Document daDaQROoVLpb4ym5KV4a1brM9

From: To: CC: Sub j: MDVAX::LPP LACSDA::MMORRISON 24-JUN-1994 13:12:28.64 LPP Chapter 13, Section 1 LOSS PREVENTION PRINCIPLES Page 13-1 Corporate Loss Prevention Review/Revision The Dow Chemical Company Midland, Michigan October 1993 Restricted For Use Within Dow and Subsidiaries 13. FIRED EQUIPMENT 13.1 SAFETY AND CONTROL OF FIRED EQUIPMENT 13.1.1 Scope Fired equipment is used within Dow to produce steam, crack or heat liquid and gaseous feedstocks, heat DOWTHERM treat gaseous, liquid and solid by-products, gasify coal, and perform other functions. When fired equipment is used in this Loss Prevention Principle, it is refers to this type of fired process equipment. This LPP is not intended for commercial fired equipment used for space heating, potable water heating, and other non-process applications. There are significant differences in size, configuration, fuels, number and type of burners, and draft systems among the equipment used in the different appli cations. The general principles for safety and control are common to most installations, but there are significant differences in specific requirements. Technology Center Design Guidelines and consultation should be used to determine specific requirements and special means of achieving the requirements of this LPP. This LPP was developed for fired process equipment listed in Appendix A. Owners of other fired equipment may find this LPP to be a useful guide, but should consult their Technology Center, local safety and loss prevention representative, and industry standards such as NFPA, ASME, Factory Mutual, and others. These principles are to be used in conjunction with applicable codes, standards and regulations and applied with good engineering judgment. Where governmental requirements are more stringent, those regulations take precedence. Appendix B is a list of references rel ating to the design, manufacture, installation, operation and maintenance of fired equipment and controls. A brief description of the subject matter of each reference is included. The list is not all inclusive and designers should familiarize themselves with codes, standards and governmental regulations that might apply to the particular installation. 13.1.2 General Requirements A. All fired equipment shall be provided with a safety system and a control system. These systems sometimes separate and independent systems, be one integrated system. are but may DO A 117489 CONFIDENTIAL The Safety system performs sequencing and interlocking functions. It performs start-up and other automatic sequenced operations. The safety system also provides the monitoring function to ensure that all parameters are maintained within pre-set, safe boundaries, and it provides alarms, event logs, overrides, partial trips and total trips of the fired equipment. The safety system is broader in scope than what has historically been called Burner Management. intains The control system is for dynamic control. It provides control of firing rate, combustion air flow, air-to-fuel ratio and other applicable controls. The control system ma safe conditions and optimum relationships among the controlled parameters. The control system includes all dynamic controls as well as what has historically been called "combustion control". ronment B. The safety system, control system, field instrumentation, equipment and sub-systems shall comprise a total system (the system) that protects personnel, equipment and the envi from harm and provides stable and reliable control. C. Designers shall be qualified to design the system for the particular type and application of the equipment, its fuels and process streams. This requires a working knowledge of: 1. The specific fired equipment purpose, type, operating characteristics and the potential hazards associated with the process and fuels. 2. The loss prevention principles, codes, standards and regulations applicable to the specific fired equipment. 3. The technology available to provide the measurement and control capability to perform the functions and meet the requirements specified in this LPP. D. installation and testing of the safety system, control system, field instrumentation, equipment and sub-systems shall be supervised by Dow personnel are responsible to ensure that all of requirements of this LPP are met. who the E. All new systems shall be reviewed during the design stage and again after construction (prior to start-up) by the appropriate Technology Center for compliance with this LPP. F. A documentation package for each installation of fired equipmen t shall be maintained and available for review. The documentation package, as described and specified within this LPP, must contain all documentation of the system as it is currently used. D0 A 117490 CONFIDENTIAL G. All significant system modifications shall be reviewed by the appropriate Technology Center prior to implementing the change. The owner of the equipment will determine whether a change represent sa significant system modification. In those cases where the owner is not certain, the Technology Center should be consulted to determine whether a reviewt is warranted. A log of significant system modifications shall be maintained in the Documentation Package. nager H. Any deviations from this LPP shall be documented with the reviewing Technology Center and approved in writing by the major ma responsible for the equipment, or by the site manager. These written approvals shall be maintained in the Documentation Package. I. changes. Each operating unit that has fired equipment shall have a written security policy that prevents unwanted changes to the system for the equipment. The security policy and procedures should require superintendent or higher level approval of This policy shall be maintained in the documentation package. J. All installations of fired equipment shall be reviewed periodically by a review team consisting of persons from outside the operating unit who are familiar with fired equipment and this LPP, to ensure that the system meets all requirements of this LPP. The equipment owner shall set up the review frequency for each installation of fired equipment and include the record of review dates and report of the latest review in the documentation package. K. Operations and maintenance of all fired equipment shall be performed only by trained personnel competent to perform such operations and maintenance. 13.1.3 Fired Equipment Operations To obtain Technology Center support for construction or operation of fired equipment within The Dow Chemical Company, the system must be designed according to the guidelines in this LPP and be used in conjunction with sound operating discipline to accomplish the following operational requirements: A. Pre-Lightoff Purge (Prior to Introducing First Ignition Source) A continuous, uninterrupted purge at a pre-defined flow rate is required prior to trial for ignition. This purge must continue for a time period sufficient to displace a minimum of five fire box and combustion-product-path volumes. These calculations for purge flow and time requirement calculations should be maintained in the documentation package. At all times during the purge the following mandatory DO A 117491 CONFIDFNTIAL prerequisites must be met or a repurge is required: 1. All safety shutoff valves must be proved closed on all fuels and process feeds to be burned in the combustion zone. 2. All combustion-air and combustion-product passages must be proved open. 3. All burner air registers must be set at the purge position. For multiple-burner fired equipment/ purge air flow should be as evenly distributed as possible through all burners during the purge step to prevent pockets of combustible gas from forming. 4. Purge air flow must be at or above 25 percent of design maximum air flow unless otherwise specified in the Technology Center Design Guideline for the specific equipment. Redundant determinations of purge flow must be utilized. Purge air flow is not always measured. Although direct measurement is preferred, the proper flow may be inferred from pre-determined damper settings, blower motor amps, flow switches, pressure switches and by other methods. For natural draft systems, a means of inducing draft to obtain adequate purge flow must be provided. Steam or inert gas such as nitrogen or carbon dioxide can be used, or a special purge blower or jet eductor can be installed. In no case shall an expl osimeter be used as the only purge check prior to introducing the first ignition source. 5. All electric-arc ignitors must be de-energized. 6. It must be proved there is no flame in the fired equipment. NOTE: For solid waste incinerators, see Technology Center Design Guidelines. B. Lighting the First Burner that The first burner may be a pilot burner or a main burner. For multiple pilots are ignited simultaneously, refer to Technology Center Design Guidelines for the specific equipment. Light-off of the first burner must be sequenced by the safety system and following safeguards must be met: automatically all of the 1. Re-purge is required if a trial for ignition of the first burner is not started within 15 minutes after commencing to establish light-off conditions. 2. Combustion air flow controls must be set to ensure air at a pre-determined safe flow rate specified for light-off. Air flow must be at or above 25 percent of design maximum air flow unless otherwise specified in the Technology Center Design Guideline for the specific equipment. Redundant determinations of combustion air flow must be utilized. DO A U7492 CONFIDENTIAL Combustion air flow is not always measured. Although direct measurement is preferred, the proper flow may be inferred from pre-determined damper settings, blower motor amps, flow switches, pressure switches and by other methods. 3. All burner air registers must be set at the light-off position. For multiple burner fired equipment, combustion air flow should be as evenly distributed as possible through all burners during the light-off step to prevent pockets of combustible gas from forming. 4. Combustion zone pressure (furnace pressure) must be stable at the designated set point for light-off. 5. If the fired equipment has a steam drum, water level in the steam drum must be at the level des ignated for light-off, usually lower than the normal control set point to allow for swelling when the fired equipment warms up after light-off. 6. Safety shutoff valves must be proved closed on all fuel and process feeds burned in the combustion zone, except when appropriately opened for the burner being ignited. 7. Fuel controls must be set to ensure fuel at the predetermined pressure and flow rate specified for light-off. If the fuel is oil or other liquid requiring atomization and temperature control, these controls must also be in service. 8. A designated commercial grade fuel must be used for light-off. 9. No flame must be detected prior to trial for ignition. 10. The ignition source for the first flame must be present before fuel is admitte d to the burner. 11. There must be a limited time that fuel may be admitted before the first flame is established. If the flame is not established during that time window, the fuel safety shutoff valve must be automatically closed. The time limit must be as short as feasible for the particular fuel and equipment type. For gaseous fuels and light oils, the time shall n ot be greater than 10 seconds after opening the safety shut-off valves, and for heavy liquid fuel the time shall not be greater than 15 seconds after opening the safety shut-off valves. 12. Only one attempt is allowed to establish the first flame. If the first trial for ignition is e of the unsuccessful, the fired equipment must be repurged. If the burner will not ignite, the caus problem must be determined and corrected. NOTE: There are special hazards associated with lighting off liquid fuel. Liquid fuel can accumulate on the floor of the combustion chamber from unsuccessful light-off attempts. Vapors from this accumulation can be an explosion hazard. Uncontrolled burning of the liquid inside the furnace or leakage of the o 0 A 117493 confidential r il to the outside of the furnace can occur. A procedure must be established to guide operations personnel in handling these situations if liquid fuel is used. 13. Proof that the first burner has successfully ignited must be provided by one or more flame detectors, otherwise the burner fuel must be automatically tripped. 14. All personnel must be at sa fe location remote from the fired equipment during trial for ignition of the first burner for routine light-offs. Written procedures must be established that specify protective measures and clothing to be used when personnel must be near the furnace for non-routine light-offs. C. Warm-up Procedure Warm-up schedules and procedures must be established for each piece of fir ed equipment. These procedures should be programmed into the safety system to the greatest extent practical. 1. Procedures must cover the various modes and conditions that may be encountered such as cold light-off, warm light-off, hot light-off and refractory drying. 2. The procedures must specify the rate that the equipment is brought from its condition at light-off to its on-line status or to its fully automatic controlled status. 3. The procedures must specify the timing and order in which successive burners may be lit. 4. The procedures for lighting subsequent burners must specify permissives to be in effect, time limits for trial for ignition and conditions under which a repurge is required. 5. The procedures mus t specify when and under what conditions secondary fuels or process feeds may be introduced. D. Automatic Control Capability All fired equipment must be provided with automatic (modulating) controls to minimize manual operation of important control loops. These controls must be maintained in good working order, and they must be used in the day-to-day operation of the fired equipment. The following control loops are typical for a large number of installations and should be designed for automatic control where applicable. Any other control loops recommended for automatic control in Technology Center design guidelines should also be included. 1. Firing rate (fuel control) 2. Combustion air flow 3. Combustion zone pressure (furnace p DO A 117494 CONFTDFNTIAL ressure) 4. Drum level or heat transfer media level 5. Hot gas quench 6. Heat transfer fluid temperature E. Continuous Indications and Trends In addition to the normal operator interface with the ?rocess provided by the system, specific continuous ndications or trends are sometimes required by governmental regulatory bodies or by the Tech Center. to analog Continuous indications refers or digital gauges and meters that may be viewed at any time without calling it up via video terminal, selector button panel, or switch. Continuous trends means a record-over-time of any measured or calculated parameter that may be viewed at any time without "calling it up" or configuring it via a computer or selector. F. Alarms and Event Logs The following condition s must be alarmed (an automatic log of these alarms is strongly recommended): 1. Disagreement among measurements 2. All trips or runbacks (Runbacks are defined in 13.1.4) 3. All conditions that lead to a trip or runback 4. Any trip that is disabled or by-passed G. Automatic Trip, Runback, or Step-to-Safest-Status e safety An automatic trip, runback, or step-to-safest status must be provided by th system to protect personnel and equipment. The appropriate action must be predetermined and executed by the safety system for each of the applicable conditions below. nt. Other specific requirements and methods for determining the existence of these conditions and proper location of instrumentation are discussed in the Tech Center Design Guidelines for the specific equipme 1. Incomplete or improper light-off sequence 2. Loss of flame 3. Low fuel pressure 4. High fuel pressure 5. Low combustion air flow 6. Low air to fuel ratio 7. Trip of any draft fan 8. Loss of quench flow 9. Complete closure of any combustion-air flow control damper 10. Improper combustion zone pressure (furnace pressure) 11. Loss of heat transfer medium flow 12. Low drum level or low heat transfer fluid level 13. Loss of indication of process variables to the DO A 117495 CONFTDFNTT Al. ted trip extent that it is imprudent to continue operation 14. Low atomizing fluid flow or pressure for liquid fuel - must trip liquid fuel as minimum 15. High combustion or product temperatures at critical locations in the flow path 16. Operator initia H. Post-Trip Purge Post-trip purge or immediate initiation of a pre-light-off purge after a trip can cause a hazardous condition under some circumstances. The consequences of a purge initiated immediately after a trip should be considered for all possible fuels and conditions. The Technology Center Design Guidelines for the specific fired equipment should be consulted. I. Flame Snuffing Flame snuffing using steam or other non-flammable vapor may be considered as a method of extinguishing a fire resulting from flammables escaping from a tube rupture. Snuffing is especially applicable for process heaters used for heating flammable liquids. These are important points when considering the use of snuffing steam: 1. The snuffing medium flow must be greate r than the total air input capacity to the fired equipment. 2. If steam is used, condensate must not be allowed to collect in the supply piping. A very reliable condensate removal system must be used. 3. Consequences of the rapid temperature drop associated with the introduction of the snuffing medium into the combustion chamber must be known. 4. The supply of the snuffing medi urn must be very reliable. Once snuffing has started, loss of snuffing medium flow before the temperature has been sufficiently reduced may cause an explosion as air displaces the snuffing medium. 5. All fuels and process feeds burned in the equipment should be tripped before the snuffing medium is added, but snuffing must commence immediately before the leaki ng flammable can cause an explosive mixture. 6. Tripping followed by snuffing can also be used to prevent fired equipment from igniting an approaching flammable vapor cloud. 7. A snuffing system will require maintenance and inspections. 13.1.4 The Safety System - Functional Design The safety system must be designed to protect personnel and equipment from the hazards of explosion, implosion , fire, overpressure and overtemperature during all phases of operation and under all operating conditions. The safety system should provide for a completely automated light-off of the first burner. The following functions should be performed by the safety system. DO A 117496 CONFIDFNTIAL. A. Sequencing Safe design of the sequencing system and procedures is of paramount importance. Safety and loss records compiled by insurance companies show that most serious incidents involving fired equipment occur during the initial light-off sequence. In order for the safety system to start and proceed to a successful completion of a sequence, all permissives for each step in that sequence must be satisfied. A permissive is a required state of the equipment and process that must exist and be proven to exist by the instrumentation. A permissive is satisfied if it is within the specified limits for the required time period. A permissive may be a constant value, a function of other variables, a function of the step in the seguence, a function of the mode of operation or any combination of these. 1. Startup Sequencing A sequencing capability which provides, as minimum, automat ed pre-light-off purge and remote light-off of the first burner shall be provided. a A typical startup sequence involves purging the combustion zone and combustion-product passes of the fired equipment to sweep out any possible accumulation of combustible gases, energizing an electric ignitor to ignite the first burner, operating valves to admit fuel to the burner. controlling the combustion air and fuel flows to the burner, and verifying that a successful light-off has occurred. Guidelines for designing the sequence and specific prerequisites for the startup of specific fired equipment are found in the Technology Center Design Guidelines for that equipment. 2. Automatic Sequencing of Other Operations Seguencing of oth er operations similar to startup should be provided. One example is a normal shutdown where load is ramped down and then burners are sequentially removed from service. Refer to the Technology Center Design Guidelines. B. Alarming and Event Logging An alarm scheme with appropriate annunciation, seal-in, display, acknowledge and reset capability shall be provided. An alarm setting can be a constant value, a function of other variables, or a function of the step of the operational sequence. The system should be capable of logging time of occurrence of alarms and events. In the event of a trip or misoperation, the log provides a record for post-event analysis. Any specific guidelines for alarms and event logging for each type of fired DO A 117497 OONFTDE'NTTAl equipment are in the Technology Center Guidelines for that equipment. Design Individual alarms for each alarmed event or parameter should be provided. If some alarms are combined, the system should provide sufficient information to determine the initiating cause of the alarm. C. Safety System Intervention (Overriding) lity. The safety system must have ultimate overriding control capabi This overriding capability must be designed and installed such that it has priority control over all other controls including control loops in manual mode. Safety systems intervention may take the form of blocking actions which prevent erroneous control signals or commands from being executed, and runback actions which ramp down variables when a change creates a po tential hazard. The safety system must be designed such that control system actions and manual intervention within the predetermined safety limits are not impeded. Manual intervention that overrides the safety system in the safe direction only is allowed. For example, the safety system can permit manual tripping of a safety shutoff valve while the equipment is running, but will not allow th e safety shutoff valve to be manually opened when the safety system requires it to be closed. D. Tripping and Manual Reset An automatic trip capability shall be provided for all fuel and process feeds to the combustion zone. Other process inputs and outputs to the fired equipment must be examined to determine the necessity for automatic trips. At least one manual trip, located a t a safe distance from the fired equipment, must also be provided. These trips shall be designed such that once tripped, reintroduction of the tripped energy input is prevented until the trip sequence is completed and is manually reset. Manual reset means that plant operations personnel must take a deliberate action to rearm the trip after determination that it is safe to do so. Trip devices such as safety shutoff valves may be reset or relatched through electrical means via the safety system or by an operator from a location remote from the trip device, or they may be reset at the trip device itself if allowed by the safety system. D0 A U7498 CONFIDENTIAL E. Partial Trips, Sub-system Trips and Step-to-Safest Status nit, In addition to the ability to completely trip the u each installation should be reviewed carefully to determine whether any of the following capabilities could improve the safety or reliability of the unit: 1. Partial Trips An example of a partial trip is an automatic trip of one or more burners in a multiple-burner installation on load injection to prevent the fuel header pressure from going low and causing a complete unit trip on low burner pressure. 2. Sub-section Trips An example of a sub-system trip is a complete trip of one fuel system of a multiple-fueled installation allowing continued operation of the unit or units on other fuels. 3. Step-to-Safest Status For certain fired equipment, tripping the fuel under some circumstances can create a condition that is more hazardous than the condition with continued fuel input. One example where it is safer to not trip the fuelimmediately is a furnace with a flammable process fluid being heated that has a tube leak because it is better to incinerate the fluid than to allow the formation of an explosive vapor. A thorough review of possible circumstances where tripping the fuel could be unsafe must be conducted for each installation of fired equipment. the Technology Center Design Guidelines specific fired equipment. Consult for the 13.1.5 The Control System - Functional Design The control system for each installation of fired equipment shall be designed and installed to provide automatic control of all functions necessary to ensure a safe and optimum operation of the equi pment throughout its entire range of operations and operating conditions. The following are Minimum Requirements: A. Stable dynamic control of all automatic control loops shall be provided. B. An evaluation of each automatic control loop should be made to determine whether it should be provided with capability of being switched to manual control by plant operating personnel. Sufficient indication of the status of the equipment, the process and the controls must be provided to permit safe manual control. NOTE: The safety system has safe-direction priority DO A 117499 CONFTDFNTTAl control over all other control including loops switched to manual control. Attempts to manually adjust the equipment that would increase the risk of a safety or loss incident must be prevented. These protective blocks must b e pre-defined in the system design. C. All transfer capability between automatic control and manual control shall be designed such that unsafe transfer of control from one mode to the other is prevented. D. Indications, Trends and Displays The system must provide the operator of the fired equipment sufficient indication of key variables such that the status of the equipment and c ontrols can be determined at a glance. Trends and displays supplement indication and may be displayed on screens upon operator demand. It Is advised that trending capability be sufficient to allow trending of all analog inputs and all digital inputs. Specific requirements are included in the Technology Center Design Guidelines for the specific equipment. 13.1.6 The Control System - Design of Common Control Loops The following control loops are typical for a large number of fired equipment installations and where used should be designed and installed according to the following principles: A. Firing Rate (or Load Control) Firing rate is the rate that fuel is burned in the fired equipment, usually to provide useful energy output. Firing rate is to be varied automatically in response to changing demand Firing rate shall be controlled by the control system to ensure that the total fuel input does not exceed the maximum capability of the fired equipment. Fuel input to any individual burner should not exceed the capacity of the burner. The measured variables (flow, header pressure, process temperature, etc.) that determine the appropriate fuel input to the fired equipment depends on the application. The safety system has priority over the control system to ensure safety in the event of control system failure and can be used to block control signals, constrain valve and damper actuators( or run back actuators to a predetermined, safe position, or close safety shutoff valves for any given condition. These safety system interventions or constraint control s should be considered and utilized where applicable to prevent fuel flow increases when: DO A 117500 CONFIDENTIAL burner(s) high fuel flow is at or above the capacity of the air to fuel ratio is low combustion product oxygen is low combustion product CO or combustibles process fluid overpressure exists process fluid overtemperature exists combustion zone, quench zone or stack are high temperature is drum level is low or heat transfer fluid flow is low equipment is at or above maximum output high combustion zone pressure (furnace pressure) Consideration should be given to safety system interventions (overrides) to prevent manual increase of fuel flow for the above conditions. B. Combustion Air Flow The combustion air flow shall be controlled by the control system to ensure a safe level of combustion air. d be The safety system has priority over the control system to ensure safety and loss prevention in the event of control system failure and can be used to block control signals, constrain valve and damper actuators or run back actuators to a pre-determined, safe position for any given condition. These safety system interventions or constraint controls shoul considered and utilized where applicable to prevent air flow decrease when: air-to-fuel ratio is low combustion-product oxygen is low combustion-product CO or combustibles are high air flow is at or below the minimum specified burner manufacturer by Consideration should be given to safety system intervention (override) to prevent manual decrease of air flow f or the above conditions. C. Air-to-Fuel Ratio 1. Air-to-fuel ratio control provides the ability to optimize fuel efficiency while ensuring sufficient air for safe combustion. 2. When air-to-fuel ratio control is used, the controller must directly proportion combustion air and fuel flow to the burners by using feedback from flow measurements or by moving the respective flow positioners proportionately. In no case should feedback from flue gas analysis such as oxygen or carbon monoxide be used to directly control the ratio of air to fuel. Feedback from oxygen or carbon monoxide in the flue gas may be used to bias or fine tune the air-to-fuel ratio controller output within a narrowly limited range. 3. For fired equipment with multiple burners, t he C>0 A 117501 CONFIDENTIAL effect of a burner or burners being out of service must be taken into consideration. If the air flow through the out-of-service burner(s) is not shut off when the fuel is shut off, the design air and fuel flows to achieve the desired ratio will not be correct for the burners remaining in service. The air flow through the out-of-service burner(s) should be shut off when the fuel flow is shut off if possible. If this is not possible, the air-to-fuel ratio controller must be properly compensated for to account for this condition. 4. When utilized, air-to-fuel ratio control must be designed to prevent an unsafe condition when variations in fuel composition cause an increase in combustion air requirement. 5. It is recommended that ai r-to-fuel ratio control be one of two types: lead/lag or pacing, a) Lead/Lag Where practical, fired equipment should use a metered air-to-fuel ratio control. Metered means that the combustion air flow and all the fuel flows are measured. The system must be configured using Select logic to accomplish the following: 1)Combustion ai r flow requirements shall be determined but the higher of: fuel setpoint from the firing rate controller, or the actual measured fuel flow. of: 2) Fuel flow shall be determined by the lower air flow set point from the firing rate controller, or the actual measured air flow. With this design, an air flow increase alway s leads a fuel flow increase when picking up load, and always lags a fuel flow decrease when dropping load to ensure that an adequate volume of combustion air is available to completely burn the fuel, b) Pacing Many smaller installations with one or two burners are supplied with pacing type control air-to-fuel ratio systems. The positions of the fuel flow control valve and the air flow control device or devices are correlated to provide the correct air-to-fuel ratio throughout the operating range. The fuel control valve and air flow control device are either physically linked, or the position of one is set by position feedback from the other. In most such systems the fuel flow is measured, but the combustion air flow is not measured. Failure or misadjustment of the mechanical or electrical linkages can cause a hazardous air-to-fuel ratio. Each installation with pacing control must have safeguards to prevent explosions in the event of a linkage failure. DO A 117502 CONFIDENTIAL. iginally Special Precautions -- Fired equipment or supplied with pacing control can be converted to control where the air and fuel flow positioners are not linked, but in such conversions it is mandatory that the combustion air flow be measured and that a lead/lag system as described above be used. D. Drum Level Control (or Feedwater Flow Control) For most boilers and other fired equipment that produces steam, drum level control is one of the most critical control loops. The control design that gives the best control in most of these installations is called three-element control. For three-element control the steam flow, feedwater flow and drum level are all measured. One method of three element control is for the feedwater flow controller to use the measured steam flow as th e feedwater flow set point. That set point, however, is biased upward by low drum level and downward by high drum level. 13.1.7 System Design and Installation Requirements The energy conversion process in any fired equipment can be quickly driven to a condition where property loss, safety or ecological consequences are severe. At the same time there is an economic incentive to operate the equipment at high capacity, the rmal efficiency and unit availability. The system must, therefore, be designed and installed to perform with a high degree of dependability. The design and installation considerations discussed in this section can be used to help provide the level of dependability needed for safety and control of fired equipment. A. General lame 1. Technology The technology available to meet the requirements of each process such as f detection, air flow measuring, valve positioning, etc. should be evaluated and the best proven technology implemented. chnology" Modern technology should be used where it has a proven performance record, but consideration should be given to the compatibility of the new system with the existing plant control scheme. Piecemeal additions of the current "latest te that result in a confusing array of different control schemes should be avoided. Designers are urged to talk with appropriate experts and operators of similar equipment to learn the performance record of an instrument, valve, operator, etc. in actual service before specifying new equipment. 2. Speed Natural time lags throughout each control loop mu St be known and taken into account in designing and installing the system. The overall time required for measuring, scanning, processing, outputting and changing actuator positions must be designed such that safety and control stability is assured for all process changes encountered. The safety system must be designed to safely shut of five down the fired equipment within a maximum seconds from the time the initiating device is activated until the safety shut-off valves are fully closed. In the case of flame detectors, the time delay inherent in detection must be included in the five seconds. If the loss-of-flame contact operates three seconds after the flame is actually out, then the safety shutoff valves must be closed within two seco nds after the initiating device is activated. 3. Time Delays Time delays programmed into the safety system or field instruments to eliminate false trips must be kept to an absolute minimum and in no case shall jeopardize personnel and equipment. 4. Redundancy The system must incorporate appropriate levels of redundancy from the point of measurement through the input path, processing path and output including actuators to ensure controllability and reliability. path safety, For this LPP, redundant means more than one, and applies to any component, data path or power path of the system. It is important that any redundancy in the system be monitored and alarmed when a fault is detected or when redundant process measuremen ts do not agree. a) Components means individual transmitters, switches, input cards, output cards, micro-processors, trip relays, etc. It must be assumed that any one component will fail. The consequences of failure must be assessed and redundancy of the components designed to meet the reliability objectives. b) Data Paths The data input signal paths and control signal output paths must be considered in designing the redundancy of the system. The design and installation of cable tray routing is important. All cable trays converging at a single entry point through a control room wall, for example, creates a single point where fire or mechanical damage can shut down several pieces of fired equipment possibly for a long duration. simultaneously, Separation of paths for redundant inputs and outputs is critical to realizing the benefits of the redundancy. This separation includes I/O cards, cable trays and field junction boxes. c) Power Paths The instrument power path for the safety system an d the control system from the power source through various power conditioners, must also be designed with the appropriate level of redundancy. Uninterruptible power supplies or appropriate battery backup should be provided for these power paths. The power path for pump and fan motors and other powered equipment should also be designed with t he appropriate level of redundancy. For critical applications, automatic switchover schemes for power sources should be used, d) Auxiliary Systems Reliability of the auxiliary systems can affect the reliability of the fired equipment and its safety system and control system. Consequences of failure of each of the following auxiliary systems should be assessed and each system designed accordingly: instrument air fuel atomizing cooling water lubrication fluid fuel supply air conditioning nitrogen 5. Systems Logic Applied to Redundant and Non-redundant The decision to use one, two with OR logic, two with AND logic or three with VOTING logic is dependent upon the application. Specific recommended logic selections are discussed in Technology Center Design Guidelines, a) Single Component When only one (flame detector, air flow transmitter, microprocessor, etc.) is used in the system, the process must be tripped or driven to its safest status if the "one" indicat es that a trip condition exists, whether the indication is real or due to an instrument failure. Any instrument failure which disables a shutdown must be alarmed and appropriate action must be taken. b) Two With OR Logic When redundancy consisting of two with OR logic is used, indication of a trip condition by either must cause a trip or drive the process to its safest status. It is used when safety, loss or environmental considerations are very important and reliability considerations are relatively DO A 117S0S CONFIDENTIAL unimportant. c) Two With AND Logic When redundancy consisting of two with AND logic is used, both must agree before an action is taken. It is used when reliability is very important and there are no safety, property loss or environmental consequences. d) Three With VOTING Logic When redundancy consisting of three with voting logic is used, action will be taken when any two of the three agree that an action is required. It is used when high reliability is needed and safety, loss or environ mental consequences are severe. It is also used where instrument reliability is questionable. 6. Signal Selection in Redundant Systems The system must be designed and installed to ensure that when two or more inputs are used to determine a control output, the signal that causes the control system or safety system to drive the process in the safe direction is selec ted. For example, the lower of two combustion air flow signals and the higher of two fuel flow signals should be used for combustion control. A small allowable difference in the measurements should be predefined and alarmed when exceeded. It is permissible to use a computed average of two or more signals if: a) the allowable difference in the measurements is small, b) a difference greater than allowable is alarmed, and c) the control falls back to safe direction control when the difference is exceeded. 7. Self-Diagnosis Self-diagnosis is the ability of the system to determine that a fault or failure has occurred anywhere within the system that reduces the level of protection or controllability that was intended. S elf-diagnosis capability is advertised by most system vendors today; however, a thorough analysis must be made to determine whether the specific capabilities provided are adequate to secure the level of protection needed and to evaluate which is the best system for the application. Self-diagnosis includes the capability to verify that control and safety outputs are executed properly and within a predefined time limit. This requires that appropriate feedback from the equipment and process be provided by the system designers. flame Individual components and sub-systems should also have self-diagnosis or self-checking capabilities. For example, uninterruptible power supplies must switch over when self checking reveals a problem, and detectors should be one of the self DO A 117506 CONFIDENTIAL checking type. The system must be designed and installed such that operations personnel are alerted to system faults and all components of the system automatically fail to their safest status. 8. Failure Modes The system must be designed and installed such that failure of any single component will not jeopardize the safet y, environmental or loss prevention functions of the system. Some equipment such as valves and dampers can be designed to fail open, fail closed, or fail last. The appropriate failure mode for each of these components must be determined to ensure safety. The failure positions can be a function of the operating status of the equipment. The reasons used in d etermining the failure mode of each output field device (control valve, safety shutoff valve, etc.) should be maintained by the operating facility in the documentation package. Where computers, programmable logic controllers (PLCs), or other electronic circuits are used, it must be recognized that certain electronic components can fail either conducting or non-conducting. The full consequences of both types of failure for each loop must be assessed and understood. Redundancy, self diagnosis and correct failure modes are the tools to ensure reliability of the safety and prevention functions of the system. 9. Shielding, Connecting and Grounding Poor wiring connections, poor circuit board connections and improper gro unding and shielding are potential causes of unreliable performance of the system. Both the design and installation of all components require attention to detail to avoid future problems. B. Field Instrumentation Principles to make 1. Direct Measurement It is better to measure a variable directly than to infer the measurement. Though it is sometimes virtually impossible all of the direct measurements desired, it should be kept in mind that serious consequences can result from relying solely upon inferred data. For example, the use of a duct pressure switch at the discharge of a forced draft fan to infer purge air flow illustrates the point. A burner air register (and/or an air flow control damper or stack damper) that can be closed is sometimes located downstream of the pressure tap. Undetected closure of any of these could cause the switch to satisfy the purge air flow permissive D0 A 117507 confidential when in actuality there is inadequate air flow. The cost of providing safeguards that reduce risk to the same level as the direct measurement approach is often as high as providing the direct measurement. 2. edundancy Analog Transmitters Versus Switches Analog transmitters should be used in preference to switches. This includes pressure transmitters rather than pressure switches and position transmitters in preference to limit switches to indicate the position of modulated dampers and valves. 3. Redundancy of Field Instrumentation It is recommended that some level of r be installed for all measurements which can cause process trip. For true redundancy of a field mounted instrument, each sensor must be mounted on a different tap so that plugging or breaking off of the tap does not affect more than one measurement. Redundancy can be obtained with two or more instruments that have the same measuring principle or with two or more instruments that use different measuring principles. An example of two measurements of different principle is a pressure transmitter on a boiler steam drum and a temperature measurement of the steam in the vapor space. Saturated steam temperature can be used to infer pressure. The same measurement can be used for pre-trip alarm in addition to tripping the process. control and C. Controlled Equipment and Sub-systems 1. The Combustion Air and Draft System a) Fans shall have sufficient capacity to supply all air required for safe operation plus 15 percent volume flow as established by the boiler operating at maximum load and at a specified maximum inlet air or gas temperature to the fan. b) Fans and d ucts must be designed to withstand the static pressure associated with the excess flow capacity requirement above. c) The arrangement of air inlets, duct work and air pre-heaters shall minimize contamination of the air supply by such materials as flue gas, water and fuel or other combustible materials. Appropriate drain and access openings shall be provid ed. d) The air supply equipment shall be capable of continuing the proper air flow during . anticipated furnace pressure pulsations. 2 Fuel System and Process Feeds Burned in the Fired Equipment Schematic diagrams of typical fuel systems for installations of fired equipment can be found in DO A 117508 CONFIDFNTIAL the Technology Center Design Guidelines. a) All fired equipment sha 11 be provided with means of ensuring that the fuel at each burner tip is maintained at the correct flow rate, pressure, temperature, composition, viscosity and purity. b) All fired equipment shall be provided with means to positively isolate all fuel and process feeds from the fired equipment, the fuel handling equipment, and other devices while maintenance is being performed. c) The fuel system shall comply with the latest LPPs for Emergency Block Valves and Relief Systems. d) All fired equipment shall be provided with safety shutoff valves. Safety shutoff valves must stop all liquid and gaseous fuel input and process feeds to individual installations of fired equipment automatically and rapidly. Safety shutoff v alves must have the following characteristics: Be quick closing. The safety system must be designed to safely shut down the fired equipment within a maximum of five seconds from the time the initiating device is activated until the safety shut-off valves are fully closed. In the case of flame detectors, the time delay inherent in detec tion must be included in the five seconds. If the loss-of-flame contact operates three seconds after the flame is actually out, then the safety shutoff valves must be closed within two seconds after the initiating device is activated. Be for on/off service only. Cannot be used for control or any other service other than for isolation. Be of a design that provides positive shutoff. Be provided with position switches supplied as needed to prove the valve position. Consist of automatic double blocks on all gaseous and liquid fuels and process feeds that are burned in the combustion zone. A vent, drain, purge or bleed must be installed between the two automatic valves and the material discharged must be disposed of in a safe and environmentally responsible manner. The vent, drain, purge or bleed valves need not necessarily be automatically operated. Be located as close to the burners as practical to minimize entrained energy downstream of the safety shutoff valves. Be close coupled. The distance between the upstream and downstream safety shutoff valves must be no greater than three pipe diameters or 12 in (30.5 cm), whichever is greater. e) Pipe, valves, flanges, and fittings shall conform to piping specifications for the fuel and process feed conditions. f) Piping for fuel and process feeds burned in the DO A 117509 CONFIDENTIAL fired eq uipment shall be routed carefully with respect to roadways and railroads to reduce the possibility of components such as valves from being struck by heavy maintenance equipment, automobiles or derailed train cars, g) Where fuel or process feed piping must be routed through buildings or tunnels, adequate ventilation and leak detection must be provided, h ) All piping carrying fuel and process feeds to be burned in the combustion zone shall be designed and installed with appropriate purging connections for maintenance. 3. Ignition and Combustion System a) An ignitor is the device that first introduces an ignition source into the fired equipment. The ignitor must be designed with the following features: Commercially manufactured or of proven design for the application. Remotely operated. Properly sized and aligned to provide sufficient energy to ignite the associated pilot or main burner. Used on a burner that is provided with flame detection. b) A pilot is a burner that lights another burner. All pilots must incorporate the following design features: Commercially manufactured or of proven design for the application. Properly sized and aligned to provide sufficient energy to ignite the associated burner. Must be proved stable for a minimum of five seconds before permitting fuel to be admitted to the associated main burner. If a continuous pilot, must be minimum of 10 percent of design maximum input of associated main burner unless otherwise specified in the Technology Center Design Guidelines. If a continuous pilot, must be continuously proved independently of the associated main flame unless equal protection is provided and documented in the documentation package. of proven If an interrupted pilot, the pilot must shut down within 10 seconds after opening safety shutoff valves for gas and light oil fuels, or within 15 seconds after opening safety shutoff valves for heavy oil fuels. Safety shutoff valves must be provided for pilots regardless of pilot size. c) Main Burner Commercially manufactured or design for the application. Stable and self-supporting at all times if not supplied with a continuous pilot. Supplied with proper atomization if required. Designed as an integral part of the overall emission control system. D0 A 117510 CONFIDENTIAL. Designed for temperature of combustion air. d) Flame Detection Commercially manufactured detectors o r of proven design for the application. UV or IR flame detector best suited to fuel and furnace design. Flame ionization detector can be used with approval of Technology Center. Self-checking detectors. Mechanical type self-checking detectors are preferred. If two detectors are used, must use both, or one designated for proving flame for lig ht-off of first burner. Aligned and focused to detect only the flame or flames intended. The total time from actual flame out until the safety shutoff valves are closed must be five seconds or less. Detector response to loss of flame must be under four seconds. Detector installed such that it will detect flame lift-off if possible. Flame lif t-off is a condition where the flame front moves away form the burner tip further than is designed for the Btu input rate of the burner. Purge medium for detector must be clean, dry and oil-free. 4. Furnace Conditions (Television) Properly designed and installed furnace television may be of significant value as a supplementary indication of flame and othe r conditions in some furnace designs. It is of particular value during start-up in viewing igniters, pilots and individual burners for proper ignition. This is an aid, but not a substitute for flame detectors and other condition monitoring. 13.1.8 Maintenance, Inspection and Testing of the System A. Critical Instruments Critical instruments associated with the system be defined and tested according to the latest edition of the LPP for critical instruments. shall B. Documentation Package A documentation package is required for each installation. It should be up-to-date, available, and must contain the following: 1. Dow piping and instrument diagrams (P&lDs) 2. Critical instrument list, testing procedure for each instrument, and record of tests 3. Listing of trips and trip set points 4. Logic diagram for safety system 5. Control logic block diagrams 6. Source code for the safety system and the control system and wiring diagrams for relay systems 7. The security policy 8. Calculations for purge rate and purge time requirements DO A 117511 CONFIDENTIAL F safety 9. The reasons used in determining the failure mode of each output field device (control valve, shutoff valve, etc.)* 10. Applicable Technology Center Design for the fired equipment Guidelines 11. equipment Operating procedures associated with the fired 12. Written approvals of deviations from this LPP 13. Log of significant system modifications C. Inspections and Reports Required by Governmental Agencies Inspection schedules and other requirements, along with their proper reports and documentation, shall strictly adhere to authorized governmental requirements for fired equipment and systems. APPENDIX A LIST OF FIRED EQUIPMENT agencies Power and Utilities Technology Center Field-erected boilers (power boilers) Package boilers - single burner Package boilers - multiple burner Heat recovery steam generators - auxiliary fired Hydr ocarbons Technology Center Radiant-wall cracking furnaces (gas feed) Radiant-wall cracking furnaces (liquid feed) Fired steam superheaters Multiple-burner process heaters - not radiant wall CEP Technology Center Radiant-wall cracking furnaces (liquid feed) Multiple-burner process heaters - not radiant wall Environmental Technology Center Thermal oxidizers (TOX) Thermal heat recovery oxidizers (THROX) Halogen acid fu rnaces (HAF) Appendix A (continued) The following fired equipment when involved in disposal of solid, liquid, and gaseous materials: treatment and DO A 117512 CONFIDENTIAL l ovens rotary kilns Multiple-chambered incinerators APPENDIX B LIST OF REFERENCES RELATING TO THE DESIGN, MANUFACTURE, INSTALLATION, OPERATION AND MAINTENANCE OF FIRED EQUIPMENT ASME CSD-1 Controls and Safety Devices for Automatically Fired Boilers The rules of this cod e cover requirements for the assembly, maintenance and operation of controls and safety devices installed on automatically operated boilers directly fired with gas, oil, gas-oil or electricity, and are applicable to the following service: All automatically fired boilers regardless of fuel ratings; b) burners field-installed in automatically boilers. input fired Boilers with fuel input ratings of 400,000 Btuh (117 228 W) or below are covere d in this code under Part CR. Boilers with fuel input ratings of 12,500 Btuh or above, falling within the scope of NFPA 85A, NFPA 85B, FRPA 85D, NFPA 85E and water heaters, are excluded from this code. NFPA 85A Prevention of Furnace Explosions in Fuel-Oil and Natural Gas-Fired Single Burner Boiler-Furnaces This bulletin applies to boilers with fuel input greater than 12,500,000 Btuh (3663 KW) that use single burners firing natural gas, fuel oil, or both. It includes information on design, installation, operation and maintenance. This standard applies only to boiler-furnaces using single burners firing: natural gas only, other gas with a Btuh value and characteristics similar to natural gas, fuel oil (only No. 2, 4, 5, or 6 grade), simultaneous firing of gas and oil for fuel transfer, simultaneous firing of gas and oil continuously. NFPA 85B Prevention of Furnace Explosions in Natural Gas-F ired Multiple Burner Boiler-Furnaces This bulletin presents requirements for the design, installation, operation and maintenance of specified boiler furnaces, their fuel-burning systems and related control equipment. This standard applies to boilers with fuel input greater than 12,500,000 Btuh (3663 KW) and applies only to boiler-furnaces using multiple burners firing natural gas and other similar gaseous fuels. NFPA 85D Prevention of Furnace Explo sions in Fuel Oil-Fired Multiple Burner Boiler-Furnaces DO A 117513 CONFIDENTIAL This bulletin outlines equipment requirements, sequencing of operations and interlock and alarm requirements for specified boiler-furnaces. This standard applies to boilers with fuel input greater than 12,500,000 Btuh (3663 KW) and applies to boiler-furnaces using multiple burners firing fuel oil only. NFPA 85G Prevention of Furnace Implosions in Multiple Burner Boiler-Furnaces The scope o f this standard is to establish minimum standards for the design, installation and operation of boiler-furnaces, their fuel burning, air supply and combustion products removal systems which include induced draft fans, related control equipment and the stack, to prevent furnace implosions and to contribute to operating safety. NFPA 86 Ovens and Furnaces This bulletin applies to Class A/B ovens or furnaces - heat utilization equipment operating at atmospheric pressures and used by industry for the processing of materials. This standard provides requirements for location, construction, operation, heating system, ventilation, safety control equipment and fire protection. NOTE: Current revisions and amendments of the above NFPA guidelines take precedence over those listed. North American Guidelines for Applications of MOD V to Burner Management The purpose of this guideline is to assist MOD V application personnel in both the c entral group and manufacturing in the application of MOD V to fired equipment installed in the U.S.A. The basis of this document is the Dow Corporate Loss Prevention Principles. The intent is to provide a standardized method for enforcement of the burner management principles stated in the Loss Prevention Principles. Europe Guidelines for Applications of MOD V to Burner Management The purpose of this guideline is to assist MOD V application personnel in both the central gr oup and manufacturing in the application of MOD V to fired equipment installed in Europe. The basis of this document is the Dow Corporate Loss Prevention Principles. The intent is to provide a standardized method for enforcement of the burner management principles stated in the Loss Prevention Principles. APPENDIX C BURNER MANAGEMENT AUDIT FORM FOR FIRED EQUIPMENT Location of Equipment (Plant/Block): Date Form: Name of Person Filling Out THE FOLLOWING DOES NOT APPLY TO SPACE HEATERS, POTABLE WATER HEATING AND CERTAIN OTHER NON-PROCESS APPLICATIONS. A. General 1. Have you read and understood LPP 13.1? No ( ) Yes ( ) 2. Have all deviation from LPP 13.1 been documented and approved by either your major manager or site manager? Yes ( DO A 117514 CONFIDENTIAL ) No ( ) 3. Have you developed installation? 13.1.8B) Yes ( ) No ( ) a documentation (LPP package for this 4. Have you worked with your Tech Center regarding specific burner management guidelines related to your equipment? Yes ( ) No ( ) 5. Have you written changes to Yes ( ) No ( ) a security policy the system preventing unwanted or equipment? 6. Do you have a written warm-up procedure for this equipment? Yes ( ) No ( ) 7. Does your installation utilize flame snuffing? Yes ( ) No ( ) B. Pre-Lightoff Requirements 1. Do you have a continuous, uninterrupted purge sufficient to displace a minimum of five fire box and combustion-product-path volumes prior to trial for ignition? 2. Is your purge flow rate at or above 25% of design maximum? Yes ( ) No ( ) Are redundant determinations of purge flow utilized? Yes ( ) No ( ) 3. If your fire d equipment is natural draft, what means do you use to obtain adequate flow for purging? C. Lighting First Burner 1. Is it possible to have a flame detected prior to trial for ignition? Yes ( ) No ( ) 2. If the initial attempt to light the burner is unsuccessful, is it possible to try again before repurging the system? Yes ( ) No ( ) 3. How many flame detectors do you have monitoring your first burner? D. Safety Sys tem 1. Is your pre-lightoff burner automated? No ( ) purge and remote lightoff of the Yes first () 2. Does capability? No ( ) your safety system have ultimate overriding control Yes ( ) 00 A 11751s confidential 3. Do you have an automatic to the combustion zone? No ( ) trip for all fuel and process Yes feeds () 4. Do y ou have a manual trip for the equipment located at a safe distance? Yes No ( ) ( ) 5. Does the system have the safety shutoff valves fully closed within five (5) seconds from the time the initiating device is activated? Yes ( ) No ( E. Control System 1. Is your system automatic ntrol? Yes ( ) No ( ) set up and for bumpless transfer manual between co 2. Do you use feedback from flue gas analysis control the ratio of air to fuel? No ( ) to directly Yes ( ) 3. Does your installation have pacing? (See LPP 13.1.6 C5.2)Yes ( If yes, what safeguards do you have to prevent explosions from linkage failure? ) ) No F. Controlled Equipment and Sub-Systems 1. Do your combustion air fans have req uired for safe operation plus 15%? No ( ) capacity to Yes supply () all air 2. Is your equipment set up to ensure that the fuel at each burner tip is maintained at the correct flow rate, pressure, temperature, composition, viscosity and purity? 3. Complete trip, partial trip, runback or step-to-safest status are required as part of the safety system. Which are applicable to your instal lation? (See next page) PLEASE SELECT THE APPROPRIATE PROGRAMMED RESPONSE AS IT PERTAINS TO YOUR FIRED EQUIPMENT RIP TRIP BACK COMPLETE T SAFEST N.A PARTIA L RUN STEP-TO- 1. Incomplete/improper light-off sequence 2. Loss of flame DO A 117516 CONFIDENTIAL 3. Low fuel pressure 4. High fuel pressure 5. Low combustion air flow 6. Low air to fuel ratio 7. Trip of any draft fan 8. Loss of quench flow 9. Closure combustion/air flow control damage 10. Unstable combustion zone pressure 11. Loss of heat transfer medium flow 12. Low drum level/low heat transfer fluid level 13. Loss indication of process variables 14. Low atomizing fluid flow/liquid fuel pressure 15. High combustion/product temperature 16. Operator initiated trip UNIT LOSS PREVENTION INSURANCE REPORT 1. Summary of Unit Features and Status Area/Country North America / USA Site Louisiana Divison Unit Superintendent Ken Fox Division Louisiana Division Unit Power 1 Location Plaquemine, La. Date 5/19/94 Building Number/s Bldg.2801 Date of Previous Inspection 3/10/92 Type of Operation Power Plant and Water Treating Inspected By (from Safety & Loss Prevention) Buck Bailey Inspected by (from Plant) Marty Morrison Give a written summary including overall evaluation comments, comparison to previous inspection, and summary of recommendations: Consolidated Audit summary is attached as a separate report. Form C-91870A IS-0850 Page 1 of 6 DO A 117518 CONFIDENTIAL 1/93 UNIT LOSS PREVENTION INSURANCE REPORT 2. Summary of Ratings and Recommendations for Unit UNIT RISK FEATURES 3. Plant Condition and Appearance 4. Unit Risk Analysis Package 5. Changes Since Last Inspection 6. Features for Areas in Unit 7. Drainage and Containment 8. Tank Storage 9. Electrical & Instrument Conditions 10. Chemical Inventory & Isolation 11. Management Considerations 12. Plant Reliability R = Recommend Upgrading G = Good F = Fair E = Excellent RECOMMENDATION R F G E NA NUMBER/S X X X X X X X NA = Not Applicable Refer to Guideline for definitions of ratings. For recommendations, see Pages. Give a brief narrative background summary including history of unit with details on age, construction phases, original plant, etc. h Ale*. j ^ *1 i *2-- i< r- fS, j ^ ~ u* ts j fii /la.'ii'- ^ J ^ ct^j + >a ^ 1r ^^ a *s-t at ^> j j life 3 zllV Tri>i A `'1 / ^ '*** Form C-91870A IS-0850 Page 2 of 6 DO A 117519 CONFTDFNTTAl 1/93 UNIT LOSS PREVENTION INSURANCE REPORT 3. General Unit Information Plant Unit , f U h)>h t-S Unit Products Raw Materials /l>e/ A^iv'ir U/a/cs' Operating Davs/Week? . Operating Hours/Day? 2V Plant Condition & Appearance - Description No. of Shifts? e Date Hours per Shift? 4. Unit Risk Analysis Package Items which must be attached as part of Risk Analysis Package (Check if attached/Give any explanations) Block Flow Sheets Yes F&EI Calc. Sheets for Highest MPPD and Highest MPDO & Bl Yes Process Description Yes CEI Summary Sheets Yes Plot Plan with Areas of Exposure and Protection Features Yes Business Interruption Data Yes F&EI Risk Analysis Summary Yes Replacement Value ^ 3 ft rw.iv'>- Interdependencies with Other Dow Facilities & Which Facilities? Power and steam generated by the Power 1 plant is supplied through a distribution network to all other plants at the site. Power 2 is a co-generator of power and steam. Condensate returned from the other plants is used to feed the steam boilers. Interdependencies with Non-Dow Facilities Raw Material supplier, Utility Supplier, Final Processing, Sole Supplier, etc. Fuel gas is received into the site from a south Louisiana supply network. Oxygen and mitrogen is received by pipeline from a local company and distributed by the Power plant. An electrical tie in place to send and receive power from the local utility company. Spare Parts Available ror Critical Equipment? Which Critical Equipment? Yes, inventory is maintained locally. List Top 3 Critical Items 1. Boilers 2. Turbines 3. Generators Spares Available? Yes 5. Changes Since Last Loss Prevention Inspection Significant Changes to Plant Since Last Loss Prevention Inspection? Any Incidents Since Last Inspection? 1. Boiler NOX Reduction Project 2. Cathodic protection project 3. i31-1 Car' f" 1 f '"0t> 1*- -- u t 1 >. Management of Change Program Established? Yes participation follows the U.S.Safety Standard Significant Capital Projects in Progress or Planned? Give Title and Amount of Capital. 1. Boiler NOX reduction project (completion) f H (ar-"-1 " i1 Ur/ 1' V, i ) UP Review Done/Planned? Yes Date? Form C-91870A IS-0850 Page 3 of 6 DO A 117520 CONFIDENTIAL 1/93 UNIT LOSS PREVENTION INSURANCE REPORT 6. Features for Areas in Unit REFER TO PLOT PLAN WHICH IS TO BE ATTACHED. (CHANGE TOP HEADING NAME IF NEEDED.) FEATURE AREA * SEPARATION PER LPP 2.2? m 6.?L' FIRE WALLS FOR SEPARATION? HOUR RATINGS? PERCENT OF PLANT VALUE? STRUCTURE AREA? STRUCTURE HEIGHT? NUMBER OF OPERATING LEVELS? TYPE OF CONSTRUC TION? (COMBUSTIBLE OR NOT?) OPEN OR CLOSED CONSTRUCTION? (PERCENT OPEN?) FIREPROOFING USED? (TYPE?) DELUGE & DRAINAGE IN LIEU OF FIRE PROOFING? SPRINKLER SYSTEMS? DELUGE SYSTEMS? FOAM SYSTEMS? AUTOMATIC OR MANUAL TRIGGERING OF SYSTEMS? HYDRANTS IN AREA? FIRE WATER MONITORS? INERTING SYSTEMS? FIRE EXTINGUISHING SYSTEMS? (CO.HALON, ETC.) OTHER FIRE PROTECTION SYSTEMS? OTHER SYSTEMS? SPECIFY. JftNK PARM *n.*re~* REAOtlpN/ JjBr fit - OTHER (SPECIFY) WARE HOUSE OFFICE/ CONTROL ROOM Form C-91870A IS-0850 Page 4 of 6 DO A 117521 CONFTDENTTAI. 1/93 UNIT LOSS PREVENTION INSUhiANUb RbPURI 7. Drainage and Containment Type of Impoundment - Remote Pit vs Dike Volume per LPP 7.6.2.G? Testing of Drainage System? Firewater Containment Considered? Open Trenches or Closed Drains? Drainage Away from Tanks & Equipment? Plans/Equipment for emptying Pits/Dikes? Vapor Suppression of Pit/Dike using Foam? Tank separation distances per LPP 7.6.6? Worst Rainfall Considered? Impervious Containment Surfaces? Operating Discipline to Keep Pits/Dikes Empty? 8. Tank Storage Types of Tanks (Pressure Vessels, Atmospheric Tanks, etc.) Redundant High Level Alarms? Pressure Relief? Vessel Registration Program? With Inspection & Testing? Codes Observed(A.P.I., A.S.M.E. U.L., T.U.V., etc.) Interlock Between High Level Alarms & Pumping? Vacuum Relief? Pressure Vessel Relief Registration? With Inspection & Testing? 9. Electrical and Instrument Conditions Electrical Classifications Areas Well Defined?(See LPP 3.1) Non-classified Plant El. Classification Drawing Up- To Date? Last Revision Date? Redundant Electrical Feeds? Yes Backup Generators? Yes Grounding with Inspection Program? Oil Filled Electrical Equipment? Yes Oil Filled Equip. Indoors or Outdoors? Outdoors Cable Penetrations Sealed? Yes Cable Trays Exposed to Potential Fires? Cable Trays Sprinkler Protected? Yes -Type of Process Control - MOD Control? - Process Information Systems? Periodic Review of MOD Program? - Audits of MOD Program and Alarms? 10. Chemical Inventory & Isolation Handling Flammable, Toxic or Corrosive Liquids and/or Gases Are There Flammable Liquids/Gases? Flammable gas Is There Flammable Gas Detection? No What are they? Methane, Hydrogen, Syn-Gas Frequency of Testing Gas Detectors? ^ ' Hazard Ratings Shown on Tanks? (LPP 1,5) Not used in LAD NFPA Ratings or Other Shown? Not used in LAD Emergency Block Valves Other Special Hazards Are there Toxic Liquids/Gases? Yes What are they? Chlorine cylinder Are there Corrosive Liquids/Gases? Yes What are they? Caustic -, Are EBVs Identified in Drawings? Yes Are EBVs Identified in Field? Frequency of Testing of EBVs? 8*.-L. JiwVj /f.* Kl*. S Are EBVs Fire Rated in Flammable Service? No Any Other Special Hazards which Increase Risk of Operation? Form C-91870A IS-0850 Page 5 of 6 DO A 117522 CONFIDENT! Al 1/93 UNIT LOSS PREVENTION INSURANCE REPORT 11. Management Considerations Last Loss Prevention Inspection? March 1992 Last Consolidated Audit? March 1992 Other Audits or Reviews of Plant? (e.g. T/C) Tech Center Implementation of Minimum Requirements? Yes Operator Training Procedures Written & Current? Yes Operating Procedures Written & Current? Yes Emergency Plans Written for Unit? Yes Written Plans for Fire Protection Impairment? Yes,LAD S&LP Standards Date of Last Hypothetical Emergency? shi Critical Instrument Program Established? Yes Emergency Plans Shared with Other Units & Oil .Site? No Testing of Critical Instruments? Yes Preventative Maintenance Program in Place? Yes Reactive Chemicals Program? Yes Date of Last Reactive Chemicals Review? March 1992 Plant Contact Person for Loss Prevention? Ken Fox, Marty Morrison Contractor Safety Program Established? Yes Smoking Regulations & Enforcement? Yes. LAD policy Other Management Programs in Place Affecting Loss Prevention? List e.g., Fire Protection Inspections, Insurance Inspections 12. Plant Reliability r" Production Capacity Per Cent of Capacity for Year Theoretical Hours/Year for Production Capacity? Hours/Year Loss Due to Outages or Percent Reduced Rates Reliability (Hours. Operation at Theoretical Rate) (Total Hours Available) Form C-91870A IS-0850 Page 6 of 6 DO A 117523 CONFIDENTIAL 1/93 I FIRE & EXPLOSION INDEX AREA/COUNTRY DIVISION LOCATION -*! DATE North America / USA SITE Louisiana Division MANUFACTURING UNIT Plaquemine.Lae PROCESS UNIT 5/26/94 Loouisrana Division PREPARED BY; Power 1 Boiler 4 APPROVED BY: (Sup*rmt*ndnt) BUILDING Marty Morrison REVIEWED BY: <Mang*in*nt) Ken Fox REVIEWED BY; (Technology Center) B-2801 REVIEWED BY: (Safety 4 Lott Prevention) ? MATERIALS IN PROCESS UNIT ? Buck Bailey Methane STATE OF OPERATION BASIC MATERIAL^) FOR MATERIAL FACTOR __ DESIGN __ STARTUP JC.NORMALOPERATION __ SHUTDOWN Methane MATERIAL FACTOR (See Table 1 or Appendices A or B) Note requirements when unit temperatures over 140 *F (6 21 1. General Process Hazards Penalty Fac Penalty Fac tor Range tor Used (1) Base Factor.......................................................................................................... 1.00 1.00 A. Exothermic Chemical Reactions B. Endothermic Processes 0.30 to 1.25 0.20 to 0.40 0.00 0.00 C. Material Handling and Transfer D. Enclosed or Indoor Process Units 0.25 to 1.05 0.25 to 0.90 0.00 0.00 E. Access 0.20 to 0.35 0.00 F. Drainage and Spill Control Oaallons 0.25 to 0.50 0.00 General Process Hazards F actor(FI).................................................................................. 1.00 2. Special Process Hazards Base Factor.......................................................................................................... 1.00 A. Toxic Material(s) 0.20 to 0.80 B. Sub-Atmospheric Pressure (< 500 mm Hg) C. Operation In or Near Flammable Range ___ INERTED _X_ NOT INERTED 0.50 1. Tank Farms Storage Flammable Liquids 0.50 2. Process Upset or Purge Failure 0.30 3. Always in Flammable Range D. Dust Explosion (See Table 3) 0.80 _ 0.25 to 2.00 E. Pressure (See Fiaure 2) Ooeratina Pressure 45 Dsia Relief Settina 55 Dsia F. Low Temperature G. Quantity of Flammable/Unstable Material ___ 0.20 to 0.30 Quantity-100 lb He = 21.500 BTU/lb 1. Liquids or Gases in Process (See Figure 3) 2. Liquids or Gases in Storage (See Figure 4) 1.00 0.20 0.00 0.00 0.30 0.00 0,00 0.22 0.00 0.00 0.00 3. Combustible Solids in Storage, Dust in Process (See Figure 5) H. Corrosion and Erosion 1. Leakage - Joints and Packing 0.10 to 0.75 0.10 to 1.50 0.00 0.00 0.00 J. Use of Fired Equipment (See Figure 6) 1.00 K. Hot Oil Heat Exchange System (See Table 5) 0.15to 1.15 0.00 L. Rotating Equipment 0.50 0.00 Special Process Hazards Factor (F2).................................................................................. 2.72 Process Unit Hazards Factor (FI x F2) * F3................................................................... Fire and Explosion Index (F3 x MF * F&EI)........................................................................ 2.72 57 (1) For no penalty use 0.00. DO A 117524 CONFIDENTIAL Print Date: 5/26/94 r LOSS CONTROL CREDIT FACTORS r ' 1. Process Control Credit Factor (Cl) Feature a. Emergency Power b. Cooling c. Explosion Control d. Emergency Shutdown e. Computer Control Credit Factor Range 0.98 0.97 to 0,99 0.84 to 0.88 0.96 to 0.99 0.93 to 0.99 Credit Factor Used (2) 0.98 1.00 1.00 0.98 0.93 Feature f. Inert Gas ? Operating Instructions/Procedures h. Reactive Chemical Review 1. Other Process Hazard Analysis Credit Factor Range 0.94 to 0.96 0.91 to 0.99 0.91 to 0.98 0.91 to 0.98 Credit Factor Used (2) 1.00 0.92 0.91 0.96 Cl Value (3) 1 0.715 | 2. Material Isolation Credit Factor (C2) Feature Credit Factor Range Credit Factor Used (2) Feature a. Remote Control Valves 0.96 to 0.98 ! b. Dump/Blowdown 0.96 to 0.98 0.96 1.00 c. Drainage d. Interlock u/Ji iAe-t 'lie" C2 Value (3) | 0,874 j Credit Factor Range 0.91 to 0.97 0.98 Credit Factor Used (2) 0.91 1.00 3 Fire Protection Credit Factor (C3) Feature a. Leak Detection b. Structural Steel rt > tut c. Fire Water Supply d. Special Systems e. Sprinkler Systems Credit Factor Range 0.94 to 0.98 0.95 to 0.98 0.94 to 0.97 0.91 0.74 to 0.97 Credit Factor Used (2) 1.00 1.00 0.97 Feature f. Water Curtains g. Foam h. Hand Extinguishers/Monitors i. Cable Protection Credit Credit Factor Factor Range Used (2) 0.97 to 0.98 1.00 0.92 to 0.97 1.00 0.93 to 0.98 1.00 0.94 to 0.98 '"i-oqj. dt Yaa.,dL\~ K> d C3 Value (3) | 0.970 | Loss Control Credit Factor * Cl x C2 x C3 (3) * [ 0.606 PROCESS UNIT RISK ANALYSIS SUMMARY 1. Fire and Explosion Index (F&EI).......... (See Front) 57 2. Radius of Exposure................................... <ngm7> 48 ft 3. Area of Exposure................................................................ 7218 sq.ft. 4. Value of Area of Exposure (1994 Dollars).................................................................... ....... $MM 5. Damage Factor....................................................... 0.56 6. Base Maximum Probable Property Damage (Base MPPD) [4 x 5]................... 7. Loss Control Credit Factor ........................(See Above)| 0.61 $MM 8. Actual Maximum Probable Property Damage (Actual MPPD) [6x7].... ................ $MM 9. Maximum Probable Days Outage - (MPDO) (ngm| 64 days 10. Business Interruption - (Bl)................................................................................................. SMM 18.98 10.60 6.42 1.48 | I | | (2) For no credit factor enter 1.00 (3) Product of all factors used Refer to "Fire & Explosion Index Hazard Classification Guide" (Form #471-00001) for details Print Date: 5/26/94 DO A 117525 CONFIDENTIAL