Flexibility and Integration Changes in an Operating Plant: A HAZOP and LOPA Review
Bypass lines, bidirectional transfers and shared tanks give an operating plant more freedom in routing, blending and inventory. This project tested what 26 such change packages did to design limits, protection layers and operating practice.
Drawn from a project in which DSIB principals led the HAZOP and LOPA studies. The engagement is anonymized.
Context
The refinery launched an integration project to gain operating flexibility and margin from its existing assets. The change packages linked process units, intermediate and product tank farms, an adjacent storage terminal, third-party distribution terminals and jetties, largely through new interconnecting and bypass lines.
No new process unit was added. Instead, the packages redefined stream destinations, transfer directions and the duty of existing equipment, and several shifted operating conditions away from the values the equipment was designed for. The same pattern applies well beyond refining: Any site that links storage, loading and process areas for routing freedom has to confirm that the original design assumptions still hold on each new route.
Plant-wide change requests of this kind can include points that do not match the original design basis. The HAZOP was therefore carried out at a very early stage of design, with late-FEED and detailed design still to follow.
For an integration and flexibility project of this depth, a verification of the operating plant's safeguarding design basis gives the change HAZOP a confirmed starting point.
See DSIB Operating Plant Safeguarding Design Basis Verification SolutionsFlexibility and Integration Requests Driving the Project
More destinations for each product
Sending a product to more than one tank farm or jetty, and transferring in both directions between storage sites.
Returning off-spec product and freeing tank space
Sending off-spec product back to process units or intermediate tanks instead of slop, and keeping tank space available when inventories run high.
Coping with feedstock changes
Keeping units running when feedstock changes push the operating envelope.
Blending and market adaptation
Sending intermediates and by-products to sale, and blending in product tanks to meet market demand.
Continuity through maintenance and upsets
Keeping the process running during maintenance, and handling upsets such as a tank reaching high level without stopping the units upstream.
Flexible tank and pump operation
Mixing, sampling and transferring between tanks, and running a spare pump together with the duty pump when needed.
A smaller number of requests aimed at environmental performance or at adapting to new technologies.
For owners of similar projects, this case study is worth reading as an early view of what such a project involves, and as a set of lessons learnt.
Is the Refinery Concept Changing?
In the years ahead, not only refineries but many integrated chemical plants may face similar flexibility and productivity drivers.
Incoming drivers for complex facilities, as outlined in the literature on the future of refining:
- New feedstocks, waste processing and CO2 capture
- Catalyst innovation to process a wider feedstock range
- More hydrocracking and hydrotreating capacity
- Alternative process routes to remove sulphur from heavy products
- Better heat integration
- Cross-sectoral links and industrial symbiosis
- Demand for liquid hydrocarbons rising until at least 2040
- A wider product slate
- More renewable energy on site
- Lower CO2 in production and transport, with cleaner fuels
- Stricter local and international environmental regulation
- Life-cycle assessment to weigh environmental gains and compare technologies
Sources: FuelsEurope, Vision 2050; J. Speight, The Refinery of the Future, Chapter 10, Elsevier.
Approach
DSIB principals, on behalf of a major engineering company, led the HAZOP and LOPA study. The study took the engineering documents of the existing lines and the preliminary engineering documents of the change project as its safety basis. The 26 packages were reviewed in 52 meeting days, about two days per package, and LOPA for completed packages ran in parallel with the HAZOP sessions, which shortened the overall schedule.
A team of 47 participants from operations, process, process safety, instrumentation, electrical, mechanical, civil, corrosion, maintenance, environmental and planning disciplines took part in the sessions. The studies were run in exSILentia to allow a seamless transfer into functional safety work.
Each change node was also reviewed through a plant-wide global node, supported by 3D models when necessary, particularly for spacing, accessibility, maintainability and emergency response perspectives. Start-up and shutdown procedures were examined through a three-guide-word task analysis as far as provided. Where packages were anticipated to be identical, a 17-point similarity analysis tested the argument; accordingly, it was possible to refer to a worksheet shared by both, with the particular tags and other unique properties of each recorded separately. The study continued with LOPA for SIL target assignment and closed with a SIF register detailed for the first SRS entries. For a particular case, a need for FSA was raised by the working group, and so a third-party assessor was involved in the project to review two of the storage tanks to provide confidence in the design basis.
A change HAZOP starts from the existing studies and safeguards. Unless the team knows what changed, how and to what extent, that starting point is trusted beyond its evidence.
Key Design Decisions
Capital expenditure accounted for 55 of the 283 actions. The items below are examples from this project, not a list to expect in every integration project: They illustrate the kind of capital changes such a study can lead to and the reasons behind them. Costs are not stated, but each decision indicates the extent of the change.
The study ran under well-established safety and design protocols, and the preliminary design documents were prepared by a team with operating experience. Another facility may present a different picture, and even a longer CAPEX list.
Some Typical Design Decisions Requiring CAPEX
- Overfill SIFs and additional tank MOVs
- New control valves and flow control loops
- SIL 3 flow SIF or an integrated design alternative
- Pump replacement to suit the piping class
- New relief valves on blocked-in segments
- Spacers, blinds, drains and vents
- Material, instrument and tracing upgrades on shared lines
- Valve position feedback, new alarms and PLC upgrade
- Nitrogen backup supply and tank blanketing
- Tanker loading ESD and jetty relief modifications
- Cross-boundary SIFs, communication links and line surveillance
Not every finding ended in CAPEX. One package would have routed a hydrocracker outlet stream around the downstream gas plant into an off-spec intermediate tank. As a high H2S concentration was identified in the stream reaching the line and the tank, the Integrity and Corrosion Group judged both unsuitable for this operation, and the change request was withdrawn. Several other packages were revised or withdrawn before engineering continued.
FSA
Existing overfill SIFs on two storage tanksIntegration projects route new flows into tanks that already carry overfill functions, and the LOPA result depends on how much credit those functions deserve. Assessing the existing functions answers that question before the credit is taken, and gives the owner a documented basis for revising or replacing them.
An independent assessment body joined the project for a short period to review the overfill SIFs of two storage tanks. DSIB principals organized and managed the process. The assessment was partial: It covered Stage 1 and part of Stage 2, because the design had progressed far enough for Stage 1 but not through the SIS design phase that Stage 2 addresses, and FAT was not included.
Specific
The functions were specific to the hazards they address. Where specificity was incomplete, the HAZOP recorded findings and actions.
Independent
Doubts arose about the independence of the ESDs from the alarms, as both appeared to use the same transmitters. A check against the design basis and in the field was recommended.
Dependable
The SIL verification relied on failure data more favourable than industry averages. Recalculating the PFDavg with realistic data indicated SIL 1 at best, before architecture and systematic capability were considered. The SRS did not address the energy source of energize-to-trip MOVs, and MOVs shared between BPCS and SIS were verified without a common-cause analysis, which the design-stage software could not model.
Auditable
Information flow from PHA through SIL allocation to verification was traceable and consistent.
Highlights
The highlights are shown to give an idea of the size and scope of the study.
SIF List at Handover
- Overfilling, SIL 2All inlet MOVs close on high-high level9
- High inlet flow, SIL 3Tank inlet MOV closes above a critical flow; design alternative under review1
- Over-temperature, SIL 1Steam supply closes at a critical temperature on traced loading lines1
- Identified, SIL not yet assignedColumn high level, to be settled in the column's own HAZOP; instrument air loss with high flow, awaiting a follow-up meeting2
Recommendations
The 283 actions were classified by type, not split into design and non-design items. Most of them call for evaluation and engineering before a design decision is taken.
Recommendations Split
Where the Study Handed Over
Independent PHA support closed with a SIF list that includes the initial information needed for the SRS entries. SRS development, SIL verification, detailed design and later assessments follow in the lifecycle.