Examples of Safety Studies and SIL Analysis on the

Ammonia Plants of OCI NitrogenHarrie DuistersOCI Nitrogen, 6160 MG Geleen, The Netherlands; Harrie.Duisters@ocinitrogen.com (for correspondence)

Published online 27 September 2011 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.10493

A safety audit is almost invariably performed on new plantdesigns in the chemical industry. This will include at least aHazop study of the basic design. Many plant owners also requirean analysis of the safety integrity level or other methods of theinstalled safety measures.

The concept of acceptable risk changes with time, butmany existing plants operate year after year without a sys-tematic assessment of the safety level, even if the plant isrevamped or modified. In addition, operating proceduresmay change without all safety aspects being considered in aformalized way. This sometimes leads to very dangerous andcostly incidents, which could have been avoided if regularand systematic safety audits had been performed.

This article will discuss the systematic safety assessmentsthat are performed at regular intervals on the 40- and 27-years old OCI Nitrogen ammonia plants in The Netherlands.Examples are presented showing learning points that werefound after a Hazop and a SIL analysis. 2011 AmericanInstitute of Chemical Engineers Process Saf Prog 31: 8388,2012

Keywords: Hazop-study; process hazard analysis; ammo-nia-plant

INTRODUCTIONLocated at Geleen in The Netherlands, OCI Nitrogen oper-

ates two ammonia plants (Figure 1), each with a nameplatecapacity of 1,360 MTPD of ammonia. Till July 2010 these plantswere owned by DSM Agro. One plant (AFA-2) was designedand constructed by Bechtel; the plant was commissioned in1971. The other plant (AFA-3) was designed and constructed byM.W. Kellogg based on Kelloggs reduced energy ammoniatechnology; the plant was commissioned in July 1984. Currentcapacity of both plants is 1,500 MTPD each.

This article will show the importance of continuously per-forming Hazop and SIL studies. Safety studies are importantfor plants being built but also for older plants that are inoperation for a long time.

Risk Assessment at the Time of Commissioning

Check of the As-build PlantFor a new chemical plant, it is almost invariably the prac-

tice to invoke some form of a safety audit in the designphase. The audit will normally include a process hazard anal-ysis (PHA). In the United States, the occupational safety andhealth administration (OSHA), made the use of PHAs manda-tory.

The PHA report will often contain recommendationsregarding some minor modifications in the design that willincrease the safety level in the plant. With the plant stillbeing in the design phase, the responsibility for the actualimplementation will be with the EPC contractor.

The result of this approach is often that, apart from check-ing that the recommendations issued during the PHA areactually implemented, nobody responsible for the plant opera-tion feels a particular ownership for the report. Once the plantis build and in operation, the process hazard analysis is some-times shelved and forgotten. This is not to say that the peopleresponsible for the plant operations are not safety-aware. Theproblem is that they find that the reportdealing with thehazards of the basic design, which have all been dealt with bymodification of the design or deemed to be acceptable low-riskholds little value for future use. As such, they do notregard it as the basis for the ongoing risk evaluation.

Operating ProceduresSome points in the PHA may address the operating proce-

dures, for instance where the safeguard against some unde-sired incident lies within the operational procedures. Wherethis is the case, it is of course essential to write the operationalprocedures in such a way that no ambiguity exists and furtherthat the procedure is straightforward and logical. For instance,if the procedure states that the operator must close valve A, B,and C, but A and C are located close to each other and B fur-ther away, then, if the sequence is important, it must beunderlined that this is the fact.

While the basic procedures are normally written by theprocess technology licensor, others will typically detail thefinal operation instructions. It is important to ensure that novital points are missed during detailing.

Risk Assessment during Normal OperationOnce the plant is in normal operation, one might tend to

believe that there is no further use for risk analysis. The staffresponsible for operation and maintenance will ensure thateverything is running smoothly, and as long as everything iskept the same, there is no reason to reevaluate the hazardor is there?

Well, in the first place it is necessary to ensure that theplant in every aspect conforms to the design that was subjectto the PHA, and that all details are covered. It seldom is.Minor details are added or modified during the late designphase or during erection and commissioning. Some pointslike the aforementioned leak scenarios may not have beenaddressed during the initial PHA.

Second, we should remember that few things remain thesame. International and national safety standards change 2011 American Institute of Chemical Engineers

Process Safety Progress (Vol.31, No.1) March 2012 83

from time to time, and if an accident happens, somebodywill ask why the latest safety standards were not followed.While there might be many good reasons for not implement-ing the newest standards, we did not even consider it isdefinitely the wrong answer.

But also the plant itself is under constant change. Smallchanges in hardware or procedures making the operationeasier or improving production may be introduced withsafety-awareness, however, maybe without taking everythinginto consideration. Especially with many of our plants run-ning built in the 70s or 80s many modifications will havebeen installed in these 30-40 years.

Thus, the risk assessment of a running plant should be anongoing exercise. Using the original PHA as a backbone, thisdoes not necessarily need to be a very time-consuming exer-cise. OCI Nitrogen has a program of performing completeplant Hazop studies for their two ammonia plants and stor-age and (un)loading facilities in a 5-year cycle.

An update should be made when:

The plant has been in commercial operation for a fewmonths.

Planning a revamp, such as the installation of a membraneunit or a CO2 flue gas recovery unit. In this connectionfocus should be, not just on the new equipment, but alsoon the impact on the connecting systems. The updatedPHA report is a good place to record that, for instance, theexisting pressure relieve valve has been checked and foundadequate for the increased flow.

Planning significant modifications to hardware, also as apart of the normal maintenance, like for instance replace-ment of a valve with higher Cv or replacing pump with anew one, having a different impeller.

Modificationseven minorof the detailed operatingprocedures are necessary.

And, otherwise, at regular intervals, say every 25 years.

The Hazop study is a useful tool to identify the points ofrisk in the plant. If the study also employs a risk matrix, it ispossible to estimate the consequences of an incident in termsof personnel safety, cost of production loss, capital costs,and environmental impact. It is also possible to do a roughestimation of the likelihood of such an incident. However, tomake a more systematic approach to the estimation of likeli-hood, tools that are more sophisticated are required. A

Hazop study is often supplemented by a safety integrity levelanalysis (SIL analysis). The SIL analysis is a systematic way todetermine the performance for a safety instrumented function(SIF) and thereby the risk of a particular incident occurring.

The SIL analysis need not be updated unless modificationsare made to safety instrumented system (SIS), the trip system.On the other hand, the SIL analysis is a useful tool in case itis planned to make systematic improvement of the plantsafety. Doing the design verification it also performs a com-plete check of the entire chain from the design to the realbuild equipment. In the following, we shall describe a practi-cal example of the use of the techniques described above.

Some Learning Points Found from Hazop and SILAnalysis at OCI Nitrogen

OCI Nitrogen (former DSM Agro) operates two ammoniaplants in the Netherlands. These plants are 27- and 40-yearsold but still reasonably state of the art due to good mainte-nance and modernization projects. Annually 1 million metricton of ammonia is produced from these facilities. In the nextparagraph some learning points from recent Hazop and SILstudies will be presented.

Upgrade of the Low Air Flow Protection of the SteamSuperheater Burners to SIL-2 Level

In the reformer furnace of the Kellogg ammonia plantAFA-3, 12 steam superheater burners are present. Theseburners increase the flue gas temperature in the convectionsection of the furnace to be able to use this flue gas to superheat steam in coils located after these burners in the convec-tion bank. These burners use natural gas. The air flow tothese burners has a low-low-switch installed to be sure thatthere is always sufficient air going to these burners. Whenthe air flow is dropped, one can get into a situation wherethe natural gas that is fed to the super heater burners, is notburned at the burners but is going directly into the convec-tion box. There the natural gas can build up to form an ex-plosive cloud where is explode with the oxygen still presentin the flue gas and the various ignition sources (hot surfaces)in the furnace. This is evaluated as a SIL-2 scenario.

The present protection against this SIL-2 scenario wasonly a delta-P measurement over the burners. When the deltaP gets below a certain value, the natural gas flow to thesteam super heater burners is stopped. The design verifica-tion showed that this protection was not adequate and notenough. The delta-P cell was not of the correct type, andalso having only one protection is not sufficient to reach theSIL-2 level.

The delta-P cell was replaced by an A-type (SIL-1 levelclassified) transmitter type 3051 from Emmerson. Further-more an oxygen analyzer was installed in the flue gas ductdirectly behind the steam superheater burners. When the ox-ygen level gets below 3 vol.% the natural gas flow to theseburners is stopped.

Hydrogen Containing Process Gas Getting into theSewer System: A SIL-1 Scenario

In the Bechtel ammonia plant AFA-2, a separator vessel isinstalled behind the CO2 removal section. This is to removeany entrainment before the process gas is sent to the metha-nator. In the AFA-2 plant the CO2 washing system consists ofan aMDEA system. Any entrained liquids could foul anddeactivate the methanator catalyst.

In the bottom section of the separator vessel a level con-troller is installed connected to a drain valve that sends theliquid to the sewer. This valve opens when the level of liquidin the vessel reaches a certain value and closes when the

Figure 1. OCI Nitrogens two ammonia plants in Geleen,The Netherlands. [Color figure can be viewed in the onlineissue, which is available at wileyonlinelibrary.com.]

84 March 2012 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.31, No.1)

StephaneHighlight

StephaneHighlight

level is low. Normally not much liquid is entering the vesseland only small amounts have to be purged.

When this level control system fails, process gas from theseparator can leave the vessel through the bottom and enterthe sewer. The pressure of the process gas in the vessel is 30bar. In this way hydrogen gets into the sewer that can forman explosive cloud. This is an unwanted situation classifiedas a SIL-1 scenario (Figures 2 and 3).

The actions taken consist of installing a separate low-levelswitch in the separator. This low level switch (LLS) operatesseparately form the level control system. The low levelswitch is coupled to a separate open/close valve. This valveis located upstream of the level control valve and protectsalso against a leaking level control valve. Furthermore thelevel control valve was reduced to the smallest possible sizeand the level controller is converted to a so-called gap-con-troller. It opens when the level is high and it closes againwhen the level is low.

Another Case Where Process Gas Can Get into theSewer System: A SIL-1 Scenario

The AFA-2 plant has an aMDEA CO2 removal system. Afterthe CO2 absorption, the loaded aMDEA solution is first fed toan expansion vessel before the solution is sent to a strippercolumn to remove the CO2.The expansion vessel operates atabout 7 bar. In the expansion vessel a major part of the dis-solved hydrogen is released together with some nitrogen andCO2. This hydrogen rich gas is cooled and sent to a separatorvessel before the gas is used as fuel gas in the reformer. Inthis separator vessel some water is also injected to wash outany entrained aMDEA solution. The pressure in the separatoris close to 6 bar.

Similar to the previous example also here the liquid levelin the bottom section of the separator is controlled using alevel measurement and a drain valve. However before theliquid is sent to the sewer again the liquid is sent a smalldegassing vessel from which the gasses go to the central flaresystem. A nonreturn valve is installed in the gas line to theflare.

In the past process gas has entered the sewer throughabovementioned system. This was caused by a failing levelcontrol in the separator vessel and by gas flowing back fromthe flare system because the nonreturn valve did not work

properly. The hydrogen rich process gas can form an explo-sion and this was classified as a SIL-1 scenario.

To improve this situation and get all system and theequipment SIL-1 level classified, the small degassing vesselwas removed. In this way the coupling between the flare sys-tem and the sewer removed. A separate low level switch wasinstalled in the separator coupled to a separate open/closevalve. An end contact is installed on the open/close valve toguarantee that under normal conditions the valve is closed.The open/close is only opened when the level control valveopens the drain valve to reduce the liquid level in the sepa-rator. It is situated in series with the level control valve(Figure 4).

Ammonia Storage Sphere: Blowing of a Pressure ReliefValve Causing a SIL-1 Scenario

OCI Nitrogens ammonia plants have a storage facilitywith two atmospheric ammonia storage tanks of 25,000 m3

and one pressure sphere. The pressure sphere has a volumeof 2,200 m3 and operates at 4 bar (Figure 5). The scenario ofoverpressurizing the sphere and having a leak in the sphereis classified as SIL-2. This scenario is protected by three Pres-sure Relief Valves (PRVs) located in top of the sphere thathave sufficient high capacities to remove and the excess am-monia causing the overpressure. In the ammonia sphere thegoverning case of the PRVs results in a release of 108 tonh21 (30 kg s21) of ammonia. This ammonia release will resultin flashing of the pressurized ammonia forming an ammoniavapor cloud of 13 ton h21. The remaining liquid ammonia isstreaming down the sphere and partly evaporating and for asignificant par contributing to the vapour cloud (Figure 6).

So when one of the PRVs of the sphere has to open avery large ammonia release with vapor cloud is formed. Assuch this release can also be classified. Primarily because ofthe large amount of ammonia, we came to the conclusionthat blowing PRVs are a SIL-1 scenario. The sphere already

Figure 2. Are you sure not having explosives getting into yoursewer? [Color figure can be viewed in the online issue, which isavailable atwileyonlinelibrary.com.]

Figure 3. Process water separator. [Color figure can beviewed in the online issue, which is available atwileyonlinelibrary.com.]

Process Safety Progress (Vol.31, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2012 85

has one electronic high pressure switch (HPS) that closes thefeed to the sphere when a certain pressure level is passed.During the design and construction verification it was foundthat one HPS was not enough to guarantee a SIL-1 level.Therefore a second HPS was installed. It is of course impor-tant to make sure that this second HPS is operating inde-pendent from the first one. So it should be on another line,and preferable be based on another measuring principle.

Ever since the design of the older ammonia plants muchnew knowledge has become available on the problem of am-monia stress corrosion cracking in ammonia spheres, atmos-pheric ammonia storage tanks, and even other equipment incontact with ammonia. See Refs 14. This know-how mustbe incorporated in the Hazop studies.

Protecting a Primary Reformer Against an ExplosionDuring Start-Up: a SIL-2 Scenario

On April 1, 2003 an explosion occurred in a gas-fired fur-nace in the melamine plant of OCI Nitrogen (at that timeDSM Melamine) in Geleen. Three people sadly lost their livesduring the accident. The gas-fired furnace at which the acci-dent occurred generates heat for the melamine process andis installed next to this plant as a separate unit. The explo-sion occurred during start-up of the furnace after a shortmaintenance stop. A detailed root cause analysis was doneand the conclusions of this are also applicable to other partsof the chemical industry.

After this accident new hazard and operability (Hazop)safety analyses were performed on all gas-fired equipment ofOCI Nitrogen. The focus was for a major part on the ammo-nia plants where gas is fired in the primary reformer, theauxiliary boiler, the start-up furnaces and the gas turbine(Figure 7).

The perception is often that natural gas is not a dangerousgas and therefore the risks of operating a gas-fired apparatusare not always recognised. There is clearly the effect of habit-uation using natural gas in the plant.

The dedicated Hazop OCI Nitrogen performed for the fer-tiliser plants resulted in a lot of potential improvement. Withregards to instructions and procedures one has to make surethat clear instructions are present and that work is exactlydone according to these instructions. Operators not following

the work procedures create new operating methods and theSHE aspects of these new methods are not always reviewedproperly. This is especially important during start-up of gas-fired equipment. This is by far the most dangerous momentbecause starting up a gas-fired apparatus is not easy and it isnot frequently done. If the first start-ups fail, operators canbecome creative in finding ways round giving rise to unsafesituations. Furthermore it was concluded that because of theexplosion risks one should try to prevent local panels closeto the gas-fired equipment.

Main learning point derived form a dedicated HAZOP atOCI Nitrogen on gas-fired equipment are:

start-up is the most dangerous moment leaking valves are a major risk factor

Figure 4. Bottom of separator with two separate valves tomake sure that no explosive gas can get into the sewer sys-tem. [Color figure can be viewed in the online issue, whichis available at wileyonlinelibrary.com.]

Figure 5. The 2,200 m3 ammonia sphere with three pressurerelief valves on top. [Color figure can be viewed in theonline issue, which is available at wileyonlinelibrary.com.]

Figure 6. Detail of the three pressure relief valves, each witha capacity of 108 ton h21 of ammonia. [Color figure can beviewed in the online issue, which is available atwileyonlinelibrary.com.]

86 March 2012 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.31, No.1)

prevent local panels to gas-fired equipment be sure to have clear instruction make sure operators follow these instruction keep air ventilation on if possible when a furnace isstopped

try to inertisize the gas feed line when not in operation be aware of other combustible gases going to furnaces keep up with the newest regulations perform a quantitative risk analysis on the safety system

Risk of Explosion Especially during Start-Up

Prevent Formation of Explosive Gas MixturesCaused by Leaking Valves

Before a start-up one relies on block-in valves like pneu-matically operated XPVs or electrically operated XEVs to betight. However this is not always the case. Block-in valvesare not always 100% close and they can leak. This is espe-cially the case with very large valves like for example in thefuel gas line to the burners of a world-scale ammonia plantconsuming tens of thousands of m3 natural gas per hour.Leaking valves can cause the firebox to be filled with gasforming an explosion mixture. To prevent this from happen-ing one should use top class valves and preferably installtwo valves in series with a bleed system in between, a socalled block-and-bleed system. Experience has shown thateven two valves (without a bleed in between) were not100% close anymore after many years of operation. It is alsoadvised to always purge the fire box before start-up andpreferably continuously so that no gas can be building up inthe furnace.

Gwyn [1] describes a system that provides a reliable, posi-tive method of testing to assure that there are no leakingvalves and that conditions are safe for lighting the gas burn-ers. OCI Nitrogen uses more or less the same system.

The system basically functions by injecting natural gasthrough a by-pass valve into the header piping to establish apositive pressure in the main fuel gas header down stream ofthe main gas supply valve. The gas is injected for a predeter-mined time or until the header reaches a certain pressure.On attaining the correct pressure the by-pass valve is closed,

and the header is required to hold a given pressure for a cer-tain time.

This test must be done in two different modes. First thepressure in the header must be chosen low (almost atmos-pheric). With this mode one can test the closeness of the mainfuel gas valve. If this valve leaks the pressure will increase. Aleaking main fuel gas valve is also a very dangerous situationwhen stopping a furnace. A furnace like a primary reformerhas a lot of manual plugcock valves and operators need sometime to close them when the equipment is stopped. A leakingmain gas valve is then a potential risk for an explosion.

The second mode of the pressure test is to do the test at ahigh pressure (max. feed gas pressure). With this mode onecan check if all the (manual plugcock) valves at the burnersare tight. When the burner valves are not close one mustlook in the field which one is leaking and close/repair thisone. An ultrasonic device can be used to detect the valveswith excessive leakage.

Upon the header holding the required pressure, and com-pletion of the purge cycle, the system will allow resettingand opening of the main gas valve. While the system cer-tainly can be built using conventional relays and hardware,the application favors using a P.L.C. Also, another mediumcan be used for pressuring the main gas header; however,this medium would then have to be purged from the systemto get natural gas to the burners.

Overfilling an Ammonia Rail Tank Car:A SIL-2 Scenario

Overfilling an ammonia rail tank car (RTC) can result inone of the most dangerous loss of containment scenarios.This is the scenario where the tank of the RTC can burstunder the thermal expansion pressure of the liquid ammonia.This situation could occur when an RTC is overfilled to suchan extent that there is too little gas space left, above the liq-uid, to accommodate the thermal expansion of the liquid am-monia. During the time the ammonia is in the RTC, the am-monia can become warmer due to ambient conditions, espe-cially during extreme hot summer days. For that reason thelegally allowed maximum fill level of the RTC in Europe islimited to 0.53 kg ammonia/litre of effective tank volume(Figure 8). If a RTC contains more than this legally allowedquantity the RTC must be regarded as overfilled and immedi-

Figure 7. Primary reformer furnace. [Color figure can beviewed in the online issue, which is available atwileyonlinelibrary.com.]

Figure 8. Ammonia rail tank car with maximum filling of 530kg m23. [Color figure can be viewed in the online issue, whichis available at wileyonlinelibrary.com.]

Process Safety Progress (Vol.31, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2012 87

ate action should be taken to correct the situation. It shouldbe stressed that overfilling is not defined as the level whereliquid ammonia leaves the tank car via the gas return lines/pipes. Overfilling already happens at levels far beneath thepoint that liquid returns via the gas return line.

To prevent overfilling the filling weight has to be con-trolled by at least two independent measuring systems. Thefilling weight can be extracted from the available systemslisted below:

The filling weight of the railway tank wagon is continu-ously monitored during the filling process on a weighingbridge. The filling automatically ends when the predeter-mined maximum is reached.

The mass flow into the tank is monitored continuouslyduring the filling operation. The filling automatically endswhen the predetermined maximum is reached.

Before transporting the weight of the RTC is additionally

checked off line on an independent and officially cali-brated scale or weighing bridge.

One important step in the filling process is to determinewhether or not an empty rail tank car is really empty. This isnormally done on the weighing bridge, communicationbetween the weighing bridge and filling station is essential inavoiding dangerous overfilling. Also, the weighing procedureapplied, stand-alone on the bridge, coupled in a train, evenmoving, can be a source of weighing failures which can leadto overfilling. If the filling station is equipped with a weigh-ing bridge itself, the weighing procedure should be exam-ined for sources of inaccurate weighing. The input of thecorrect data for filling is mostly done manually and therebycan form a potential high-risk step.

When filling is monitored by measuring the volumetric/mass flow into the tank, all steps in determining and control-ling the correct batch amount put into the monitoring equip-ment should be assessed for sources of error and preferablydouble-checked.

Finally, when an offline check of the RTC weight is per-formed on a weighing bridge, this weighing bridge is mostlikely the same weighing bridge as used for weighing theincoming empty RTC. Here again, the weighing procedureapplied plays a role in the risk of not discovering over-weight rail tank cars. Also, a systematic error in the weigh-ing bridge could remain undiscovered since it is influencingthe empty weighing and on the filled weighing in the sameway.

OCI Nitrogen has added an extra step in assuring thatno overfilling is taking place. During the filling of theRTC a separate thick pipe (small vessel) is connected tothe RTC. When the level in the RTC rises, the level in theconnected pipe (vessel) also rises. In this connected ves-sel a high-level measurement is installed that is coupledto a switch (HLS). The HLS that is installed is situated ata level that is equivalent to the maximum filling level ofthe RTC. The HLS switches off the ammonia feed pumps(Figure 9).

LITERATURE CITED

1. J.E. Gwynn, Positive Pressure Testing System (PPTS), Vol.28, AIChE Ammonia Safety Symposium, Minneapolis,1987.

2. EFMA Guidance document on transporting ammonia byrail 2005. Available at: www.efma.org

3. H.G. Orbons and T.L. Huurdeman, Stress CorrosionCracking in Syngas Heat Exchangers, Vol. 4, Plant Opera-tion Progress, 1985.

4. R. Nyborg and L. Lunde, Measures for Reducing SCC inAnhydrous Ammonia Storage Tanks, Vol. 15, Process SafetyProgress, 1996.

Figure 9. Separately installed high level protection of the railtank car. [Color figure can be viewed in the online issue, whichis available at wileyonlinelibrary.com.]

88 March 2012 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.31, No.1)