.

~
1

:;:::
~-------

r'

..
...

-------

:
l
.

_ .._,--------- ,_..,--_.

-_. --

SAFETY
--'~~~-.-- ~~~A~$PEC T SO F--.. . . . . -~.
MAINTENANCE
I:

_ ...

__ ..

,;

;~

,
J
;

~.-

"

,I .
L,

,I'
L

r
!

,
i
,!
i
SffETY ASPECTS OF NAINTENANCE
by
.-.~
.. _-- -._--.
!
Dr. H. Farabi
Depdrtment of Chemical Engineering
The! University of the West Indies
st. Augustine
- ---._-

"--'-

A sound, efficient maintenance programme is essential in any

industrial establ ishment.
Such a programme will keep the physical
,
i
--.. . - . - - - -- ---.plant in good conditior and will reflect favourably in the safety record.
Too often maintebance is thougllt to mean only repair. Considerable
I
emphasis should also be placed on preventive maintenance and on the
type of inspection tha~ will discover conditions pertaining to tile
building or eqUipment ~hich, if uncorrected, might resuJt in accidents.
The need for maihtenance on a plant implies some abnormality
j
and often some increast in hazard. The ~onduct of the maintenance
. . "j
~ . ~ work may-a Iso-i-ntrodUc ~i ts-own haz<1nls to the plant .~-=Tn:'aildTtjJj'n; - - --~::,,:,:,~~:._-_ _

r
the. maintenance act illi i,es may .bea,. hazard foCtile personnel
~

illvo I vecC::-'=:"'--:'-:- -

in them.
It is necessary,~therefore, to exercise careful control of
maintenance work in order to eliminate hazards to the plant and to
j
the personnel.
,

.r

Some work constItutes modification'rather tllan maintenance.

The integl~ity of the plant may be degraded by plant modifications ,unless
they al-e closely controlled. Thus both plant maintenance and plant"
modification require systems of control witll a fairly
high degree of
,
formality. Plant maintenance needs to be administered through some
kind of permit system, 'jlWhile plant modification requires a system which
identifies, checks and records modifications.

PREPARATION FOR NAINTENANCE

Identification of plantl
I

Nany incidents o~cur on process plants due to errors in the

identification of the ~quipment on which work is required. Plants
1

i
I

- 2 -

,.

can seem a confusing maze of vessels and pipework, much of it lagged,

andit is oftendiff~cult toident~.f:y-equ.i.pmenL-uri.ajded.s.i.mply.by tracing
the course of pipework or by the use ~f other clu~s.
It is necessary, therefore, to adopt a

mOi-e

positive policy

the identification of equipment.

One method which may be used is to attach a permanent identification
to.a particular equipment.
Identification should be consistent and should accord with reasonable expectations. Another method of identification; therefore, is
the identification tag. This is particularly useful for joints, but
is applicable to other equipments also instead ofiPermanent identification.
The ideritification of the equipment, permanent or ,temporary, should
be given on the permit form .
. __Lsolatio.nof plant

----~~-

I.

~-

-~-

-- - - --.

Another fertile source of. inc i dentsi s . i nadequ ate_iSQJ,;.tjonof .

equipment on which maintenance is to be carried out. It is essential
for there to be positive isolation both with respect to process materials
and to moving parts.
Isolation from process fluids is sometimes c'arried out by closing
an i,solation valve on a line, .but thisis.not .a.completely effective
method of isolation. There have been numerous inc~~ents in which'either
the valve has been opened in error or the valve has corroded or jammed
and has passed fluid. It is necessary, therefore, to effect more positive
isolation.
Equipment such as a pump or an agitator should be isolated by
locking off the starter and/or removing the. fuse."_.A notice. should
be hung on the starter prohibiting startup of the device.
Other preparatory measures
After the plant section has been isolated ani:! before maintenance

r---

I,

- 3 -

work is done the section should be vented to release pressure, drained,

and, if necessary, cleaned and/or purged.
Venting is norma11y to atmosphere at a safe place or into gas
absorption equipment. Liquid is drained into a container or, if the
liquid is expendable and it is safe to do so, into the works drain.
In this latter case the drain should then be flushed with water. Cleaning/purging is by air, inert gas, steam or water, as appropriate.
CONTROL OF MAINTENANCE
Permit systems
Maintenance and modification of process plant involves many
potential hazards and it is essential that this work be controlled
bya formal system of permits -to-work.
The object of the permit system is to control the conduct of
the maintenance activities- by specifying the work to bedone,-bjldeTinirigthe responsibilities of individuals, by eliminating hazards or protecting
against them, and by ensuring appropriate inspection and testing.
Types of permit
Permits-to-work- have a variety of names: clearance cer~ificaes,
fire permits, etc.
Permits may be classified by reference to the operation to be
performed, the equipment to be worked on, the classification of the
area where the work is to be done, the special hazards which may be
encountered, the equipment to be used or the tim\,! ..of day specified
for the work. A list of typical permits, which illustrates all these
categories, is as follows:
Operations
line breaking
vessel entry
hot work

- 4 .-

waste disposal
equipment removal
excavation

.-

---.-------~~--

.'-'-"'-.-"--~"--

----------

-----

----------------

- - - - - - - - - --------- _.-

Equipment worked on
electrical equipment
sprinkler system
Area classification
flammable area
Special hazards
fire
corrosive substances
toxic substances
Equipment used
.-mobile crane
--Time of day
after hours work

-=f:

Contents of permit
A typical permit-to-work, in this case a clearance certificate,
is shown in Figure 1.
Some important features of a permit and its use are as follows.
The section of plcint and the item of equipment on which work is to
done should be specified. The equipment may be idehtified by an
identification tag and this should be cross-referenced on the permit.
The nature of the work to be done should be clearly described. There
should be a certificate that it is safe to proceed- with the work.
This certification means that the possible hazards have been considered.
The precautions already taken, such as isolation of pipes and of moving
machinery, should be stated and so should those still to be taken,
such as use of breathing apparatus. The period of validity of the

<.

- 5 -

certificate sllould be shown and cross-references given to other related

certificates. The permit should be signed before the work is handed
over by the issuing authority and by the recipient and preferably by
all tile individuals in~olved in the work. When the work is handed
back, the permit should again be signed by these two parties.
Types of perm it sys tem
The permit syst~m for a given job may be either a one~ or a twostage system. In the ~ingle-stage system there is one permit normally
issued by tile operations supervisor to the ~aintenance supervisor ..
In the two-stage system there is a furt~er permit which is issued
by the maintenance supervisor to the members of his workforce who are
to do tile job.
-An-otller differen-ce of practice in Hepersonnelwhci- are- autllorizedto issue or accept a pen~it-to-w(jrk. Typically these are the -operations
and maintenance supervisors. In some firms, however, certain permits
are issued by the s~fety officer.
In a particular permit system a given job may require more than
one document. There may well be other certificates which are necessary
before tile main permit .an be issued. A test certificate for analysis
of the working atmosphere is a common example.
Tile job may be subdivided and separate permits issued for each
subdivision.
Some types of permit relate to higher levels of hazard than others
so that there is a hierarchy of permits. Thus t.he lowest level of
permit may be a clearari.ce certificate, followed by a safety certificate
and finally a fire certificate.
Operation of permit systems
There are many practical problems in the operation of a permit

- G ~.--.---

.. - - - - - - - -

system.
It is a principal object of such a system to: define the
responsibilities of all conce~ned. The exact division of responsibility

--r
I

between operations and maintenance supervisors, for example, may vary

according to circumstances. It should be absolutely clear, however,
in a given case where the responsibility lies.
The norm is that the operations supervisor. is the issuing authority
and the maintenance supervisor is the accepting authority. It is the
responsibility of the former to ensure that the plant is safe for the
work to proceed. The latter is responsible for ensuring that the further
working precautions are taken. In certain cases, such as maintenance
work on switchgear, the operations supervisor is not competent to give
clearance so that the maintenance supervisor has gceater degree of
responsibility than usual.
-Another-object of a permit-systemis to ensure that--thepe-oj3le-who actuall~ have todD the job understand what is ~nvolved. Iti:;
very desirable, therefore, for the maintenance men to read the permit.
This is not easy to achieve, since the general content of permits rapidly
becomes famil iar. In some systems there is a requirement that the
men countersign the permit. The device of affixing the permit in a
plastic case to the equipment to be worked on is al~o used.
.

~.

It not infrequently happens that there is a change of intention

while the job is being done. An example is a change from work on pump
bearings which does not involve breaking into the process lines to
other work which does. If such a change of intention occurs, a separate
permit should be issued.
The area affected by the
Work at a particular plant may
plants. It may be appropriate
the supervisor on such a plant

r-

[
l.

work should be considered carefully.

affect or may be affected by adjacent
in certain defined cases to require
to countersign the permit.

/
,.
"

//.t' . .

'1~
I

------~.

-----

------------- -

- 7 -

Tilere must also be clear arrangements for the discharge of permits.

Tile system should normally be that the permit is signed off only by
,
the maintel]_ancesupervisor to whom it is issued or by ahother supervisor
of the same trade and responsible for the same area of plant and that
a fresh permit is issued each time work is resumed. Lack of cl arity
canr_e.sult in_b_rea_k_dow_n __ of the permit arrangements, as the following
case illustrates. A maintenance fitter left a job unfinished overnight,
intending to resume it, next day. The job was signed off, however,
by another of the maintenance personnel. When the original fitter
began work next day, the plant was no longer safe for work.
Audit of permit systems
is not
enough to create a permit system to control maintenance
-----., -___-"'yrk:-.:_::T_her-eshould also-be arrangements for the audit of the system
--to-ensore-that--H--is-operating properly. These may consist of a speci-fic
instruction to the plant manager to check each week a prbportion of
the permits issued.
It

---- --

MAINTENANCE ACTIVITIES
Emptying, purging and cleaning
Much maintenance , work requires the prior removal of process
materials from vessels and pipes. Frequently these materials are
corrosive, toxic and/or flamrnable.
The normal procedure for emptying a vessel or pipe_ is to isolate
it, to vent to release the pressure and then to draw off tile contents.
It is then-frequently necessary to remove-t~aces of process rnaterial
from the inside of the vessel or pipe. This may be done to render
tile equipment safe for'welding or to allow people to work inside.
When welding has to be done, the removal of process material
should be rather thoro~gh .. Some materials form residues wllich are
very difficult to shift and which can adhere to the sides and. roofs

- 11 -

as well as the bottoms of tanks. These residues can give off flammable
vapours at the high temperatures used in welding.
There are various methods which may be used to remove traces
of process materials from equipment. These include steaming out,
mechanical washing and hand cleaning.
Washing with cold water or purging with air are not effective
methods of removing oil. Reliance on these method~ has been the cause
of many accidents.
The problems of preparing equipment for maint,enance work have
already been -considered in relation to vessel entr~ and are considered
further below in connection with line breaking and demolition.

When it is necessary for the atmosphere in an) equipment to be

free of flammable or toxic materials, this should bee checked positively
by chemical analysis by a competent person. If the: work is prolonged,
';
-repeat- checks should be made.
--- ---Breaking of pipelines

f
[

/-:

Breaking into a pipel ine can invol ve a number! of hazards and

it is necessary to exercise considerable care.
For the breaking of a pipeline there should be clear instructions
on the work and on the area in which it is to be dOne. Information
should be given on the material in the line and its;hazards, and on
precautions to be taken.- The joint to be broken should b~ indicated
by an identification tag. The \~ork is normally covered by a permitto-work.
Some preliminary measures and precautions include
isolation of the working area and posting of warning notices;
_provision of safe access;
support of the pipe on either side of the joint;
isolation of the pipe section;
release of pressure from the pipe section;

I,,:.-.

rb

--'.-

..

-- .-:~----------;--

- 9 -

---

draining ofth-epipe--sectTon anilliilfftning-of the fluid drained;

precautions against fire;
protection of personnel.
- ...

- -,.

-'

-- -

------_.

-----_._- _.

~-.---

.. -.

- ..

The joint to be broken should be isolated. Pumps or other devices

which could put the joint under pressure should be switched off. Measures
should be taken to release the pressure_2n the 1 ine.
It should be assumed, however, that the pipe may be full and
under pressure, and precautions should be taken accordingly. In
particular, it may be necessary.to use protective hoods or equivalent
equipment.
Some joints are difficult to break and thus constitute a potential
hazard. A persistently troublesome joint should be reported by the
maintenance men. - An ai ertsupervi sor-will recogn i ze such a joint as
--~a probi em.---:- - ----~-

------

The-pTpewbrk designer -also ha,-a-cDntribution-to make by building

into the design enough 'spring' to facilitate the breaking of joints
which must be broken frequently. Alternatively, a slip ring may be
installed.
After breaking, a pipe is sometimes found to be choked. The
blockage may be removed by means such as digging it out. But it should
not be cleared by using air or gas pressure. The danger IJere is that
the plug of material will be ejected as a projectile.
The ends of pipes on the installation should be blanked off.
Tank repair and demolition
The repair and demolition of tanks is another operation which
has given rise to a number of accidents and requires careful precautions.
The principal hazard is fore/explosion of the flammable material
ignited by operations such as welding or cutting. This hazard is usually
well understood with volatile liquids, but it is not always appreciated

<

- 10 --------

that it exists with relatively involatile liquids and residues also.

Residues can contain considerable amounts of volatile material which
constitute a fire hazard.

r
i

The main risk is that residues catch fire, volatile material

is evolved and a more serious fire/explosion occurs. Heat from the
cutting torches alone is generally not enough to vaporize sufficient
material to create a vapour explosion risk, but it does provide a source
of ignition for the initial residue fire.
Residues are not confined to tank bottoms, but occur also on
walls and roofs. If the inside of a tank is covered with a thin film
of flammable material, a film fire can occur which can result in a
serious fire/explosion.
In certain cases volatile materials which can polymerize may
. -1 eave so 1i d po lymer res i dues on the upper wa 11 s or the roof. Such
-------mater-ia-lsare. usua11yprotected against polymerization in the-liquid
phase by inhibitors, but this does not stop polymerization in the vapour
phase.
Hot work and welding
The principal hazard of hot work, including welding, is that
it introduces a source of ignition.
There are some plant areas where such an igoition source is not
normally allowed. In these areas special precautions and formal
procedures are necessary for hot work.
It is essential, therefore, for equipment to- be worked on to

be clearly identified and to be isolated, emptied and cleaned, tested

for flammables and inspected.
It may also be necessary to protect neighbouring equipment by
some means such as shielding.
In certain circumstances it is desirable to assign a fire watch

l .

- 11 -

to monitor any fire which may start as a-resuH-o-f this work~--such

as smouldering material.
Further aspects of welding are considered below In relation to
hot tapping.
Eguipment removal
The removal of equipment from the plant to the workshop can create
a hazard i f flammable or toxic material may be trapped inside it.
It is necessary to have some procedure to deal with this problem.
Equipment which is installed but is no longer required should
normally be removed. This applies to all kinds of equipment whether
it be vessels, pumps, pipes, instruments, fuses, etc. Unused and often
disconnected equipment _is a fertile source of accidents_;
MAINTENANCE EQUIPMENT
Tools
Tools such as hammers and spanners have been con-sidered a possible
source of igriition and non-sparking tools have been developed.
Materials used in such tools are typically aluminium, bronze
or monel for tools that have to withstand impact or torque such as
hammers, spanners, and crowbars; copper-beryll ium alloy for tools
requiring a cutting edge or gripping teeth such as knives, chisels,
saws, drills, pliers and shears; and plastics, leather, fibre and wood
for shovel and scraper tools.
These tools have a number of disadvantages. _ Generally, they
are more expensive fand they are softer and tend to burr. Moreover,
particles can more easily become embedded in them, thus reducing their
non-sparking qualities.
The API has issued a number of reports over a period of years
on non-sparking tools (e.g. API 1973 Item 23). The general conclusion

- 12 -

is that such tools have limited value. It was considered that an

incendive spark -of -s-teel would be unlikely to be produced manually
and that power Dperation would be needed. Possible exceptions are
atmosphei-es fl ammab 1e due to the presence of hydrogen ~ acetylene, ethylene

or carbon disulphide.--Thus instead of using all types of non-sparking tool in flammable

areas a more limited use may be preferred. One policy is to restrict
their application to the use of non-sparking hammers (though not spanners)
for the hardening up of leaking .joints on lines containing the above
four gases.
Lifting equipment
Lifting equipment has been the cause of numerous accidents.
There are statutory requirements, therefore, for the registration and
regu lar inspection _of _equ.Jpm~-rifsuch as ch_ai ns , s lings and ropes.
These'ar-'e--gTvenJnthe FactorleS J\ct1961 :--10 X.};
Only this properly registered and inspected equipment should
be used for lifting.
In process plant work incidents sometimes occur in which a lifting
lug gives way: This may be due to causes such as incorrect design
or previous.overstressing.
Mobile cranes
Mobile cranes present several different types of hazard. One
is the danger of collision with process plant, pa~ticularly pipebridges,
when the crane is on the move. A minimum measure to prevent this is
clear identification of pipebridges, but it may be advisable to resort
to more positive protection, such as a crossbeam in front of the pipebridge which obliges the crane driver to lower the jib.
Another type of hazard is the overturning of the crane on to

r'-j

i :

r'
f

l
L

- 13 -

process plant. For a given crane there- is a maximum safe load and
maximum safe jib radius. There is normally a safe load indicator,
but nothing to indicate the safe jib radius. If this latter is exceeded,
the jib itself constitutes the main load and a small additional load
may be enough to topp 1e the crane.
It is important for crane drivers to be well trained in the
operation and limitations of their cranes and in the special hazards
of process plants.
A rather less obvious hazard in cranes hired from outside
contractors is the use of cab heaters which are not sui~able for flammable
areas. A heater is needed, but it should be of an appropriate type.
Forklift trucks
- It-i s-conven i en-t--to-note-here the- Iliizards ass-o-clatedwj th:TorkJjJ~t_._-~~~_
trucks. IncidEnts _ar.e numerous in which for~li_ft trucks are driven
into and damage buildings and plant, including process plant. Pipework
is particularly at risk.
It is desirable, therefore, to review the routes which are used
by forklift trucks and to consider whether there is a need for special
protection of vulnerable features such as pipebridges and for special
training for drivers.
SOME MAINTENANCE PROBLEMS
Materials identification
Misidentification of materials is a significant problem. Materials
errors may occur in maintenance ~Iork. Situations in which they are
particularly likely are those where the materials look alike; e.g.
low alloy steel and mild steel or stainless steel and aluminium painted
mild steel.
It is necessary, therefore, to exercise careful control of

- 14
~--

~---~---------

materials. Methods of reducing errors include marking, segregation

and instrument Sj:lOt checks. Component identification
Thus confusion can easily arise, for example, over pressure relief
valve components, with the result that a relief valve may be put back
on the plant with too high a setting. This type of error can readily
occur with similar components made by the same manufacturer.

Similarly, it is easy for slip plates to become mix~d up so that

a slip plate suitable only for a low pressure duty is used on a high
pressure application.
A particular type of component identification error is fitting
an equipment with a component which alters its performance. Thus the
capacity of a control valve may be increased by putting 51la_wr.ong
trim,- or the de l-iver;y--pressur.e of..ci -pump ma:y_ . .b:e_Jot.t:ea.s.e...d-=_bY..::.ftttiOg_-:-::-.:..__... __ __ _"['
.~ wrong impeller.
~,-j

t::-"

There is need, therefore, for systems of control for such critical

l:.

items.
External corrosion
External corrosion beneath lagging is a considerable problem
on process plant. It is important that the maintenance system should
check on external corrosion.

L-.l

Such corrosion occurs particularly on steel equipment in the

temperature range 0-125 0 C. Below OOC the surface is protected by ice,
while over 125 0 C water evaporates. Use of types of mineral wool
insulation which are acidic can exacerbate the problem.
There are various forms of corrosion which can occur due to agents
other than water. Chloride attack occurs from chlorides which are
leached out of some insulation materials. It can also arise from thermal

-.

- 15 -

decomposition of PVC labels on very hot pipe surfaces. Nitrate attack

arises from the use of nitrite treated water on plant surfaces.
Supports for storage tanks and vessels are a common site of external
corrosion.
Pumps and other eguipments
Pumps are the source of a large proportion of leaks and fires
on process plant. A common fault is seal failure with resultant leakage.
The leakage often ignites and causes a pump fire. Another frequent
fault is bearing failure, which can induce a seal failure. After a
pump fire it is' not always easy to tell whether the seal or bearing
lIas failed first.
Reduction of pump failures is partly a matter of design and
... ~s~l.ect io.n, but maintenance -aspects- are -a 1so important. Many fau--lts
_. --can be forestalled by a careful overall check when a pump is taken
off for other maintenance work.

--

In addition it is not uncommon for faults to be introduced in

the course of' maintenance work. A simple example is misalignment of
the impeller shaft when the pump is reassembled.
Faults of this kind point to the need for proper systems of work
maintenance and for adequate training.
.

~-.

Similar problems arise with other types of equipment .

Small bore connections
Small bore connections are another source of-leaks and fires .
. Such connections are often abused. Heavy pressure gauges or valves
may be fitted to them without adequate support. They are frequently
overtightened, sometimes with a pipe wrench. People stand on them
to reach isolation valves.

- 16 -

MODIFICATIONS TO THE PLANT

r

Some engineering work on plant goes beyond mere maintenance and

constitutes modification. Such modification involves a change in the
.plant and/or process and can introduce a hazard.

The outstanding example of this is the Flixborough disaster.

The Flixborough Report (Parker, 1975, para, 209) states: 'The disaster
was caused by the i ntroduct i on into a we 11 des i gned and cons tructed ---plant of a modification which destroyed its integrity.'

t .'

It. is essential, therefore, for there to be a system of identifying

and controlling modifications.

,.
,I

Modifications may be made to the plant or the process or both.

Types of modification
Modi fi cat.i onsmay _be_ctassjned~cc_ordjngtQ..J:tJe.:.st,,:g~ofJ:ll.E!.......:- ------ -project at which they are made:

~-~~---I:

(1)
(2)
(3)

r'!

design modifications;
commissioning modifications;
operating modifications.

II:-: l

They may be. distinguished by the degree of permanency:

(1)
(2)

temporary modifications;
permanent modifications.

And they may be classed by the level at which expenditure decisions

are made:
(1)
(2)

non-sanction modifications;
sanction modifications.

'These different situations tend to have their own characteristic

hazards.
Modifications made during the design process really fall outside
the present discussion, which is mainly concerned with the stages of

-1,
I

..

.
-~;----

- 17 -

commissioning and operation. It is sufficient here to re-emphasize

the points already made concerning the need to ensure that at the design
st<lge there is an adequate system of identifying and keeping track
of any modification made.
The commissioning stage, and the immediately preceding precommissioning stage, is often a period when large numbers of modifications
are made, frequently under intense pressure.
Commissioning modifications tend to be aimed at making. the plant
work. In the operations stage the object is rather to ke'e'p the plant
going. But again they may be done under considerable stress.
The scale of modifications and the level at which expenditure
for them is sanctioned vary greatly. At one extreme there are minor
.modiJLca.tions whichrequire no special sanction. Until fairly recently
--the sole documentationon"slJch modifications has been w6~kshop job'-""
ti ckets' or'permi ts-to-work. At the other end of the scale are
modifications requiring expenditure sanction by senior management.
Such sanction requirements 'have traditionally been imposed to control
costs rather .than ensure safety, but they do at least usually result
in detailed consideration of the proposal by experienced personnel.
Pressure releif and blowdown hazards
A hazard which is liable to arise as a result of modifications
and one which is particularly dangerous is the invalidation of the
arrangements for pressure relief and blowdown.
Some illustrations of the ways in which this can occur have been
given by Hend~rson and Kletz (1976) and are show~ in Figure z.
The situations are self-explanatory.
Another type of modification is the derating of a plant to a
lower operating pressure. In this case, while the need to alter the
pressure relief valve setting is usually appreciated, it is sometimes
/
/ .... /.1

~ '''f

- 18 -

k:.

forgotten that it is necessary also to check the relief valve capacity,

which is reduced by the derating.
Similarly, an increase

i~

,.
,.

. I

if i..Y'P
a change
plant throughput me,) rp-n
. -,-

in pressure.relief valve capacity.

The ease with which hazards associated with pressure relief can
arise means that the check that the modification has not invalidated
the pressure relief arrangements is particulariy import~nt.
Other hazards of modifications
Modifications can invalidate not only pressure relief but also
instrument systems. In particular, a situation may be created where
an important measurement signal is degraded by the interposition of
a restriction filter, etc.
A commonrnOd i fi. ca ti on i s . .:tp.e temp~l"~ rjlJ.eplacelllent or bypas ~1 flg_______.. _
of a unit such as a reactor or heat exchanger with a length of pipe.
This appears to be a simple matter, but it is still
necessary
to design
.
.
the pipe properly and to provide proper supports. The hazard is shown
by the Flixborough disaster.
Alt~ration.

of a device which in some way limits flow or pressure

can create a hazard. Examples include the removal of a restrictor
oriftce inst~lled specifically to restrict flow, increase in the size
of a valve trim or installation of a pump impeller capable of a greater.
head.
Modifications which appear quite minor can nevertheless introduce
hazards.
Other hazards are listed in tile form for the-control of
modifications shown in Figure 3.

....

;
t, -,

- 19 -

---------

. __ .. _--

.--.~-------~--"-

.. - - - - - - - - -

Modifications to the process

The lesson commonly drawn from the Flixborough disaster is the
importance of maintaining the integrity of the plant and of-avoiding
degradation due to a plant modification.
The plant can also be put at risk, however, by operation of the
process ou-tside-fhe-en-velope of operatingconditionsT6rwhich the-pressure system is designed. It is essential, therefore,"
, to control
such process modifications as well.
"

Moreover, even if "the envelope of operating conditions remains

the same, cilanges in operating practice may affect featurei such as
inspection and proof test intervals, which tend to be base'd on historical
plant experience.

CONTROL OF MODIFICArIONS
The elements of a system for control of plant modification are
. (1) procedures, (2) assessment, (3) inspection, (4) documef1tation,
and (5) training.
There shou.ld be a formal procedure which requires all modifications
to be author,ized by competent persons and a standard method of making
the safety assessment; there should be a system of inspection of
modifications by a competent person to make sure the work h~~ been
done as intended and is complete; there should be a system of documentation to record the change; and there should be adequ~te training
so that all personnel concerned understand the system of control.
Authority for modification
Systems for the control of modifications and the levels at which
particular types of modification can be authorized vary somewhat, but
the basic principles are quite clear. There should be a well defined
and understood system of authorization.

<

- 20 -

!, -The system, is that any modification to a plant or process must

be authorized in writing by a competent manager and engineer. This
applied to any modification, however cheap and temporary, as well as
permanent modifications. The level of authorization is uSllally the
lowest level of technical executive management, i.e. plant manager
and plant engineer. If the modification involves instruments or electrical
equipment, an instrument or electrical equipment, an instrument or
electrical engineer should also approve the modification.
It is essential that these work personnel be capable of recognizing
problems which lie outside their sphere of competence and be willing
to consult other experts. In effect, they should adopt the approach
of the general practitioner in the medical field.
Major sanction modifications are designed in the usual way by
the design departments.
Design authority

---------------- r

Some modifi~ations require to be checked or completely designed

by an appropriate design authority.

There is a problem area here. Many plants are designed and built
by outside contractors, who initially have the greatest expertise about
the plant but also eventually lose touch with it. -

[
L

There is, therfore, typically a transfer of expertise to a design

authority within -the operating company and often within a particular
works.

Identification of modifications

The identification of modifications is a cru~ial problem. There

is usually a large amount of maintenance work. It is necessary but
not always easy to identify items which in fact constitute
modifications.

- 21 -

This requires til at a modification be defined. Tile following

two-part definition is given by Henderson and Kletz:
'(1) Any change in the equipment, temporary or permanent, .which
may affect the safety of the process or safety and integrity of the
plant. It does not include changes in engineering equipment which
are not in contact with the process and cannot affect the safety of
the process or the safety and integrity of the plant.
(2) Any change in process materials, services, operating conditions,
or operating procedures, and including experimental programmes, which
fall outside established practice.'
Tile first part of this definition covers those equipment changes
which are normally understood as plant modifications. The second part
brings in also the process modifications.
I r\1:he"sys tem oescri bed
by-theseauthors--it--isc-the-respons
i bi I ..ity----------.
-. --_..
of the plant manager and plant engineer toidenUfy.mo,difications.
-

~---

Critique of modifications
Modifications proposed are not always necessary. Sometimes the
proposal is a symptom of a problem which is better dealt with in some
other way.
It is appropriate, therefore, tllat a proposed modification should
be considered critically. Questions which may be asked concerning
it are: Is it necessary? Is it economic? Is there a better alternative?
Procedure for modifications
Before authorizing a modification particular attention should
be paid to ensuring that
'(1) The number and size of relief valves required are not changed
(or any necessary changes are specified).
(2) The electrical area classification is not changed (or any

<

- 22 -

,r-

necessary changes to the electrical equipment are specified).

There are no effects on tri ps or a I arms (or any necessary
changes are specified).
14) There are no other effects which might reduce the standard
of safety.
(5) The appropriate engineering standards are followed.
(6) The right materials of construction and,fabrication standards
are used.
(7) Existing equipment is not subjected to conditions beyond
the design basis without checking that it can withstand the 'new conditions ..
(8) Any necessary changes in operating conditions are made.
(9) Adequate instruction and training are provided to operating
and maintenance teams.'

nr--

I
r

f'
I

~", :.;,

g:~

--- Safety assessment of modifications

These procedures need to be supplemented by a system (or -the
identifi~ati~n of h~zards in-the modification.
The method described by Henderson and Kletz makes use of the
safety assessment form shown in Figure 3. The form is best completed
not by a single individual but by two or three people working together.
The top half of the form provides check words which form the basis
for a hazard- and operabil ity study and the bottom half a more conventional
checkl ist.
It is found helpful in making the safety assessment.to assume
that, until it is shown otherwise, any isolation valve or other restriction will isolate an equipment from its protective ..device, e.g. a vessel
from its relief valve, and that any new line will introduce some unwanted
contamination, overpressure of some equipment or more flow into some
equipment than its outlet pipes can handle.
This procedure, therefore, makes use of a standard form to initiate
a safety assessment which goes beyond the use of a checklist.

r
r-'

!
,

- 23 -

Inspection of modifications
is the responsibility of the person authorizing a modification
to carry out a pre-commissioning inspection of that modific.ation _and __
to satisfy himself that it is in accordance with the design intent,that the standards for design, construction and testing have been followed,
that the _provisions of the safety assessment~ave been met and that
the work is complete.
It

Documentation on modifications
It is essential that plant documentation be kept up to date and
therefore that any modification be recorded. This requirement may
be met by the use of a formal register of modifications.
-If the modification requires-alterations to operatingor-inspe~tion---pract ices ;-i-j;--=i-s-necessari-that- the -appr':-opriate--ha-ng-es -be-made-in
-------tile documentation covering these asp_ects.
Training on modification systems
A system for the control of modifications can only work if-all
the personnel involved are aware of and have an -understanding of the
system through training.
The process operator who may turn off an agitator the maintenance
fitter 11ho may blank off a vent, the instrument artificer who may al ter
a trip setting, need to be a\1are of the hazards which these types of
modification may involve and of the system of control of modifications.
The plant managers and engineers who authorize modifications
need to have the theoretical knowledge, general 'practical experience
and experience of the particular process and plant to recognize potential
hazards, and also to appreciate situations where they should call in
expert assistance.

./

<
-'"

- 24 -

Commissioning modifications
The commissioning stage tends to involve numerous modifications
at a time when the plant manager and plant edgineer are heavily loaded .
.It may be appropriate, therefore, to appoint special personnel to check
these modifications. People who have been involved in hazard
identification during the design stage may well be suitable for this
task.
It is also advisable to conduct a post-commissioning check of
the pressure relief and blowdown arrangements about a year after startup.

'

ii

Variations in modification control

The system for control of modifications just outlined is essentially
and is intended primarily for large continuous petrochemical plants.
--_It - is-emphas i zed that other systems may be more appropri ate for other
~-~~'::--=~ype's'-~of:-p-i-ilnf-,-anllough-the-bas.i c pr i nci p 1es remain app 1 i cabl e:.: :

F'

-----!

SOME MODIFICATION PROBLEMS

Materials aspects
The materials for modification or repair should be 'suitable'
and should have properties at least equal to that of the parent material
originally used. If advanced codes apply, the materials should have
guaranteed minimum properties and should be so certified.
It is a 150 necessary that both' parent and rep 1acement mater i a 1s

should be capable either of withstanding the fabrication processes

without losing the required properties or of havin9 these properties
restored.
The availability of suitable material may be' a problem, either
because it is no longer made or because delivery times are long.
The parent material is sometimes degraded and. may require treatment
before welding can be done on it. Thus, for example, if there is surface

.;

'

- 25 -

sulphur contamination, it may be necessary to remove the contilmlnatTo,Y

by grinding and then to preheat to allow welding.
In some cases the parent material may have been rendered unweldable
by high temperature exposure or hydrogen attack.
The application of quality control procedures can give rise to
difficulties. There has been continuous progress in the measurement
of defects in materials and in acceptance standards. The situation
can eas ily ari se, therefore, where the quality demanded for the rep I acement material far exceeds that of the original equipment material.
The properties of both parent and replacement materials may be
affected by activities such as cold working, preheating or ~elding.
Materi a 1 prope,t i es may be res tored to some ex tent by su i tab 1e heat
treatment, but the heat treatment operations which can be carried out
. -are~-s-tr'i ct 1yl i mi teo;
MAJOR PLANT EXTENSIONS
Design of extensions
A major extension involves changes on a greater scale than a
normal plant modification. This means that it is particularly necessary
to check on the various facilities which may become inadequate ,or overloaded as a result of the extension. Some features of the design which
should be checked with this in mind are (1) pressure ~elief valves;
(2) vent, flare, blowdown and absorption systems; (3) drains and sewers;
and (4) trip systems.
The design, location and capacity of the pressure relief valves
should be checked and sufficient spares should be provided. A review
should also be made of the need for liquid thermal relief valves on
long sections of off-site pipeline which could be boxed in.
The facilities for gas and vapour relief, for flaring, for liquid
blowdown and for emergency absorption should be checked.

---~

.. -

...

The check on sewers and drains should cover not only the capacity
- nf-the underground sewers, but also that of the surface drainage so
as to ensure disposal of fire water.
A major extension also involves more Extensive changes of plant
configuration. It is particularly important, therefore, to check not
only tha~ there are suitable trip systems on the extension itself,
but that those on the existing plant are also still appropriate.

r.

Layout for extensions

The problems of pipework during the extension should be given
special attention. The number of live pipelines passing through the
non-operating areas should be kept to a minimum. Despite the best
safe-\~orking procedures, incidents are frequent in which 1 ive 1 ines
are broken or burnt open by construction personnel.
_____ Uti.littes~ lines' should be isolated from the non-operating area.
by block valves. Sewers should also be isolated from the non-operating
area, since they present the hazard that flammable gas may flow through
them from the operating into the non-operating area. Wood suggests
that sewers should be isolated completely rather than simply by the
sanding down of sewer beehives .
---_.~.-

--~

['
f

There should be adequate provision of blanking-off points to

permit pre-commissioning testing of equipment such as compressors on
air or gas recycle, while maintaining isolation of the non-operating
area from flammable gas and utilities.

Safe-working procedures
A major extension usually means that there are on the site a
large number of contractors' personnel and also additional company
construction and maintenance personnel. This situation is a particularly
severe test of the safe-working procedures and the normal procedures
should be reviewed to check that they are adequate.

L..,

- 27 -

The original plant usually continues in operationwfiile~coristru~ctfoii

work is in progress on the extension. It then shuts down so that it
can be tied into the expansion facil Hies. Itis necessary to control
work in the non-operating plant, and it is desirable that if it is
necessary to carry out gas-freeing operations on shutdown, then hot
work in the non-operating area should cease until this has been done.
The permi t-to-work sys tern is usually that in normal use. But
the number of permits issued is likely to increase greatiy and works
personnel rnay need to be assigned full tirne to analytical testing of
.atmospileres and issuing of perrnits.
In these circumstances identification of equipment becomes even
more important. It is essential that permits specify clearly the equipment to be worked on and that there be positive identification of equjp~_ .
. ments .. A co] our:J:ode~_pgLeed_w.Hh~th~e.c_o.rLtractot"s~ma..l'-.:be
used
asan----.
... - -----------------additional means of identification. Pipel iries in~ the non~operating----~--~~~~~-----;--_

- .

_.

area which are live should be clearly marked with an

a~reed

"-_.

__.-

code.

It is necessary to ensure that works and contractors' pipe blinds

are kept separate. The system described byb Wood is to .use works blinds
with a straight handle to distinguish them from the T-handle type used
by contractors. Furthermore, there . should be an instuction that
neither party must remove the other's blinds. Incidents occur in which
contractors' personnel remove blinds from live lines.
As mentioned earlier, in sorne permit systems a separate permit
is needed for the insertion or removal of blinds. This is particularly
appropriate for work on major extensions.
There is need for an alarm system to cover the hazard of f1 ammab 1e
gas release from an operating plant while hot work is being done in
a non-operating area. Personnel in the non-operating area should be
instructed to stop hot work when the a I arrn is raised. The norma 1 alarrn
system should also be explained to them.

- 28 -

The hazard of illicit smoking smoking should be reduced by the

only effective means available, which is the provision of smoking areas.
The personnel involved in the extension should be given training
on the hazards and procedures.

THE MAINTENANCE SYSTEM

I
!

, The rna intenance informat i on sys tem

Information on plant incidents, failures and repairs is needed
both for maintenance and loss prevention purposes. It should be a
specific objective of the maintenance system to generate such information.

._-----

The principal data required are those for failure, repair and
availability. The data are more valuable if they are of good quality.
Failure data should preferably give times to failure in each failure
mod~rather than overall failure rates.
Availability data should give
. ......
-----._- ---=--a:-fhtoUghj5lit~dehsit}'~Fath-erthan-a single downtime figure. --

!.

There are also other' data which are needed.

on human error and on leaks and fires.

These include data

Data on failure and related aspects are essential to the loss

prevention approach. The plant engineer, therefore, has a crucial
ro le to play here. He should make it his business to have an information
system which generates these data.
Information feedback
The requirement for failure data is one aspect of the more general
need for feedback of information from the maintenance to the design
function.
Again the plant engineer can playa key role in ensuring effective
feedback of information and so reducing unreliable and hazardous features, ,
and he should make this a definite objective.

l.,

L
I

- 29 -

Maintenance policies
The policies which are followed in a process plant have a marked
influence on the level of failures experienced.
There is, however, no universally applicable policy. The policy
appropriate in a given case depends on the failure situation. In some
cases breakdown maintenance is sufficient, in others preventive:
maintenance is preferable.
Maintenance of protective devices
Maintenance of the protective devices on the plant is particularly
important and should be covered by a formal system with full documentation.
Some of the principal protective devices are
-(1). pressure relief- valves;
(2 )
(3)

(4)
(5)

(6 )

(7)
(8)

(9)
(10)
(11)

- ------

bursting discs;
tank vents and filters;
other pressure relief devices;
non-return valves;
mechanical trips and governors;
instrument trips;
other instrumentation;
alal-m systems;
sprinkler systems;
fire water systems.

This list includes not only the more obvious protective devices,
such as pressure relief valves, but also some other critical items
which are not always thought of as protective devices, such as tank
vents.
The maintenance of instrument trip systems is very important.
The de~tgn of such systems is based on the assumption of proof testing
at fixed intervals and is invalidated if this is not correctly-donee

- 30 -

It is also important that the other instrumentation be maintained

to a high starldard:- Ifthegeneralinstrument system is allowed to
degrade with numerous incorrect measurements, false alarms and control
Fire protection equipment should be well maintained so that it
is available when required. There have been many instances where equipment has faiJed.to.op.erate . ott.en with. serious conseCjuences.

L-.-
r
-

L..