Safety: My Five Lessons from Five Decades of Engineering

Tom Baxter shares safety lessons learned from across his career

PROCESS safety is an integral part of most chemical engineers’ responsibilities. It has been a significant feature of my career since my first role as a chemical engineer on a petrochemical site in the mid-1970s.

I have collected a large number of process safety case studies over the years and the following describes five case studies that have left a life-long impression on me. I have selected one from each decade of my career.

1970s: Permit-to-work and competency

I was a Shift Manager commissioning a pigment production plant. I was writing 20-30 permits a day. One was a permit-to-work for a replacement pump discharge non-return valve that went all wrong.

The system is shown in Figure 1. An amine-based solvent was stored at a tank farm. The amine was a health hazard, as on contact it is absorbed into the bloodstream, resulting in severe illness. The main storage tank fed a much smaller day tank located on the plant roof. The day tank was fed by a centrifugal pump with a discharge non-return valve. To prevent back syphoning, the day tank dip leg was fitted with an anti-syphon hole; it also had a sight glass and level bubbler.

During commissioning we couldn’t get the level bubbler to work, so in order to keep the commissioning schedule on track, the day tank was manually filled using the sight glass.

A crack in the transfer pump discharge non-return valve was noted and required replacement. I had the pump isolated, drained and cleaned, and the suction and discharge chained closed. I issued a permit-to-work for its replacement by the maintenance team.

What subsequently happened was not what I expected – the pipe fitter broke a flange outwith the chained isolation. The fitter was drenched with amine syphoning back from the day tank while trying to re-make the flange connection.

Syphoning should have been prevented by the anti-syphon hole at the top of the dip pipe.

The subsequent incident investigation showed that the dip pipe and the level bubbler pipe had been swapped. The anti-syphon hole was on the bubbler, hence the reason the level controller was not working and there was no anti-syphon protection on the dip pipe.

The Factories Inspector (now the HSE) investigated the incident and I was criticised for not checking how the fitter would change the non-return valve. My counter was that I did not expect a competent pipe fitter to break a connection beyond the chained isolation.

The life-long learning for me was: don’t assume people will do what you believe to be obvious.

Another lesson was why provide a design where the bubbler and dip pipe could be wrongly installed – have two different nozzle sizes or bolt patterns perhaps?

The life-long learning for me was: don’t assume people will do what you believe to be obvious

1980s: Gas blowby – the unidentified risk

On 21 March 1987 a hydrocracker unit at the Grangemouth, UK refinery was being recommissioned following a routine shutdown. The following morning there was a violent explosion and subsequent fire. The explosion occurred on a low pressure (LP) separator vessel and could be heard and felt up to 30 km away (https://bit.ly/3NYy0cM).

An unidentified overpressure scenario was the root cause.

A common arrangement across many industries is a high pressure system feeding a low pressure system. The low pressure system is designed to a lower pressure than the feeding high pressure, thus the low pressure system has to be overpressure protected. Figure 2 shows a generic arrangement with the design pressure break at the LCV 1 - the HP/LP interface. It is generally at the last valve where on closure high pressure would be experienced.