Microsoft Word - 1.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 77, 2019 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Genserik Reniers, Bruno Fabiano Copyright © 2019, AIDIC Servizi S.r.l. ISBN 978-88-95608-74-7; ISSN 2283-9216 A Safety-Walk for Ageing Control at Major-Hazard Establishments Maria Francesca Milazzoa,*, Paolo Angelo Bragattob, Giuseppe Sciontia, Maria Grazia Gnonic aDipartimento di Ingegneria, Università degli Studi di Messina, Messina (Italy) bDipartimento Innovazione Tecnologica, INAIL, Monteporzio Catone (Italy) cDipartimento di Ingegneria Ingegneria dell’Innovazione, Università del Salento, Lecce (Italy) mfmilazzo@unime.it The Seveso III Directive requires plant operators have to monitor and control the ageing of critical equipment in order to prevent losses due to corrosion and other deterioration phenomena. It is essential to verify and demonstrate the adequateness of measures adopted for these purposes, therefore there is a need of methods and tools supporting these duties. A huge amount of data coming from smart sensors and information related to the Safety Management System have to be gathered and managed. They must be presented in an effective way during internal and external audits. To overcome the difficulties in facing such duties, a digital log of primary containment equipment is needed; this is particular important when equipment has the potential to cause major accidents, because it is affected by many concurrent deterioration mechanisms and cannot be easily replaced, thus its lifetime is very long. Based on this register, the actual ageing status can be presented in visual effective form during a safety-walk around the plant. This paper presents a system solving these issues and providing support to operators and Control Authorities; the core of the system is an ageing prognostic model, based on accelerating and slowing down factors. 1. Introduction Ageing of equipment is the cause of many accidents in European process industries; evidences of this can be found in emars, the public database of major chemical accidents, managed by the European Commission in the framework of European Seveso Directives for the control of major accident hazard (Wood et al., 2013; OECD 2017; Gyenes & Wood, 2016). According to recognised definitions (Wintle et al., 2006; Horrocks et al., 2010), ageing is the effect of deterioration mechanisms on equipment over the years. Deterioration mechanisms include corrosion, erosion, mechanical and thermal fatigue and many other phenomena weakening the metallurgical properties of the materials. The control of ageing is particularly important for primary containment systems, which include vessel and pipes (both pressurized or not). Deterioration may cause a failure or a rupture of the containment system, which in turn may cause a loss of hazardous materials with severe consequences for workers, environment and asset (Palazzi et al., 2015; Vairo et al., 2017). Containment systems are the core of process plants and are not easily replaceable, due to both costs and technical difficulties, whereas the replacement of other systems (including machines and control systems) is much easier. Obsolescence is a further effect of time on equipment, but it does not depend on chemistry and physics, but just on laws, regulations, technical rules and standards, which make a system unusable over the time, even though it is still in good condition. Methods and techniques dealing with ageing and obsolescence are absolutely different and this paper focuses just on the first one. Amongst various systems, the operator of a Seveso establishment must focus on “critical systems”, defined as those whose failures are able to cause a top event, as identified in the quantitative risk assessment (according to the Seveso Directive). In the common practice of process industry, the shortcuts of Fault Tree Analysis (FTA) are able to identify critical systems. DOI: 10.3303/CET1977159 Paper Received: 6 February 2019; Revised: 26 April 2019; Accepted: 7 July 2019 Please cite this article as: Milazzo M., Bragatto P., Scionti G., Gnoni M., 2019, A Safety-Walk for Ageing Control at Major-Hazard Establishments, Chemical Engineering Transactions, 77, 949-954 DOI:10.3303/CET1977159 949 Ageing depends on many factors (Bragatto & Milazzo, 2016), including initial design criteria, control of process conditions, maintenance, inspection program, management of changes and repairs, management of technical documents and personnel skills. To pay attention to these factors may assure equipment longevity (Milazzo et al., 2018), given that they may affect the failure rates and, thus, extend the residual useful life (defined as the expected minimum time before the failure). In this context, inspections are the main way to know the actual condition of equipment. These include on-line measurements, visual inspections, non-destructive testing on site, sampling and laboratory tests and invasive testing. Unfortunately, only a few deterioration mechanisms are easy to be detected. The selection of the technique depends on the mechanism: the external corrosion of an atmospheric tank, for instance, may be detected just searching for the rust on its surface, but most mechanisms act inside the material and require complex and difficult methods to understand the actual conditions. In many industries, such as refineries, planned stop period is 10 years and in the meanwhile the operator must trust on less effective methods, including indirect measurements, partial testing and mathematical models. In Seveso establishments the operator has to adopt a very conservative approach, in order to overcome those uncertainties. Nevertheless, to make the right decisions, he/she needs to see the actual condition of materials inside the vessels or pipes. This is also important for the auditor, which has to understand in a short time these conditions. A few years ago, this was possible just for the rust over the tanks, while today new methods and technologies make this possible. The enabling technologies include smart identification of equipment, wireless communication and cloud computing, which must be combined with a model for the ageing assessment. The enabling model is the new index method (so-called fishbone model) developed by a group of Italian scientists and practitioners that has been adopted by the National Competent Authority for the application of the Seveso Directive (Bragatto et al., 2018). The objective of this paper is to discuss how the combination of models and technologies allow assessing and managing ageing. Section 2 discusses in detail the method and its potential for actual conditions’ understanding when combined with enabling technologies; Section 3 discusses in detail the equipment tagging and the organisation of the database for the implementation of the prototype of equipment log. Section 4 discusses the potential of the safety-walk both for operators and auditors. Section 5 presents some conclusions and future perspectives in implementing more advanced tool for ageing assessment. 2. Method and tools for ageing assessment and management To understand the actual conditions of an equipment with respect to the effects of the deterioration mechanisms, the combination of the fishbone model for ageing assessment (Bragatto and Milazzo, 2016) with some innovative technologies is proposed in this paper. These enabling technologies includes different IOT (Internet of Things) technologies for a smart identification of equipment and cloud computing to store equipment data. 2.1 The fishbone model for ageing assessment The fishbone model for ageing assessment has been developed with the aim to face the requirement of the Directive Seveso III related to the control and management of equipment ageing. It offers a valuable support to the auditor, which has to understand in a very short time the adequateness of the activities performed to delay, as long as possible, the effects of deterioration mechanisms. The fishbone method (final version reported by Bragatto et al., 2018) is an index approach, which defines the ageing status of the equipment based on accelerating and slowing-down factors. It consists in assigning to both accelerating and slowing- down factors a score, respectively, in the form of a penalty or a compensation. As shown in Figure 1, accelerating factors include age/in-service time, deterioration mechanisms, defects/damages, failures, stops and accidents/near-misses; whereas retarding factors include integrity management system, audits SMS, adequacy controls, inspection results, process control and physical protections. Factors are defined as given below: • Age/In-service time = ratio between current age and maximum designed age or ratio between current operating hours and maximum allowed in-service hours. • No. unplanned stops = ratio between number of unplanned stops and total number stops over a reference period. • Failures = ratio between actual number of equipment failures over a reference period and number of expected failures according to generic failure rates used in the Safety Report. • Accidents/Near-misses = ratio between number of accidents and near misses due to ageing and total number of recorded events over a reference period. • Deterioration mechanisms = average value amongst three scores related to the consequences of the degradation (i.e. dimension of leakage), the ability to detect the main damage mechanisms (by an inspection technique) and the velocity of propagation of the phenomenon. 950 • Defects/Damages = percentage of serious damage detected over the reference period, compared to the number of critical equipment. • Audits SMS = average a score, obtained during the audits of the Safety Management System, as required by the regulation for the control of Major Accident Hazard, it is the average value between two scores related to the number of examined points and number of non-conformities. • Integrity management system = performance level of inspection management procedures (e.g. periodical, risk-based RBI, dynamic RBI, etc.). • Inspection results = average value among three scores accounting for the inspections planning and the results of tests that verify the functionality and integrity of the systems. • Adequacy control = average value among two scores accounting for the extension and degree of coverage of techniques, and qualification of inspectors. • Process control = performance level of the process control systems (e.g. automated inter blocks, certified IEC 61508 and IEC 61511, etc.). • Physical protections = average value between two scores accounting for the frequency of the controls and the actual condition of the protective systems (e.g. lining, coating, cathode protection, etc.). Figure 1: Fishbone model (Bragatto et al., 2017). Each score (penalty or compensation) is assigned by referring to a four-level scale: 1 = low; 2 = medium; 3 = medium-high; 4 = high. Assignment criteria for the scores are given by Bragatto et al. (2018). A sign will be also associated with the score that will be negative for penalties and positive for compensations. By summing penalties and compensations the ageing status can be assessed. If the cumulated compensations are greater or equal to the cumulated penalties, the activities that are in place for the ageing management are adequate. 2.2 Equipment tags To visualise the equipment status by means of the fishbone model or other prognostic models and by using innovative technologies, the first problem is to uniquely identify equipment in an automatic way: the idea is to attach a tag based on IOT technologies, which communicates automatically with the software for acquiring information about the equipment by using mobile devices provided to operators. As given by the literature (Gnoni et al., 2016), two main technologies have been already evaluated: the first one is the Near Field Technology (NFC), which allows a proximity communication between the equipment and the mobile devices; the latter is the Bluetooth Low Energy (BLE) technology, which provides longer distance for communication. Both technologies are characterised by benefits and limitations: an NFC tag attached to the equipment will provide a really unique identification as the communication range is very short, thus interferences due to other equipment or structures are not present. The main limit of this solution is the lower “flexibility” provided, as with BLE technologies the communication between the tag attached to the equipment and the mobile device is allowed without being in proximity. Thus, the communication range characterising BLE tags is about 4 - 5 m, allowing the operator a longer distance to the equipment (Figure 2). More efforts, mainly due to avoid interferences between the plant environment and the tag, are required when BLE technology is adopted to equipment identification. Both technologies provide communication locally at plant level without the need of an internet connection and they are characterised by precise standard for communication thus enabling the use of all type of mobile devices compared to other IOT technologies requiring dedicated devices; these features 951 contribute to reduce also the cost of infrastructure required for equipment identification. Moreover, both solutions are in laboratory testing phase. Figure 2: The automatic identification process with the two IOT technologies 2.3 Equipment log The equipment log is a management software, which keeps track of a set of events that can happen to the equipment of an industrial plant, under a unity logic. The word event is used in a very wide way, it includes gathering of data, the change of information, etc.; it must not be misunderstood with “accident” or “failure event”. Therefore, the term set of events refers to the set of acquired information related to the factors and linked to the equipment ageing. Two sets are considered: the first one includes events related to accelerating factors (i.e. events that speed up ageing) and the second one contains events associate with slowing-down factors (i.e. events that retard the phenomenon). These two classes of factors are appropriately “noted” in the equipment log and build the “ageing history” for the equipment. The logical structure of the equipment log is shown in Figure 3. It is a tree structure, where the root is the establishment, followed by the logical units and, therefore, the critical equipment. Each node of the tree, represents a physical entity and a set of events is associated with each entity. An event represents an "information container", each one is associated with the date (the time when the event occurs), the entity to which the event is associated, the information about what the event represents in the fishbone model and, finally, the set of numerical values or data, which contributes to define accelerating or slowing down of the ageing of the equipment. Figure 3: Logical structure of the equipment log. 3. Implementation of the prototype of the system for a safety-walk A system prototype for safety-walks has been implemented, it consists of a tool to present the actual ageing status in a visual form during a walk around the plant. Given that a huge amount of data coming from smart sensors and information related to the Safety Management System have to be gathered, managed and presented in an effective way during internal and external audits, the previous mentioned equipment log is a fundamental part of the system. The core of the system is an ageing prognostic model, based on accelerating a slowing down factors, discussed above and which allows elaborating: • ageing indexes for the equipment (or, at higher levels, for the logic unity and the industrial plant); • updated frequencies of failure, using a model that modifies general frequencies from the literature based on judgment on the effectiveness of the safety management system and the adoption of measure for risk reduction (Milazzo et al. 2010); • residual lifetime for the equipment based on a generic model, such as that proposed by the European Standard CEN TC319. 952 The equipment log is a web application, which can be retrieved from any browser. It provides the following functionalities: management of logical units and equipment, management of ageing-oriented “events” related to the plant, logical units and equipment; management of inspectors (which consists in the possibility of registering one or more users to access to the register); management of downloaded data by logical units, this functionality consists in exporting the data of a logical unit (equipment list, accelerating/slowing-down factors) in JSON format. Figure 4(a) shows hardware and software used for the realisation of the first prototype of the equipment log. A Raspberry PI works as a server, in which the webService NodeJs has been installed with the related management software and a MySql database. The system works locally on a LAN of the plant, where any authorised user can access it through a browser. (a) (b) Figure 4: (a) Prototype equipment log. (b) Safety-Walk application for ageing control. 4. Safety-Walk for ageing control 4.1 Concept There are two modalities of using the prototype for the safety-walk: (i) the walk is made to gather data to update the fishbone model or other prognostic models; (ii) the walk is made to assess and update ageing indexes to the individual containment system. The second modality is interesting as it allows recalculating expected useful lifetime (or probability of failure within a certain time, the time before a failure, the time before a top event) of a piece of equipment, according to the models mentioned in Section 3. 4.2 Technology Figure 4(b) shows the scenario implemented to allow an inspector performing the safety-walk by using the developed system. The safety-walk consists of an "advanced" inspection of one or more equipment, logical units or the entire establishment. For each equipment, through the data contained in the register, the inspector will determine information about ageing, in the form of an index (as provided by the fishbone model), a failure probability or a residual lifetime, as well as other information about the equipment (mainly data). The "tools" used for the safety-walk are mobile devices or smartHelmet. The mobile device (tablet and/or smartPhone) includes an Android App that, once it has been installed, will download the log data in a JSON format and for each equipment will applies the prognostic models, obtaining the ageing status that is shown on the display. In the following, a brief summary of the dynamic of the safety-walk and the interactions among equipment, IOT devices, mobile devices and the prognostic models is given. The operator walks inside the plant with his/her mobile device or helmet: each time he/she arrives nearby the equipment, where the IOT tag is attached, the 953 device automatically identifies the equipment through an Android App. All information about the maintenance “history” are available for reading and updating through the device. A QR code will be also attached to the equipment aiming to provide a redundancy identification system, in case the IOT tag is characterised by a fault. The App could be used also by a maintenance operator to update, directly from the workplace, information about activities that must be reported in the equipment log (e.g. fault, repair actions, etc.). Further developments relate the connection of online sensors to IOT tags; thus, the App will determine the residual life of the equipment also by using more advanced prognostic models. 5. Conclusions The control of major accident hazard and the management of asset integrity have to be strictly merged to achieve the objective to maintain the same safety level along the entire lifecycle of process plants. The conditions for a safe ageing have to be set in the early stage of the equipment life. Therefore, the Safety executive at a Seveso site must have a continuous cognisance of the “health condition” of each critical equipment, even though testing and maintenance are in charge of other units. For the same reason, the Seveso auditors cannot carry out their task just looking at compliance of the procedures. They must have also an understanding of the actual equipment status, as well as what could be the future trends. The proposed solution exploits the potential some enabling technologies, to provide safety for operators, by means of a method giving an insight of the equipment conditions, to the extent that is relevant for major accident prevention. The solution is quite complex, as integrating a deep knowledge about deterioration processes, a careful management of information and a large gathering of data. The user-interface hides all these difficulties to operators, which usually are not expert in corrosion science. The application presented is at the first steps, but there are reasonable expectations for a good acceptance by operators, because it is consistent with official guidelines and up to date with smart technologies. The project, under which this work has been performed, is at half progress and results of planned on-site experiments will give the opportunity for further improvements. Acknowledgments This work is supported by INAIL (Istituto Nazionale per l’Assicurazione contro gli Infortuni sul Lavoro) within the call BRIC 2016/ID15, SmartBench project. References Bragatto P., Delle Site C., Milazzo M.F., 2018, Audit of Ageing Management in Plants at Major Accident Hazard, IEEE Proceedings 2nd International Conference on System Reliability and Safety ICSRS, 400-405. Bragatto P., Milazzo M.F., 2016, Risk due to the ageing of equipment: Assessment and management, Chemical Engineering Transactions, 53, 253-258. Gnoni M.G., Elia V., Bragatto P.A., 2016, An IOT-Based System to Prevent Injuries in Assembly Line Production Systems, IEEE International Conference on Industrial Engineering and Engineering Management, 1889- 1892. Gyenes Z., Wood M.H., 2016, Lessons Learned from Major Accidents Relating to Ageing of Chemical Plants, Chemical Engineering Transactions, 48, 733-738. Horrocks P., Mansfield D., Thomson J., Parkerv K., Winter P., 2010, Plant Ageing Study Phase 1 Report. Health and Safety Executive Report no. RR823. Available on-line: www.hse.gov.uk. Milazzo, M.F. Bragatto, P.A. Ancione, G. Scionti, G., 2018, Ageing Assessment and Management at Major- Hazard Industries, Chemical Engineering Transactions, 27. Milazzo, M.F., Maschio, G., Uguccioni, G., 2010, The influence of risk prevention measures on the frequency of failure of piping, International Journal of Performability Engineering, 6(1), 19-33. OECD Organisation for Economic Cooperation and Development, 2017, Ageing of hazardous installations. OECD Environment, Health and Safety Publications - Series on Chemical Accidents, no. 29. Palazzi E., Currò F., Fabiano B., 2015, A critical approach to safety equipment and emergency time evaluation based on actual information from the Bhopal gas tragedy, Process Safety and Environmental Protection, 97, 37-48. Vairo T., Del Giudice T., Quagliati M., Barbucci A., Fabiano B., 2017, From land- to water-use-planning: A consequence based case-study related to cruise ship risk, Safety Science 97, 120-133. Wintle J., Moore P., Henry N., Smalley S., Amphlett G., 2006, Plant ageing. Management of equipment containing hazardous fluids or pressure. Health and Safety Executive Report no. RR509. Wood M.H., Arellano A.V., Van Wijk L., 2013, Corrosion Related Accidents in Petroleum Refineries. European Commission Joint Research Centre Report no. EUR, 26331. 954