Peter N. Lodal Eastman Chemical Company Centrifugal Pump Isolation Hazards: Case Histories and Prevention Methodologies Peter N. Lodal Eastman Chemical Company

Boiling Liquid Expanding Vapor Explosion What is a B.L.E.V.E.? Boiling liquid expanding vapor explosion, often referred to by the acronym BLEVE, is a phenomenon which occurs when a vessel containing a pressurized liquid substantially above its boiling point is ruptured, releasing the contents explosively. What is a BLEVE? Boiling Liquid Expanding Vapor Explosion

What Causes a BLEVE? Pressure P Increases Vapor Closed System Temperature Increases T What Causes a BLEVE? Closed system with any liquid (doesn’t have to flammable or reactive, can even happen with just water) As heat is applied, temp and press increase Pressure keeps bulk of fluid liquid state Eventually the bulk liquid temp increases significantly above normal atmospheric boiling point Heat Liquid

Vessel Ruptures Pressure Rapidly P Decreases Vapor 1600x Vapor Volumetric Expansion Liquid Flash Vaporizes The Vessel wall exposed to increasing temp and pressure Finally the vessel wall fails System pressure is rapidly decreased Causes the bulk liquid to instantly flash vaporize Liq to Vap has a 1600 times volumetric expansion This expanding vapor is the energy that rips the vessel apart and throw fragments considerable distances In some cases it can propel the vessel itself long distances If liquid if flammable, in addition to the physical energy, can also have enormous fire ball Heat Liquid

What can BLEVE? Tanks Hot water heaters Drums Cylinders Railcars Pumps External pool fire If flammable, fireball is enormous Hot water heaters BLEVE does not necessarily involve flammables Drums External pool fire 15-20 minutes Launch Cylinders Launch like a missile Railcars Launch over 1 mile in the air Pumps Running isolated (suction & discharge closed) As little as 20-30 minutes What can BLEVE Tanks pool fire If liquid is flammable, the resultant fireball can be enormous 2:24 video Hot Water Heater 1:45 Drums approx 15-20 min in pool fire (Aniline Plant 1:30) BLEVE can launch 55 gal steel drum several hundred feet Railcars derailments exposed to pool fire from another car Can be launched over 1 mile in the air 1:45 The heat source for each of these was pool fire Pumps can BLEVE if started and left running isolated (suction & discharge closed so fluid is bottled up) Our onsite case histories indicate this can happen in as little as 20-30 mins I’d like to review 3 our onsite case histories with you

Case 1 Sludge Pump

Case 1:Description of Incident A loud sound was heard and a 20 foot long white to whitish-gray cloud was seen in the area of Sludge Pump. Inspection showed Pump was fractured and small pieces were found as far away as 35 feet. Pump suction and discharge valves were found closed and the local pump run switch was found in the auto position.

Case 1: Data Pump suction & discharge valves were closed. Pump local hand switch was set in Auto. DCS was set telling the pump to run. Electrical evaluation of the pump power breaker indicated the pump was running until some “incident” tripped the breaker.

Case 1: Data (continued) Pump fracture analysis suggests approximately 200-210 psig pressure was generated. Pegged pressure gauge on pump discharge suggests pressure reached 200-210 psig. Vapor pressure data suggests temperature required to reach 200-210 psig was approximately 230 C.

Case 1: Data (continued) Differential Scanning Calorimeter (DSC) on actual pump sample showed no exotherm until 376 C. Autoignition temperature on actual pump sample was measured at 485 C.

Case 1:Conclusions No evidence of deflagration. Material does not appear to be thermally sensitive at our temperatures. Autoignition does not appear to be credible. Root Cause -- Pump was inadvertently started by DCS and left running with process material blocked into the pump head which built up enough temperature to raise the vapor pressure to 200-210 psig which caused the pump to fail.

Case 2 Caustic Pump

Case 2: Data Pump suction & discharge valves were closed. Pump was inadvertently started when operator threw a hand switch thinking it was for a ventilation fan.

Case 2: Conclusions Material was non-flammable, so deflagration was ruled out. Root Cause = Pump was inadvertently started and left running with process material blocked into the pump head which built up enough temperature to raise the pressure to a point which caused the pump to fail.

Case 3 Condensate Pump

Case 3: Data Pump suction & discharge valves were closed during a power interruption and system shutdown. Pump was started remotely 3 days after the shutdown.

Case 3: Conclusions Material was non-flammable, so deflagration was ruled out. One 5-lb piece of the casing was found 400 feet from the pump installation. Root Cause = Pump was started automatically and left running with condensate blocked into the pump head which built up enough temperature to raise the pressure to a point which caused the pump to fail.

Common Features Complete Isolation (Suction and Discharge Blocked), not deadheaded (discharge only blocked). Fluid Filled Remote Start Capability Seal Failure did not provide adequate pressure relief

Case Pump Summaries Case 1 3500 RPM, 15 HP, 140 psig Organic Acids & decomposition solids Case 2 1750 RPM, 10 HP, 55 psig 50% Sodium Hydroxide solution Case 3 2600 GPM, 75 HP, 110 psig Steam condensate Case Pump Summaries: All relatively small centrifugal pumps No special chemical properties, non-flammable, non-reactive, one just water

Conclusions Pump Explosions can occur with completely isolated fluids, even when those fluids are non-flammable Damage potential increases as horsepower increases (increasing inability to dissipate energy) Seal failure as a relief mechanism is NOT a safe assumption

Recommendations So, what are the best ways of preventing pump explosions? Use local start only (remote shutoff is not an issue) Avoid the ability to isolate the pump Lock open or remove valves on the suction and/or discharge Train operators on the significance of this issue

Centrifugal Pump with Remote Stop A centrifugal pump is shown with a local start / stop switch but with only the capability to stop the pump remotely. This is the preferred set up for a centrifugal pump and should be used unless process necessity dictates a different design requirement.

Recommendations If local start and lock open valving are not options (e.g., spared pump installations with auto-throwover), there are a number of control options that can be evaluated on a case-by-case basis for adequacy of risk reduction: Relief device (rupture disc or relief valve) High Temp Shutdown High Pressure Shutdown Limit switches on isolation valves to ensure they are open (or at least not closed) Low flow interlock Low power draw interlock (limited application—reliability issues) Next

Centrifugal Pump with Relief In this case, the remote stop capability has been replaced with start / stop capability from the BPCS. This type of set up will normally require some additional protection with the reliability indicated by a LOPA of the pump. In this case a relief valve on the discharge of the pump has been provided to relieve building pressure. The relief from the pump should be sent to a safe location which, depending on the chemical, could be the floor, a relief stack, or some other form of secondary containment. Back

Centrifugal Pump with SIF A SIF has been added to the pump to cause it to stop in the event of high discharge pressure. All symbols with a darkened corner are part of the SIF and are tied to the safety PLC or hardwired. Because there is now an interlock that can stop the pump from running, a local Jog – Off - Auto Switch has been added. The Jog function is spring loaded to return but the Jog bypasses all interlocks as a positive test that power has been locked out when required for LOTO purposes. A variety of instrumented options could be used to trip the pump based on the requirements of the process including pressure (as shown), flow, temperature, and power. Back

Pump Protection Selection Matrix Pump Protection Selection Guidance   Type of Pump Hazard Pump Service Types Version: B 3/2/2011 By KBYount (HPCC) PRELIMINARY DRAFT <- Protection Method Centrifical Pumps Variable Speed Drive Centrifical Pump Positive Displacement Pump Reactive Chemical Exotherm Liquid Vapor Pressure Expansion Hazard (Bleve) Thermal Expansion Hazard (Casing Bust Open) Pump Seal/Bearing Failure Safety Rated Protection Required (SIL 1-3) Batch (ON/OFF) Pumping Service Analog Control Valve/Loop Involved Auto Pump Throwover Service Variable Process Composition Variable Process Temp Slurry Service Interlock On-line Testing Required Pump Type, Process Service/Conditions -> A B C D E F G H I J K L M N O Low Power Monitor Interlock 1 Y Low Amps Interlock 2 Low Flow Interlock (transmitter or switch) 3 High Temperature Interlock (Pump Casing) 4 High Pump Discharge Pressure Interlock 5 Overpressure Relief Valve 6 Minimum Flow/Recirculation Line 7 na Minimum Flow Control Loop (DCS or Mechanical FC) 8 Block Valve Position Indication Interlock 9 Operational Locks on Manual Isolation Valves 10 Local Only Operator Start Switch (New) 11 Y = Yes, Typically good for this service N = No, Typically not a good fit for this service C = Conditionally good for the service, additional design details are required, see notes na = Not Applicable

Communicate the hazard Share Learnings Communicate the hazard Identify potential pump explosion hazards in our areas Remote start capability Evaluate each potential pump explosion hazard Make recommendations to mitigate risk Share our Learning’s: We need to communicate this hazard to everyone who works around pumps Each area needs to identify their potential pump explosion hazards Do you have remote start capability? Each area needs to evaluate each potential pump explosion hazard and make recommendations to mitigate the risk

Questions?