Global Congress on Process Safety - 2012 __________________________________________________________________________ How to safely operate Multifunctional Pilot Plants: A Case Study at the Dow Chemical Co. Luiz A. Zacharias Process Safety Technology Leader The Dow Chemical Co. 2301 N. Brazosport Blvd. – Freeport – TX - 77541 [email protected] Roger B. Painter Senior Research & Development Manager The Dow Chemical Co. 2301 N. Brazosport Blvd. – Freeport – TX - 77541 [email protected] Disclaimer: The Dow Chemical Company has provided for the compilation of the information in this document as a part of an effort by its employees to collect and share their experience and expertise in safety, loss prevention and security. The contributors to this document believe the information provided is accurate, and they have provided this information in good faith. However, no warranty, express or implied, is given by The Dow Chemical Company. Other than The Dow Chemical Company employees, those who use this document should use their independent judgment in evaluating information contained herein, and assume the risk for using the information provided in this document. The user is solely responsible for compliance with applicable laws and regulations. Prepared for Presentation at 8th Global Congress on Process Safety Houston, TX April 1-4, 2012 UNPUBLISHED AIChE shall not be responsible for statements or opinions contained in papers or printed in its publications Global Congress on Process Safety - 2012 __________________________________________________________________________ How to safely operate Multifunctional Pilot Plants: A Case Study at the Dow Chemical Co. Luiz A. Zacharias Process Safety Technology Leader The Dow Chemical Co. 2301 N. Brazosport Blvd. – Freeport – TX - 77541 [email protected] Roger B. Painter Senior Research & Development Manager The Dow Chemical Co. 2301 N. Brazosport Blvd. – Freeport – TX - 77541 [email protected] Keywords: pilot plants, risk assessment, management of change Abstract Located at Dow Chemical’s Freeport, Texas site, the Multifunctional Pilot Plant (MPP) facility has safely supported diverse research initiatives related to the development of chemical processes and evaluation of catalysts, raw materials and products since 2000. MPP provides the necessary infrastructure such as raw materials, utilities, process automation, analytical services and waste management. Due to the variety of the different chemistries and processes located within the same structure, a detailed safety risk assessment protocol is applied equally to each project irrespective of size, chemistry or complexity. Reactive Chemicals and Process Hazards Analysis, aided by the use of a diverse set of tools, is required to be completed during early stages of new projects. Interface issues between different operating processes within the facility are also studied and evaluated for managing future scale up activities once the project is concluded. Over its life, a project goes through multiple reviews to ensure the initial and continued safe operation. Unit engineers, technicians, and researchers working in partnership with Dow’s Process Safety Technology Center identify, investigate and implement best practices to ensure the ongoing safe operation of the project. This presentation will cover the following topics: 1. Infrastructure and Pilot Plant capabilities 2. Risk Assessment Protocol 3. Training and Personal Development for Engineers and Technicians 4. Environmental, Health and Safety Performance Global Congress on Process Safety - 2012 __________________________________________________________________________ 1. Introduction The Dow Chemical Company’s Multifunctional Pilot Plant (MPP) facility is located in Freeport, Texas and has supported diverse research and development initiatives related to the chemical processes, catalysts, raw materials and products since 2000. It provides the necessary infrastructure to assure safe and reliable continuous operation of each project. The variety of chemistries and processes located within the same structure requires a detailed safety risk assessment protocol which is applied independently to each individual project and holistically for the entire facility. A pilot plant project goes through multiple reviews to ensure the initial and continued safe operation, including: - Hazard Assessment during the project development phase identifying, quantifying and reducing risks compatible to the planned operation; - Pre-startup Safety Review prior to introduction of chemicals and actual operation of the project to assess the readiness of equipment (hardware and software) and personnel for the operation; - Periodic Process Hazards Analysis for continuing operations; - Management of Change process covering any modifications to the project once in operation. 2. MPP Infrastructure and General Capabilities The Multipurpose Pilot Plant (MPP) is an ISO 9001:2008 certified facility consisting of multiple process research bays each equipped with raw materials and utility tie-points for installation of pilot and market development scale plants as pictured in Figure 1. Figure 1: Multipurpose Pilot Plant Facility Global Congress on Process Safety - 2012 __________________________________________________________________________ Control room, storage, laboratory space, waste management and disposal also support the facility’s projects. The facility is designed to accommodate multilevel plants and is covered to provide protection from the elements. The bays are prewired with power connections and a centralized process automation and data collection system that facilitate true plug-and-play installations. The centralized process control system ensures implementation of consistent process control strategies across all projects. All infrastructure systems for the facility are operated, maintained and managed by a central group independent of the projects. 3. Project Development and Hazard Assessments Once a new Research and Development (R&D) project is defined to be scaled up from the laboratory bench into a pilot plant scale in MPP, a systematic risk assessment and management protocol is engaged. The objective is to evaluate and control the risks associated with the hazards of materials and processes which may have the potential to injure people, or damage property or the environment. The Dow Chemical Company defines requirements for management of process hazards in its Process Risk Management Standard. MPP established a risk assessment and management protocol which starts once the project is to be installed within the facility. Dow’s risk assessment program is an integral part of Dow’s overall environmental, health and safety program. The risk assessment portion of the program at MPP identifies and estimates the risks associated with the activities within each project as well as the support units. Identification and quantification of risks are the beginning of Dow’s process for maintaining the health and safety of our workers and the neighboring communities. Equally important are Dow’s worker education and training programs, hazard warning and communication efforts, design controls and features of our facilities and processes, operational procedures and practices, and our overall quality assurance effort. Risk management also utilizes risk analysis which is the estimation of risk from identified hazards using qualitative or quantitative techniques and engineering judgment. Risk analysis is the process whereby the identified hazards are evaluated to provide an estimate of the risk and includes answering these three questions: - What potentially can go wrong? (hazard identification) - What are the potential consequences? (consequence impact estimation) - How likely is it to happen? (frequency estimation) The MPP risk management protocol has several steps with defined inputs and deliverables: - Determine the requirements for risk reviews (internal standards, operating permits, etc.) and define when risk reviews are expected to be completed and identify responsible parties to complete the defined risk reviews independent of projects’ scale and complexity. Global Congress on Process Safety - 2012 __________________________________________________________________________ - Identify the hazards related to the system being studied. The role of hazard identification is vital to the risk management process because it establishes the foundation for risk analysis. If hazards are not identified the risks cannot be analyzed. - Analysis of the risk associated with the identified hazards. The risk analysis methodologies required and the degree to which the risks need to be considered will vary. In some cases, simply knowing what could go wrong (for example, hazard identification) may be sufficient to make risk management decisions. In other cases, an understanding of the potential consequences or frequency alone may be adequate to make risk management decisions. Some cases require quantification of both consequence and frequency. - Evaluate each risk to determine if it is considered acceptable. There are two basic approaches to evaluating risk tolerance. The more traditional approach is qualitative in nature and typically involves making judgments based upon policies and standards derived from collective experience. These policies and standards have evolved over time as a result of historical performance. The second approach is quantitative in nature and involves comparing the risk with numerical criteria. If the risk exceeds predefined and agreed upon criteria established by Dow Chemical, this exceeding risk is addressed by: changing the activity which generates risk to reduce it, discontinuing the activity creating the risk, or reviewing the risk and the activity creating the risk with corporate management and obtaining agreement on any necessary changes. - Once risk reduction steps are taken, hazard identification and risk assessment must be reevaluated to determine if any new risks have been introduced and to see if the risk is now acceptable. If so, the risk assessment is complete. Management procedures are then reviewed to ensure that appropriate and effective management systems are in place and that the remaining or residual risk is being monitored and controlled. The risks are periodically revisited or re-evaluated when significant process or engineering changes are contemplated. - Periodic re-review is required every 3-5 years to ensure that the latest risk processes have been used to manage the potential risks associated with each project. 4. Tools and Documentation in Managing Process Risk The specific steps, tools to be used for each step, required documentation, and approvals required at each step for evaluating and managing process risk are indicated in the following items: 4.1 Process Hazard Analysis Traditional Risk Review tools are used in this project phase with the objective to obtain an initial screening and assessment of the hazard potential. They are: - Fire and Explosion Index (F&EI) - Chemical Exposure Index (CEI) Global Congress on Process Safety - 2012 __________________________________________________________________________ - Reactive Chemicals and Process Hazard Analysis (RC/PHA) - Layers of Protection Analysis (LOPA) Consequence Estimation - Application of Process Safety (PS) Most Effective Technology (MET) – Dow Loss Prevention Principles (LPP) - When applicable, Government regulations may require additional reviews Once the processes of step 4.1 are completed, a multifunctional analysis involving members of the MPP staff, the project team, the Process Safety Technology Center and the local Reactive Chemicals committee evaluate the appropriate risk reduction alternatives. After these activities are defined and implemented, the overall Process Hazard Analysis must be revisited to ensure that any new hazards that may have been introduced are identified and analyzed and to determine what impact the risk reduction measures have had on the F&EI, CEI, and LOPA Consequence Estimation calculations. At this point in the process, a decision is made if there is a need for advanced risk review. 4.2 Advanced Risk Review This final step consists of more quantitative hazard identification and analysis than was carried out in step 4.1. The Primary Tools utilized for fixed facilities for the Final Risk Reviews include: - Explosion Impact evaluation for occupied buildings near potential explosion sites - Cause-Consequence Pair Identification - used to better develop/define scenarios for LOPA - For technologies which are new to Dow, Hazard and Operability Study (HAZOP) is recommended to identify scenarios before the LOPA analysis is performed. - Layer of Protection Analysis (LOPA) using scenarios identified during HAZOP and RC/PHA - Fault Tree Analysis, Event Tree Analysis, Human Factors Analysis, and PHAST (Dispersion Modeling) are other tools that may be used in this step as part of additional analysis for special circumstances or to address those situations. This step can be an excellent method for identifying additional risk reduction alternatives. These alternatives are now evaluated and appropriate risk reduction measures are implemented. However, any new hazards that may have been introduced via the modifications or mitigation measures must also be identified and analyzed. 4.3 Manage Residual Risk When the Process Hazard Analysis and Advanced Risk Review are complete, management procedures must be reviewed to ensure that appropriate and effective process Global Congress on Process Safety - 2012 __________________________________________________________________________ safety management systems are in place and the residual risk is being monitored and controlled as planned. Management procedures to be reviewed include: - Management of Change Guidelines - Job Procedures - Personal Protective Equipment Guidelines - Training Programs - Loss of Containment Procedures - Emergency Planning and Response Procedures - Dow Chemical’s Loss Prevention Principles Implementation and Compliance Residual risk management requires a continuous effort to review and emphasize process safety management systems and to evaluate a process or activity for new hazards that might have been created or discovered. 4.4 Periodic Review and Validation It is expected that this full risk review process will be initiated as a result of each significant change to the facility. However, the Process Hazard Analysis and Advanced Risk Reviews described within this document are reviewed and re-validated every 3 to 5 years. If any new scenarios or new conditions are identified which would present a higher risk than previously documented, any previously performed reviews would also need to be updated and revalidated with action items and related documentation included in the projects’ database. 5. Personnel Training and Development Over the course of the MPP facilities growth, training has evolved to the following sequential steps: - General EHS Training Operational Training Field Awareness Hands-on Training Training Review Board Ongoing Development A detailed checklist is used to track the successful completion of the training plan for each employee. The checklist is validated by the lead technician or run plant engineer and the production or operations leader for the project. The training regime is similar for either a technician or an engineer assigned to the project. Global Congress on Process Safety - 2012 __________________________________________________________________________ It is important to note that the training and certification can be divided into separate training packages. For example, an employee could proceed through the steps detailed below for a single operation instead of the entire project’s operation. The separation of the training is especially beneficial for tasks that are infrequently performed. It is also beneficial for a new employee as they can be trained on lower hazard operations initially and then once experience is gained, have their training extended to include more complex or hazardous operations. 5.1 General EHS Training The first training step covers Dow’s environmental, health and safety training identified for the employee’s specific role. Depending on the topic, the training is either self paced computer or instructor led. Indoctrination to the MPP facility including review of specific policies is also included during this phase. 5.2 Operational Training The second training step covers process technology and procedure training which are both instructor led. Process technology training details the chemistry, technology to be practiced and the known chemical and process hazards associated with the new project. Procedure training is a detailed review of the operating procedures for the project. This step ensures the employee has a fundamental understanding of the operation and the chemical and process hazards associated with the project before beginning field awareness and hands-on training. 5.3 Field Awareness The third training step ensures the employee obtains familiarity with the project and facility. An experienced technician, lead technician or run plant engineer reviews the facility and the project with the employee. Important safety features of the facility are identified, such as location and operation of field alarm panels and switches, safety showers and gas detectors, as well as normal emergency response actions in the event of an emergency. The employee is provided a process flow diagram and copies of the project’s piping and instrumentation diagrams (P&IDs). The employee is expected to identify the physical location in the field for all equipment and instrumentation, and routing of all lines. 5.4 Hands-on Training The fourth training step is the first time the employee actually performs operating tasks. Hands-on training is 100% supervised by the lead technician or run plant engineer for the project. The employee must be trained and demonstrate proficiency for all operations identified for their specific role. Before an employee is trained on the process automation system (or sometimes called board), they are trained on the outside operations, which includes identifying all process control loops. The employee must perform each supervised task until their assigned trainer acknowledges acceptable proficiency. Global Congress on Process Safety - 2012 __________________________________________________________________________ 5.5 Training Review Board The final training step is a Training Review Board (TRB). The TRB consists of three parts: white board review, plant walkthrough and process control review. The TRB is an oral evaluation of the employee’s knowledge and is attended by the operations or production leader, run plant engineer and/or lead technician, and EHS delivery. In preparation for the TRB, the run plant engineer and/or the lead technician develop a list of detailed questions that cover all aspects of the operation from chemical and process hazards to performing specific operations. This questionnaire defines the minimum expectations and is reviewed and approved by the operations or production leader. Participants in the TRB question the employee using the questionnaire or asking other questions they identify during the review. All questions not currently included in the questionnaire are captured for future TRBs. The white board review takes place in a conference room and normally begins with the employee sketching the pilot plant process on a white board. It is expected that the employee will draw all major vessels, interconnecting process and utility lines, and significant controls and valves that resemble the P&IDs for the project and describe the actual chemistry during the unit operation overview. The employee is expected to explain all process control loops and operational strategies, safety systems and interlocks, process and safety hazards, and emergency responses for the project. Participants frequently interrupt the employee during the sketching process to ask questions. This interruption is actually beneficial as it replicates a normal day for the employee (i.e., interruptions occur on a routine basis) and it ensures the employee thoroughly understands the process. The project walkthrough validates the individual’s knowledge of the field equipment, safety systems and operations. Again, questions are raised as the employee describes the different sections of the pilot plant. During the plant walkthrough, emphasis is placed on day to day tasks and the identification of safety equipment. Lastly, the process control review confirms the employee’s familiarity with the operating system. This part of the review requires the employee demonstrate proficiency in operating the project, including: navigating through the process control system, accessing parameters, accessing and responding to alarm screens, accessing process history, and activating and manipulating control loops. At the completion of the TRB, the review team subjectively determines if the individual sufficiently demonstrated the identified competencies for the role. If the individual did not pass, a detailed action plan is identified up to and including going through all the training a second time. The individual is not allowed to operate independently until they successful complete a TRB. 5.6 Ongoing Development It is common to make frequent changes within a pilot plant, such as process modifications to investigate an alternate approach or new idea. Dow’s Management of Change (MOC) work Global Congress on Process Safety - 2012 __________________________________________________________________________ process ensures that changes are properly reviewed and implemented, which include identification and documentation of training. Dow also requires the review of operating and emergency procedures at specified intervals even if changes have not occurred. These processes ensure that training remains current for all employees supporting a project. This MOC requires at least the acknowledgement of all employees allowed to operate independently in MPP, so no one is surprised with a change. 6. Environmental, Safety and Health Performance All Process Safety events (Incidents or Near Misses) are thoroughly investigated using Root Cause Analysis methodology, where appropriate. Corrective and Preventive Actions are established. Investigation sessions are facilitated by the MPP Facility Leader with participation of representatives from the affected project and Subject Matter Experts. A Process Safety Incident is identified, reported and investigated if it meets all four components of the following criteria: 1. Chemical / Process Involvement: A chemical or chemical process must have been directly involved in the damage caused where the term “process” is used broadly to include the equipment and technology needed for chemical production; 2. Reporting Threshold: An incident must meet at least one of the following reporting thresholds: a. Fire/Explosion: There is either a fire or explosion that causes direct costs exceeding $25,000 (USD). The term “explosion” includes both detonations and overpressures, OR b. Chemical release: There is an acute release of flammable, combustible, or toxic chemicals from the primary containment (i.e., vessel or pipe) greater than the chemical release threshold quantities described in the Center for Chemical Process Safety (CCPS) Process Safety Metrics, excluding releases to a properly designed and operating control device specifically designed for that event 3. Injury / Fatality: a. There is a fire, explosion or chemical release that does not trigger the thresholds above, but involves one or more fatalities or Days Away of Work Cases (DAWC) involving employee or contractor or that involves overnight hospitalization for nonemployees. OR Global Congress on Process Safety - 2012 __________________________________________________________________________ b. There is one or more serious injury (DAWC) or fatality of an employee or contractor that directly results from the release of energy or material from a process, including chemical storage, even while the process is not in normal operation. This includes operations such as pressure testing, cleaning and maintenance. 4. Location: The incident occurs at a fixed facility in production, distribution, storage, utilities, or large/small pilot plant areas. This includes tank farms, ancillary support areas (e.g., boiler houses and waste water treatment plants), and piping within the site. Process Safety Near Misses are identified, reported and investigated as per Dow’s work process which establishes the following criteria: 1. Fire or Explosion: Any fire, explosion, or ignition of flammable or combustible materials involving a chemical process, or electrical arcing that does not meet global process safety incident criteria. 2. Unplanned Mixing: Any contamination or unplanned mixing materials with potential for uncontrolled/unexpected reaction 3. Uncontrolled reaction: A chemical reaction resulting in an unplanned consequence 4. Relief Device Failure or Activation: By definition, a relief device opening is an unplanned event. The fact that the system reached the relief device set point is of concern. 5. Actual Chemical Release: A loss of containment 6. Potential Chemical Release: The potential for a significant release due to mechanical integrity deficiency. 7. Failure of a Layer of Protection: An incident where protection afforded by a layer of protection (hardware, software, procedural, or human) fails to operate as intended. Layers of protection can be defined by several methods including LOPA, RC/PHA, historical design, LPPs, etc. 8. Personnel Exposure: Personnel exposure to toxic or hazardous chemicals with potential for DAWC. 9. Uncontrolled Mobile Equipment: Incidents where large mechanical equipment (fork trucks, backhoes, railcars, lifts, etc.) are in an uncontrolled state and have the potential to breach the mechanical integrity of process containing equipment. The process containing equipment could be either the transport vessel itself or equipment in a nearby process plant. 10. Violation of Process Safety Rules: A violation of a facility's process safety rules. 11. SIS Activation: The activation of an identified safety instrumented system 12. Miscellaneous: Additional business, site or facility identified criteria Global Congress on Process Safety - 2012 __________________________________________________________________________ 7. Conclusion After almost 15 years of continuous operation, the Multifunctional Pilot Plant has demonstrated its operational capabilities meet all Process Safety requirements, with outstanding results. This is especially true when considering the number of personnel and variety of operations at the facility. We can attribute this successful case to the components of its overall Safety program: - Detailed and multi discipline risk assessment during design, construction and start up of projects - Permanent post start up verification of operations to assure compliance with safety requirements, experimental design objectives and personnel safety performance - Management of Changes with involvement of external SMEs - Reporting, investigation and correction of root causes associated to Process Safety Incident and Near Misses - Clear set of personal safety performance expectations related to safety and operational training