Microsoft Word - 42landucci.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 82, 2020 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Bruno Fabiano, Valerio Cozzani, Genserik Reniers Copyright © 2020, AIDIC Servizi S.r.l. ISBN 978-88-95608-80-8; ISSN 2283-9216 Application of HAZOP, LOPA and SIL to an Alkylation Unit in a Refinery: a Case Study Juliana Puello*, Sonia Gómez, Ingry Ruiz, Stefany Lombana, Stefanny Figueroa Chemical Engineering Department, Universidad de San Buenaventura Cartagena, Dg 32 #30-966, Cartagena, Colombia jpuello@usbctg.edu.co In a refinery, an alkylation unit is a process for producing gasoline range material (alkylate) from olefins such as propylene, isobutene, butylene, and pentene. In the alkylation process, light hydrocarbons from the Fluid Catalytic Cracking Unit (FCC) react in presence of a catalyst (hydrofluoric acid or sulphuric acid), to form a mixture of heavier hydrocarbons. After the reaction, the alkylate meets the specification as high octane gasoline. Important safety considerations in this process are related to the catalyst. For example, if hydrofluoric acid (HF) is used, its high vapour pressure, making it easily vaporized if a leak occurs in the units. HF can travel a significant distance as a dense vapour. Even though a small concentration of HF is used in the reaction, it is still enough to cause human and environmental problems, since it is a very corrosive and toxic inorganic acid. The objective of this study was to evaluate the hazards in the alkylation unit at a refinery located in Latin America, applying HAZOP, LOPA, and SIL methodologies. This study is based on the assumption that the process operates according to the conditions intended in its design, thus the risk and operability problems are unlikely to occur. The HAZOP (Hazard and Operability Study) analysis covered 13 sections of the alkylation process. Hazardous scenarios were categorized as: related to safety, environmental, and financial; each topic was also risk ranked to assess the strength of existing safeguards. The causes of hazardous scenarios were identified including human error, equipment failure, and external events. The severity of deviations was evaluated without any protection or safeguards. From all the deviations that were analysed, 24 scenarios were identified as significant risk and of high risk. These scenarios were then analysed by LOPA (Layer of Protection analysis) and SIL (Safety Integrity Level) methodologies, to identify the layers of protection that mitigate the hazardous scenarios found in the HAZOP analysis, as well as assigning a PFD (probability of failure on demand) value on each safeguard. Based on this, recommendations are provided, to mitigate the consequences or improve the operational capability 1. Introduction The alkylation unit performs an important role, since its product, a high-value alkylate, is used as a gasoline blending component. HF alkylation unit converts some products that are of limited use (i.e. butane, propene, butane) to iso-butane (Tamm et al., 2018). On the other side, the hydrofluoric acid (HF) catalysed alkylation represents potential hazards for the process itself and the people who operate it, so the units for this process meet high safety special requirements for their construction materials and operational practices contemplated in its design, construction and operation (Vogt and Weckhuysen, 2015) and also follow an adequate safety system for its operation. If released in the atmosphere, HF rapidly forms dense vapor clouds that hover near land and can travel great distances. Like other powerful acids, HF can cause deep severe burns and damage the eyes, skin, nose, throat, and respiratory system. Also, if HF enters the body through a burn or by the lungs, it can cause internal damage throughout the body (Bajraktarova-Valjakova et al., 2018). At high enough exposures, HF can kill. The Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) regulate HF as highly toxic (United Steelworkers, 2013). The efficient operation of an HF catalysed alkylation units is a complex task and subject to the most testing of operating regimes, due to industry-specific constraints and operating issues that stretch the processing capability of the plant. Based on what is mentioned above, this study is aimed to identify and review best safety practices for proper operation DOI: 10.3303/CET2082058 Paper Received: 5 January 2020; Revised: 9 April 2020; Accepted: 2 August 2020 Please cite this article as: Puello J., Gomez S., Ruiz I., Lombana S., Figueroa S., 2020, Application of Hazop, Lopa and Sil to an Alkylation Unit in a Refinery: a Case Study, Chemical Engineering Transactions, 82, 343-348 DOI:10.3303/CET2082058 343 and performance of an alkylation unit catalyzed with hydrofluoric acid (HF) by applying HAZOP (Hazard and Operability Study), LOPA (Layer of Protection analysis) and SIL (Safety Integrity Level) methodologies. 1.1 Hazard and Operability Study (HAZOP) methodology The HAZOP methodology is used to identify major process hazards or operability issues related to the process design. It aims is to identify all conceivable deviations far from design intentions in the plant and to determine the possible abnormal causes and the adverse consequences of those deviations (Benedetti et al., 2018). The considerations of the team are provided in the following two aspects: 1) determining whether a given operation or activity has the potential to start a hazardous situation, and 2) determining the range of hazardous events associated with the operation or activity. When analyzing a deviation, it is advised to consider the worst-case scenario, so it should be assumed that no safeguard is installed in the facilities. Also, the most severe consequences must be taken into account. 1.2 Layers of Protection (LOPA) analysis The LOPA analysis is an analytical tool for assessing the adequacy of protection layers used to mitigate process risk. It includes simplified methods to characterize the consequences and estimate the frequencies of an incident. Its primary purpose is to determine whether there are sufficient layers of protection against a specific accident scenario. The layers of protection are the following: Design, Basic Process Control Systems, Critical Alarms, Human, Safety Instrumented Functions, Physical Protection (relief devices), Post-response Physical Protection, Plant Emergency Response, Community Emergency Response. The steps to carry on a LOPA analysis are: 1) From HAZOP, choose the scenarios that are of Significant Risk or High Risk; 2) Estimate the potential risk; 3) Define the tolerable risk (this is, the tolerable maximum frequency of mitigated event); 4) Analyze the layers of protection and establish the independent layers of protection; 5) Assign a risk factor reduction; 6) Estimate the overall consequence frequency to compare with acceptable risk criteria, which is 1 x 10 -8 / year, and 7) Evaluate and repeat the process if necessary (Willey, 2014). Literature provides the values of the Probability of Failure on Demand (PFD) for independent protection layers (Kojo and Manninen, 2019). 1.3 Safety Integrity Level (SIL) analysis A SIL is a measure of safety system performance or probability of failure on demand (PFD) for a Safety Instrumented Function (SIF) or a Safety Instrumented System (SIS). There are four levels of SIL (SIL1, SIL2, SIL3, SIL4). The higher the SIL level, the lower the probability of failure on demand for the safety system, and the better the system performance (Delavar et al., 2016). In this study, SIL analysis is done to assess the amount of risk reduction necessary to maintain the risk of the process at an acceptable level. 2. Methodology To develop the HAZOP, LOPA and SIL analysis, the first stage was a detailed study, concerning the alkylation process and how it works, to identify the operating principles of the alkylation unit as well as the main variables of the process, and also to select the nodes to be evaluated. To do this, it was needed to systematically carry on a review of the Process Flow Diagrams (PFD), Piping and Instrument Diagrams (P&ID), and plant manuals by a multi-disciplinary team (Crawley and Tyler, 2015). Forty-eight nodes that are distributed among thirteen units were considered for this study, as it is shown in Table 1. For each node, deviations were analyzed, regarding guide words and the relevant process variables. Each association between a guide word and a variable represented a hazard scenario. Each hazard scenario was categorized as affecting safety (S), environmental (E), and financial (F). Also, each scenario was ranked according to its estimated severity and likelihood of occurrence, to determine the risk ranking. Regarding the severity level, a category (S1 Negligible, S2 Minor, S3 Significant, S4 Major, S5 Catastrophic) was assigned to each scenario, according to the effects on the safety (the health of personnel), environment or finances, while the likelihood (frequency) was assigned from a list of five levels (F1 Improbable, F2 Remote, F3 Rare, F4 Probable, F5 Frequent). The risk ranking, as a result of the relation between the severity and the likelihood (frequency) of each hazard scenario, can take the following levels: Low (L), Medium (M), Significant (S), High (H) or No Ranked, according to a Risk Matrix (Mannan, 2012), as it is shown in Figure 1. 3. Results 3.1 HAZOP analysis For this analysis, the relevant variables were: Temperature, Pressure, Level, Charge composition, Concentration, and Flow. The guide words applied were “More”, “Less”, and “None”. Twenty-four scenarios 344 were found to be of significant risk and high risk in nine of the thirteen sections of the HF alkylation unit, as it is shown in Table 2. These twenty-four scenarios were then analyzed by LOPA and SIL methodologies. Table 1: Sections and nodes analysed by HAZOP in the HF alkylation process unit Sections Nodes Selective Hydrogenation Feed surge drum, Heat exchanger, Condenser, Reactors, Stripper Charge and drying Surge Drum, Olefin feed dryers in use, Olefin feed dryers in regeneration, Condenser, Coalescer Reaction Reactor, Acid settler Acid Storage HF Acid container, Acid storage drum, Acid dump drum Cooling water tower TAE Cooling tower Isostripper Isostripper surge Drum, Isostripper tower, Depropanizer feed settler Depropanizer and HF Stripper Depropanizer, Depropanizer receiver, Isobutane flush filter, HF Stripper, Propane flush filter Propane treatment section Propane exchanger, Propane alumina treaters, Propane KOH treaters Debutanization and alkylate treatment Debutanizer tower, Reflux drum, Alkylate filters, Alkylate treatment drum n-Butane treatment section Heat exchangers and condenser, Treaters with alumina, n-butane coalescers, KOH treatment drums, Additive treatments ALKAD regeneration Fresh additive charge – additive storage drum, Additive stripper, Additive stripper receiver, Additive stripper bottoms separator HF regeneration Acid regenerator, Isobutane superheater, Condensate pot, Polymer surge drum, Polymer neutralizer, Closed drain drum Effluent treatment Liquid Knockout drum, Neutralizing drum, Relief gas scrubber, KOH regeneration tank, Neutralizing basin Figure 1: Risk matrix and definitions Table 2: Significant and high-risk scenarios Section Total number of scenarios Number of Significant risk scenarios Number of High- risk scenarios Selective Hydrogenation 176 4 0 Charge and Drying 113 3 0 Alkylation reaction 50 1 0 Propane treatment 62 2 0 Debutanization and alkylate treatment 72 1 0 n-Butane treatment 103 2 0 HF regeneration 112 3 2 Cooling water 15 1 0 Effluent treatment 71 5 0 3.2 LOPA and SIL analysis Based on the HAZOP findings, and for illustration purposes in this paper, the HF regeneration section was chosen to explain the LOPA and SIL analysis applied in this study. Three scenarios were evaluated as of significant risk and two scenarios were evaluated as of high risk, as it is shown in Table 3. 345 Table 3: Summary of HAZOP, LOPA, and SIL for HF Regeneration section Node P.P. Dev S F R I.E.F Independent Protection Layers PFD O.C.F. SIL for SIF SIL P.D. P. E.R. Acid regenerator Temperature More 4 3 12 1 E-3 1 E-2 1 E-2 1 E-2 1 E-9 1 E 1 -- Acid regenerator Temperature More 4 3 12 1 E-3 1 E-4 1 E-1 -- 1 E-8 0 -- Acid regenerator Pressure Less 4 3 12 1 E-3 -- 1 E-2 1 E-2 1 E-7 1 E-1 1 Closed drain drum Pressure High 5 4 20 1 E-2 1 E-1 1 E-2 1 E-2 1 E-7 1 E-1 1 Closed drain drum Pressure High 5 4 20 1 E-2 1 E-1 1 E-2 1 E-2 1 E-7 1 E-1 1 Abbreviations: P.P. = Process Parameter; Dev = Deviation; S = severity; F = frequency; R = Risk; IEF = Initiating Event Frequency; P.D. = Process Design; P. = Procedure; E.R. = Emergency Response; O.C.F. = Overall Consequence Frequency Probability of failure on demand (PFD) values were based on documents from CCPS (2001), which report comparisons between PFD reported by industry and by CCPS. Based on Table 3, the three significant risk scenarios in HF regeneration are explained as follows: • High temperature in the acid regenerator. As it is shown in Table 3, for this scenario, the work team considered severity of 4 (Major), and a frequency of 3 (Rare), so this event represents a risk of 4 x 3 = 12 (Significant). The possible cause of this scenario is a failure in the flow control valve (FV), which would make it stay closed, resulting in a decrease in the HF inlet flow. This valve failure would also result in a decrease in the removal of soluble pollutants in the acid. Regarding the consequences, no significant consequences would develop in the short term, but in the long term this would potentially cause a higher overhead temperature in the regenerator, a loss of acid purity that would eventually result in a runaway reaction, or corrosion that would result in leaks that in turn would cause personnel injury; another consequence would be an undesirable increase in the production of organic fluorides and polymerization in the reaction section. A first recommendation to avoid this scenario is to install a Flow Indicator Controller (FIC) in the inlet line of the acid regenerator column, to ensure the operational range in case of a fail in the FC valve or its FIC. Another recommendation is to verify the sampling schedule for isobutane and olefin feed. Also, it is recommended to add a HF/water ratio analyzer on the acid circulation loop of the alkylation reactor and create a calculation in the pressure control system (PCS) for the acid regenerator isobutane/acid ratio. The existing safeguards that would control this scenario were identified as 1) Intermittent flow from ALKAD section; 2) Lab sampling; 3) Handwheel on flow control valve; 4) Temperature indicator controller which will add reflux to maintain the overhead temperature at the regenerator; and 5) Operator procedures, training, and response. Considering that the initiating event frequency is 1 E-03 (suggested by the work team), and the probability failure on demand (PFD) for each of the independent process layers (IPL) was: process design: 1 E-2 PFD; basic process control systems (BPCS): 1 E-2; procedures: 1 E-2 PFD, the overall consequence frequency is 1 E-03 x 1 E-02 x 1 E-02 x 1 E-02 = 1 E-9. Based on this value, it is observed that the hazard generated by this deviation is mitigated with the safeguards that exist already. • High temperature in the acid regenerator. In this case, the possible cause of this scenario is that the temperature control valve (TV) fails and stays closed. The consequences related to this scenario would be a decrease in the isobutane flow from the depropanizer and HF stripper section which would cause the following: the higher potential of corrosion in the acid regenerator column, dragging of pollutants to isostripper section, loss of regenerator reflux causing higher overhead temperatures and, on the long term, the potential of increased impurities in the acid and eventually, acid runaway. 346 The recommendations to avoid this scenario consider the installation of a high-temperature alarm in the line, together with the constant monitoring of the temperature from the control room, and also periodic maintenance of the controllers (setpoint adjusting) and valves. As it is shown in Table 3, this scenario has a severity of 4, a frequency of 3, and a risk level of 12 (significant). The following safeguards were identified: 1) Flow indicator; 2) Temperature indicator; 3) Handwheel on TV; and 5) Operator procedures, training, and response. Considering that the initiating event frequency is 1 E-03, and the probability failure on demand (PFD) for each of the independent process layers (IPL) was: process design: 1 E-4 PFD and procedures: 1 E-1 PFD, the overall consequence frequency is 1 E-8. Based on this value, it is observed that the hazard generated by this deviation is mitigated with the safeguards that exist already. • Low pressure in the acid regenerator. The possible cause of this scenario is that the manual valve at the top of the regenerator is left open. The consequences for this scenario would be possible fire explosion due to hydrocarbon spill, air pollution, injuries to the employees due to acid spill (and possible death of employees in case of exposure to high concentrations), equipment damage, economic losses, non-programmed stop and total evacuation of the unit. The recommendations to avoid this scenario are: changing the manual valve for a safety valve at the top of the column and install a bypass system to send the stream to the flare header to reduce the risk for the employees to be exposed to an HF leak. For this scenario, severity of 4, frequency of 3 and risk of 12 S (significant) was obtained, and the only safeguard identified was the operator procedures, training, and response. Considering that the initiating event frequency is 1 E-3 and that the probability failure on demand (PFD) for each of the independent process layers (IPL) was: procedures: 1 E-2 PFD and emergency response: 1 E-2 PFD, the overall consequence frequency is 1 E-7. To reach an overall consequence frequency of 1 E-8, a SIL of 1 E-1 (SIL 1) must be implemented, which corresponds to the recommendation of changing the manual valve located at the top of the vessel for a relief valve that will help prevent air pollution and system from exceeding specified overpressure. It is worth noting that the effectiveness of this device is sensitive to service and experience. Also shown in Table 3, two scenarios were evaluated as of high risk in HF regeneration section: • High pressure in the closed drain drum. The possible cause of this scenario is that the bypass system of PCV is left open, which causes an increase in the nitrogen flow rate. The consequences for this scenario would be full nitrogen pressure on the drum and vent header, and at the worst case, during decommissioning with the vent line blocked inside. Another consequence would be potential overpressure of the slop drum, leading to flange leaks, loss of containment, and personnel injury. The recommendations to avoid this scenario are: considering to move the pressure indicator and the restrictive orifice of the nitrogen line, to the slop drum vent downstream of the bypass PCV; also to install a pressure indicator in the top of the drum to monitor the pressure; also to review the design pressure of the slop closed drain drum (this, considering that the maximum nitrogen pressure on the purge of the drum and vent piping is around 95 psig, and the current design pressure of the drum is 50 psig). A severity of 5, frequency of 4, and risk of 20 (high risk) was obtained for this scenario, and the following safeguards were identified: 1) Pressure indicator; 2) Restrictive orifice; 3) Operator procedures, training, and response. The frequency for this event was considered as 1 E-2, and that the probability failure on demand (PFD) for each of the independent process layers (IPL) was: process design: 1 E-1 PFD, procedures: 1 E-2 PFD and emergency response: 1 E-2 PFD, so the overall consequence frequency has a value of 1 E-7. To reach an overall consequence frequency of 1 E-8, a SIL of 1 E-1 (SIL 1) must be implemented. Installing a high-pressure alarm together with the pressure indicator (PFD 1 E-1) would reduce the overall frequency to 1 E-8. • High pressure in the closed drain drum. The difference with the previous high-risk scenario is the possible cause: PCV fails and stays open, causing an increase in the N2 flow. Consequences, recommendations, safeguards, severity, frequency, risk, PFD’s, overall frequency, and recommendation to reduce the overall frequency to 1 E-8 are the same as in the previous high-risk scenario. 4. Conclusions The complexity of the HF alkylation process has been illustrated in this document, considering the hazards associated with HF storage, handling, and processing. Even though this paper is a summary of the detailed analysis by HAZOP, LOPA, and SIL, it helps understanding why the refineries that operate HF alkylation units 347 are under increasing pressure to maximize the safety of the unit, product quality, and operational procedures, as well as to decrease their environmental impact. The detailed analysis of the nodes showed that the unit has a fair safety system, and it is equipped with the controllers and protection layers to help prevent incidents. However, in some parts of the plant, it is needed to implement more safeguards to mitigate hazardous scenarios. The majority of hazardous scenarios were categorized as of significant risk, and also it was found that the unit has enough safeguards that can mitigate the deviations. Two scenarios were found to be of high-risk, specifically in the section of HF regeneration; both scenarios were associated with high pressure in the closed drain drum, due to different causes. Both high- pressure scenarios can be mitigated by the installation of an alarm to attain a lower overall frequency for this scenario. Also, in the HF regeneration section, another scenario showed the need to change the type of valve at the top of the acid regenerator. Even though this scenario represented a significant risk, it was necessary to reduce the overall frequency of the event, since the only safeguard, in this case, were the procedures, training, and response of operators. The rigorous analysis involved in each case shows the importance of the team experience at analyzing each scenario and considering the frequency of events to determine the probability of failure of safeguards in the unit. References Bajraktarova-Valjakova E., Korunoska-Stevkovska V., Georgieva S., Ivanovski K., Bajraktarova-Misevska C., Mijoska A., Grozdanov A., 2018, Hydrofluoric Acid: Burns and System Toxicity, Protective Measures, Immediate and Hospital Medical Treatment, Open Access Macedonian Journal of Medical Sciences, Nov 20, 6(11), 2257-2269. Benedetti-Marquez E., Sanchez-Forero D.I., Urbina A., Rodriguez D., Gracia J., Puello-Mendez J., 2018, Analysis of Operational Risks in the Storage of Liquid Ammonium Nitrate in a Petrochemical Plant, trough the HAZOP methodology, Chemical Engineering Transactions, 67, 883-888. Center for Chemical Process Safety (CCPS), 2001, Layer of Protection Analysis, Simplified Process Risk Assessment, D.A. Crowl, ed., American Institute of Chemical Engineers, New York. Crawley F., Tyler B., 2015, HAZOP: Guide to Best Practice, Elsevier, Amsterdam, Netherlands. Delavar A., Tehrani E., Alizadeh S., 2016, Layers of Protection Analysis to Achieve Safety Integrity Level (SIL), Case Study: Hydrogen Unit of Refinery, Scientific Journal of Pure and Applied Sciences, 11. Kojo S., Manninen V., 2019, The Benefits of Different Risk Assessment Methods Used for Power Plants, Chemical Engineering Transactions, 77, 913-918. Mannan S., 2012, Lee’s Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control, 4th Ed., Butterworth-Heinemann, Waltham, United States. Tamm D.C., Devenish G.N., Finelt D.R., Kalt A.L., 2018, Analysis of Gasoline Octane Costs, Baker O’Brien Inc., U.S. Energy Information Administration, Houston, United States. United Steelworkers, 2013, A Risk Too Great: Hydrofluoric Acid in U.S. Refineries, Tony Mazzochi Center, New Perspectives Consulting Group, Pittsburgh, United States. Vogt E.T., Weckhuysen B.M., 2015, Fluid catalytic cracking: recent developments on the grand old lady of zeolite catalysis, Chemical Society Reviews, 44(20), 7342-7370. Willey R.J., 2014, Layer of Protection Analysis, Procedia Engineering, 84, 12-22. 348