HAZOP-Proof Ammonia Plant: New Way

of Defining a Safe and Reliable Design

This new technique, which meets interacting design criteria of a 1,800-MTPD ammonia project,
offers special safety features and withstands a detailed HAZOP study.

Georg Grossmann and Dieter Fromm

BASF AG, D-6700 Ludwigshafen, Germany

Since its foundation 25 years ago, the BASF Project Approval Final Startup
production site at Antwerp, Belgium is one of Release for Planning Approval
the biggest single buyers of ammonia in north-
west Europe. Thoughts about building an ammo- Project |<^BaslcEng7)>i<( Detalad EnglnaofIna
nia plant to cover this large demand came up
i \ Construction
several times, but were not realized until
1987, when the project for a 1800 MTPD plant Safety I
Reviews : :
was put on the way.
Stages

For projects involving mature technology,

BASF is using increasingly the services of ex-
perienced contractors to design and build new
plants on a turn-key basis. Time

Concerning plant safety, our management

has established a policy according to which
BASF commits itself to build any plant at any
place worldwide to at least the same standards
as in Ludwigshafen, our main production site
and head office. To ensure an uniform high
safety level for all plants, a standard proce-
dure for the safety reviews was developed more
than 15 years ago. This has proven to be ef-
fective in a great number of projects, where
BASF could define the terms of the project in
full responsibility.
BASF'S STANDARD SAFETY REVIEW SYSTEM
The standard procedure with its con-
nections to the project progress is shown in
Figure 1. It consists of three stages of re-
views which are conducted at different plan-
ning states.
Figure 1. Standard safety review schedule.
Stage 1 is done towards the end of the
basic design period, when most of the process
parameters as capacity, feedstock, general
layout etc. are known. It deals preferably
with the possible safety interference of the
new plant and the ones already existing in the
neighbourhood and with the substances handled
in the plant.
Stage 2 is based mainly on the PID's and
is preferentially conducted in the early de-
tailed planning period. The survey team tries
to anticipate the risks by looking at the new
design stage by stage and using the experience
with this and similar processes.
Stage 3 is used for new processes or
plants, when toxic or otherwise dangerous

79
substances are handled or when the process
itself has higher risks than usual. Here, a
step-by-step check similar to the Hazard and
Operability Study (HAZOP) developed by ICI is
used for the critical stages of a process.
The ammonia process being a well known one,
a Stage 3 review was not considered to be
necessary.
For the turn-key, lump-sum ammonia pro-
ject with full contractor responsibility and a
short time schedule, our standard safety re-
view scheme is not flexible enough. We had to
find a way to modify it in order to get a
plant according to our safety standards, with-
out time and cost impact by late substantial
design changes.
DEFINITION OF THE 'HAZOP-PROOF' DESIGN
In order to define the safety level to be
achieved, we took the abovementioned HAZOP
analysis as as standard and concluded, that
the design has to be 'HAZOP-proof'. This means
the design must be able to withstand a full
scope HAZOP study conducted at any time after
the detailed planning without major changes.
The 'HAZOP-proof' design has to be achie-
ved before the lumpsum bids are final and
therefore, a method to evaluate the design on
the basis of technical-bid PID's with a mini-
mum of effort and a maximum of effectiveness
was required. For this purpose, the standard
HAZOP procedure cannot be used without
problems.
•HAZOP-Proof Design Achieved
The guide word technique generates a uni-
form pattern of questions, and it is unlikely,
that a serious hazard will be overlooked. As
can be seen in Figure 2, a rigourous HAZOP
procedure for 250 items would generate more
than 7500 questions. In the case of a well
> 250 Items
to be checked
Process
v x
Compressors^ Function <|
x
Control Loops<|
Bother Items 4
5 min per Question = 156 Sessions = 31 Weeks
Figure 2. HAZOP guide word combinations.
known established process, about 90 Z of the
questions give no new aspects, because the
risks are already known or the special combi-
nations of process properties and malfunctions
are not safety relevant. To overcome this dis-
advantage without sacrificing the principles
of HAZOP, our safety department developed a
special form of safety review, that we now
call the 'Mini-HAZOP'. Figure 3 shows that it
is not a substitute, but a complement to the
old scheme.
The main difference to a full scope HAZOP
is the restriction to meaningful combinations
of the guide words. On the other hand, we ad-
ded explicit questions, which in the standard
HAZOP only come up by extensively using the
term 'Other than', i.e. start-up, shut-down,
maintenance etc.
For ease of use, a standard sheet of
these questions is generated for every item to
be discussed. Figure 4 shows the layout of
such a sheet. The questions are arranged in
groups for different general aspects.
Group 1 comprises the malfunctions that
endanger the mechanical integrity of a given
item, i.e. overpressure, vibration, corrosion
or leakage.
Group 2 deals with the process-related
hazards. 'Failure of designed Function ' re-
minds the team to think about for what purpose
a special heat exchanger, pump, filter and so
on actually is provided for and wether the
loss of its function has safety consequences.
by 'Mini-HAZOP' Another very important point in this group is
backflow, for example into one of the utility
systems.
The questions of Group 3 are about pro-
blems with supporting systems like the control
loops and valves, auxiliary pumps, utilities
etc.
> 7,500 Questions Invitation Bid Approval Startup
to be answered to Bid Preparation Contractor Selected
<( Detailed Enginnerlng
Safety \
Reviews : i
Time
Figure 3. Revised safety review schedule.
80

Group 4 deals mainly with the problems
that arise during exceptional operation of the
given piece of equipment, for example startup,
shutdown, trip situations and so on.
In the last group, problems which are not
related directly to the plant operation are
addressed. This includes external influences
and unspecific problems, that are not caused
by the process.
During the discussions of malfunctions,
the general rule was applied, that only one
independent fault was assumed; however, all
the following upsets induced by a primary mal-
function have to be considered.
General Rules for the Actions to be Taken
To eliminate the detected hazards, ge-
neral rules were established. If for example,
during the discussion of possible malfunctions
a potential overtemperature is recognised,
either the design temperature has to be modi-
fied or other measures have to be taken to
limit the temperature automatically. This ca-
tegoric approach avoids lengthy discussions
about what really happens, when the tempera-
ture will be 20 °C over the 'design tempera-
ture. A clear strategy with the lowest pos-
sible number of exceptions increases the ef-
fectiveness of the discussions and also makes
it easier for others to understand the reasons
for the measures taken.
SAFETY REVIEWS FOR THE ANTWERP
'Mini-HAZOP' Tested on an Existing Plant
As the 'Mini-HAZOP' is a new tool, we
tried it on one of our existing plants, to
become acquainted with the strategy and also
to become sensitized for the critical parts of
the ammonia process. During these discussions,
the 'Mini-HAZOP' form was still developed fur-
ther and brought into it's final shape.
'Mini-HAZOP' for Three Technical Bids
On the basis of the test survey, the time
required for the 'Mini-HAZOP' could be estima-
ted. Thanks to the very intensive cooperation
of the contractors, it was possible to finish
the reviews with three bidders within one week
each and the necessary changes could be inclu-
ded in the lumpsum bid prices. The processing
of the sheets was as far as possible automated
by using a standard computer program. By this
we were able to complete the documentation
very shortly after the end of the discussions.
Identification and Design Data
1
Check List for Possible Malfunctions in 5 Groups :
1. Mechanical Integrity .i.e.: 11 Questions
• Pressure
• Temperature
« Material
2. Process Related Risks, i. e. : 5 Questions
• Failure of Designed Function
• Baokflow
• Wrong Composition
3. Auxiliary Equipment . i . e . : 6 Questions
• Instrumentation
• Control Loops
• Pumps
4. Exceptional Conditions . i . e . : 8 Questions
• Start-up
• Maintenance, Repair
5. Not Process-Related Risks . i . e . : 5 Questions
• Welding Defects
• Freezing Water
Figure 4. Arrangement of the "Mini-HAZOP"
checklist.
Modification of the Stage 2 Review
As mentioned earlier, the 'Mini-HAZOP'
due to its compressed structure cant't pos-
sibly uncover all risks related to a new
plant. Furthermore, not all information re-
quired for a detailed discussion is available
in this stage of the project. Therefore,
after having selected the contractor and the
PROJECT process, an extended safety review stage 2 had
to be performed. This review was a good check
for the effectiveness of the 'Mini-HAZOP'. It
was decided to modify the Stage 2 review and
to conduct it similar to the 'Mini-HAZOP',
however in an intensified and extended form to
cover the whole process with its connections
to the outside.
A check list was derived from the 'Mini-
HAZOP' sheet. Some questions were added that
couldn't be covered to full extent in the
'Mini-HAZOP'.
The actual difference between the stage 2
review and the 'Mini-HAZOP* is the depth of
analysis, which can be expressed in terms of
duration - about 8 weeks - and the number of
checked items, now about twice as much.
Discussion of the Trip System
The trip system was reviewed very care-
fully to optimize between the safety of the
plant and the availability. As a general rule,
81
all trip initiators are installed as a 2-out- Absorber
C02 Product
-of-3 voting system. The signals are processed Column
by a fully redundant, hardwired trip logic Scrubbed Synthesis Gas
system. All parts of the trip system are de-
signed such that a single passive error will
not be able to prevent the trip action or the
triggering of the trip itself.
The necessity to override some of the trip
signals was discussed thoroughly. Trip
bypasses are only installed, where they are
absolutely necessary; where they are critical,
automatic reset of the bypass is provided.
EXAMPLES
Two typical examples from the Antwerp Figure 5. Example 1: Design of CO, scrubbing
project will show the modifications of the section before "Mini-HAZOP".
design on its way getting 'HAZOP-proof'.
Example No. 1:
Liquid Letdown from a HP Separator
During our trial 'Mini-HAZOP', liquid C02 Product Absoiter
». Column
letdown from vessels under pressure was found
to be a rather critical operation, especially Scrubbed Synthesis Gas
when it has to be done manually, e.g. for
start-up or in the case of a controller upset.
Figure 5 shows schematically the letdown
.P. Flash

Vaste Gas
-^
X r^
\j i-
to Fuel
from a separator after the C02 washing column.
The gas consists mainly of hydrogen under a .P. Hash ^
X
pressure of about 30 bar. During normal oper-
ation, there should be practically no liquid V
in the separator. Yet during malfunctions of
the column some of the scrubbing solution can COZ-ContalnIng
Synthesis Gas
be carried over and has to be removed from the
separator. In the first design, this was done
by a standard level controller, which would
have discharged the solution to the slop Figure 6. Example 1 after "Mini-HAZOP".
system via a funnel and an underground line. A
failure of the level transmitter, the con-
troller or the valve could have caused a
breakthrough of inflammable gas with all its
related hazards.
C02 Product Absorber
n. Column
After this risk had been identified in
Scrubbed Synthesis Gas
the 'Mini-HAZOP', the control equipment was
modified. Figure 6 shows a separate shut-off
valve actuated by a 2-out-of-3 low level
switch and the controller was put to a 2-point
.P. Flash

Vaste Gas
-^
X n ,
W i-
to Fuel fS
operating mode to ensure a quick and tight
shut-off of the control valve at low level. .P. Flash
X -,
During the Stage 2 discussion, an even V
better solution was found, which is shown in
Figure 7. The valve doesn't discharge anymore CO2-ContalnIng
into the open funnel, but rather into the H.P. Synthesis Gas
flash column, where the liquid is brought back
into the solution recycle and any gas is
safely introduced into the waste gas for fuel. Figure 7. Example 1 after stage 2 safety review.

82
Example No. 2:
Overpressure in the Gas Generation Section
Another example is the overpressure pro-
tection of the gas generation section between
the inlet of the primary reformer and the out-
let of the high temperature shift reactor.
Most ammonia plants have the first set of
safety relief valves in the gas generation
section downstream the heat exchanger between
HTS and LTS, because otherwise, the large
amount of gas and steam at temperatures of Primary Secondary Waste Heat HT-Shift BFW LT-Shift
about 400°C would require very big valves and Reformer Reformer Recover/ Converter preheater Converter
vent lines. For the Antwerp plant, this
arrangement is shown in Figure 8. This means
that a rather long chain of vessels and heat Figure 8. Example 2: Overpressure protection of
exchangers is protected against overpressure the gas generation section before
by one group of safety relief valves far from "Mini-HAZOP".
the pressure source.
During the 'Mini-HAZOP' it was found that
an accidental higher pressure loss in the HTS
could have caused an uncontrolled overpressure
in the primary and secondary reformer and in
the waste heat recovery system.
The result from the Mini-HAZOP is shown
in Figure 9. After calculation of the highest
expected pressure drop in relation to the
design pressures, it was stated, that an
additional group of safety relief valves had
to be installed at the inlet of the HT shift
reactor
During the Stage 2 discussion, this
Primary Secondary Waste Heat HT-Shlft BFW LT-ShKt
actually safe solution could be replaced by a Reformer Reformer Recovery Converter preheater Converter
more economical one, which is shown in
Figure 10. It was found out, that the re-
maining process steam after a emergency shut Figure 9. Example 2 after "Mini-HAZOP".
down of the process gas was not able to over-
pressurize the reformers, because it repre-
sents only a small part of the volume of the
reformed gas. A total blocking of the HT shift
reactor was assumed to be practically impos-
sible, and therefore, a 2-out-of-3 pressure
switch at the inlet of the primary reformer
acting on the feed gas and burner trip can now
replace the very bulky additional safety
relief valves at the inlet of the HT shift.
Both examples show, that the 'Mini-HAZOP'
is well suited to identify the hazards. During
the Stage 2, it very seldom occured, that a
substantial risk was recognized, which was not
already addressed in the 'Mini-HAZOP*. Ap-
plying the general rules mentioned earlier,
Primary Secondary Waste Heat HT-Shift BFW LT-Shht
countermeasures could quickly be proposed. In Reformer Reformer Recovery Converter Preheater Converter
the second reviews, when there was more time
to discuss, these solutions could be
optimized. Figure 10. Example 2 after stage 2 safety review.

83
INCLUSION OF OPERABILITY AND AVAILABILITY
The operability and the availability of
the plant was also a major concern during our
discussions. All equipment was checked for an
uninterrupted five years operation. That means
that in case of the rotating equipment, except
of the large turbocompressors, spare units,
most of them with autostart, are installed.
The 2-out-of-3 voting trip system helps to
prevent inadvertent plant trips caused by
failing transmitters while maintaining its
fully redundant safety functions. All other
vital instrumentation and control equipment
will be installed in a way, that repair and
maintenance is possible without interrupting
the operation. For the critical pieces of
equipment, operability under startup and all
kinds of setup conditions was checked in the
course of the safety discussions.
CONCLUSIONS
The benefits from using the described
procedure arise from different areas. Of
course, the main objective is to obtain
optimum plant safety and operability without
necessity of late changes of the design, which
would be very costly or could be even im-
possible, because a rearrangement of the pro-
cess would become necessary.
Most countries require a safety report to
be included in the application for the buil-
ding or operation permit. In our case, the
documentation of the 'Mini-HAZOP' and the
extended Stage 2 analysis could be adapted
without problems.
Dieter Fromm
84
We expect that the clear and comprehensive
strategy towards solving safety problems will
also help in eventual public discussions.
Being able to show that reasonable
countermeasures are provided for all risks
that could be expected will give the employees
and neighbouring citizens the feeling that the
company takes full responsibility and care of
the operation.
And last but not least, the time spent
for the safety reviews is used more effective.
All 'Mini-HAZOP's and the final Stage 2 review
together took only about half of the time that
we had estimated for a full-scope HAZOP study,
the result in terms of achieved plant safety
being practically identical.
But a plant is not only to be designed in
a safe way, much more it has to be operated
safely. A major part of the safe operation de-
pends on the safety training of the operators.
If the operators learn that there are general
and reasonable safety design guidelines
applied in their plant, they will easily
understand what the purpose of each safety
device is. This is the first step to a safe
and reliable operation.
In our opinion, making a design 'HAZOP-
proof' by the shown procedure is a good way
out of the dilemma between safety requirements
and time restrictions in big turnkey, lumpsum
projects. The plant safety department of BASF
has therefore adopted the procedure as a
standard for new turnkey projects, one of them
being the 1.3 billion DM ethylene cracker at
Antwerp.
Georg Grossmann
Theo Huurdeman, DSM Fertilizers: How many people
were involved in the mini HAZOF study? What disciplines
were involved?
Grossmann: There were about five to eight people from
the project teams of the contractors and BASF, and one or
two people from our Safety Department. Would you repeat
the second part of your question?
Huurdeman: I understand the team consisted of various
85
disciplines. What disciplines were involved—process
engineers only, or instrument engineers and mechanical
engineers as well?
Grossmann: Most of them were chemical engineers, I
would say, and as I mentioned earlier it took one week for
every design. That means three weeks to review three
technical bids at this stage.