevent heat loss or gain for process control
and it is often necessary for the protected process system to function properly. For
example, if a process fluid condenses or freezes or vaporizes in a line, a hazardous
condition may exist, such as overpressurization, loss of process control, or runaway
reaction.
7.2 Absorption of Liquids: Absorption of moisture or process liquids can lead to a
hazardous condition, such as lowered thermal performance, corrosion under wet
insulation, or a fire if the absorbed liquid is flammable or combustible. Thermal
performance is impaired when the insulation material is wet. Moisture can enter
insulation material through a break in the weather barrier, by a leak in steam trace
tubing, or by a process leak in the insulated system. When the air spaces in insulation
become filled with water or other liquid, the insulation's conductivity approaches that of
the liquid.
7.3 Fire Safety
Fire safety is related to three major properties of insulation: Combustibility of the
insulation itself
• Combustibility of absorbed liquids
• Integrity during fire
For maximum safety, insulation should be non-combustible, non-absorptive, non-
melting, and well maintained throughout the life of the facility. Insulation materials that
increase the facility's combustibility should be avoided.
7.4 Selection of Insulation Materials
Insulation systems (including jacket, banding, and supports) commonly
installed on piping and equipment for reactive chemical service for the
purpose of fire protection should incorporate the following features:
• A non-combustible inorganic insulation material such as calcium silicate
or cellular glass
• Double-layer construction with all joints staggered
• High melting point jacketing
• Well-secured jacketing, typically by stainless steel bands
8. Human Factors in Design
8.1 Appropriate consideration and implementation of human factors in
process design will improve process safety by:
• Making the process and its intended operation easier to understand
• Making procedures clearer and easier for operators to do what is
intended
• Limiting potential deviations from intended operations
New facilities should be reviewed for ergonomics and human factors issues
during design, construction, and startup. Existing facilities should be
reviewed periodically for opportunities to improve human factors in an
inherently safer way, including through process hazards analyses. Such
reviews are usually performed both periodically for an entire process as
well as for significant modifications.