THIS MONTH'S PUZZLER We had six railcars in a propylene loading bay. One of the tankers was overfilled and was vented to fixed piping via hose at the loading station; the fill valves on the car and the loading arm were open. The other cars' valves and their loading valves on the fixed piping were closed per standard procedure. Sometime during the night two additional cars were brought down the line to be filled, pushing the first six cars towards the exit and blocking the entrance track point. The locomotive crew — believing the first six railcars were full and disconnected — bumped the cars further down to access other bays. In the process, a hose snapped. The emergency cut-off valve for the bay failed. The only way to prevent a major catastrophe was for an operator to rush in to manually close the valve. He stopped the flow but received serious cold burns. Fortunately, the propylene vapor cloud didn't ignite. How can we ensure that nothing like this ever happens again? MAKE CHANGES ─ IMMEDIATELY!I encountered a similar problem while working in a plant that constantly unloaded propylene rail cars in a remote unloading rack located approximately ½-mile from the control room. On more than one occasion a hose had failed, resulting in a major leak and very dangerous situation. The Department of Transportation stipulated that the unloading station be manned continually; the unloading process took six to eight hours. We implemented the following changes: 1) the hoses were replaced with piped swing arms (which are safer than hoses); 2) remote-operated vapor and liquid block valves were installed on the base of each arm, allowing local control; 3) liquid valves were fail-closed with open/closed indicator switches; 4) valves were cycled each time a set of cars was unloaded; 4) cameras were installed on the rack to monitor the process; and 5) propylene sensors were placed strategically around the loading area to detect leaks. In your particular case I would also add a sign and derail on the railroad tracks ahead of the loading area. Only the operator should be permitted to remove this derail once loading/unloading is complete. If your plant lacks these procedures then you should implement them. P. Hunter Vegas, senior project engineer
Avid Solutions, Inc., Winston Salem, N.C.FLAG ITI'm not sure how far reaching this requirement is, but in Ontario it is required to erect a blue "tank car connected" flag on the track leading to a connected rail car. It is also common practice to install a lockable derailer about 25 feet up the track from the first loading spot.James Miller, process engineer
Chemtura, Elmira, OntarioINSTALL AN OVER-SIZED ACTUATORMake sure that the emergency cut-off valve is fail-close and regularly maintained. Install a limit switch for the valve closed position, to check the regular operation of the valve. A spill-detection system is needed — ground temperature probes or filling hose failure detection, e.g., filling hose low pressure. If you cannot guarantee regular maintenance of the valve, install a high-performance valve with an oversized actuator. Michele Murino, maintenance manager
Air Liquide Italia Produzione, Milan, ItalyCONTROL CHOCK REMOVALPut the operator in charge of setting up the cars to be filled. Have a chock with a safety flag after the last car at the filling station; only the operator is allowed to remove the chock. The train crew drops off railcars but is not to be permitted to push the cars. If a loading spot is empty the chock will be on the car in the next loading spot. This would allow the crew to fill the empty spots — but only the empty spots. Before any cars are pushed if the cars are filled, the operator should disconnect the cars and remove the chocks. Only an operator is permitted to move the chocks.Frank Sommerfield, senior technical manager
Chester Engineers, Coraopolis, Pa. USE A DERAIL DEVICEWhenever a car is hooked up a derail device should be placed on the track!John Leonard, service manager
Keystone Propane Service, Throop, Pa.IMPROVE COMMUNICATIONMechanical derails with flags and flashing lights at either end of the track would indicate to both plant operators and rail crews whether or not any car track movements would be safe. There is a need for better internal communication between the plant personnel in charge of car movements and the loading operators. Visual indication that loading was in progress should have been provided, e.g., red, loading — no access; green — OK. Lockout devices requiring action from all internal plant sections involved should be provided before proceeding. Communication between the plant and the rail line coming in for the move should be established as standard. Robert Drucker, consultant
East Northport, N.Y.PUT IN LOAD CELLS Install load indication and controls (weigh cells) to prevent over-filling. This should be matched with the load as per the car maximum capacity. Information on the cars must be provided to the driver of locomotive at his console so that he can monitor filling. C. M. PAKHALE, superintendent
Oil India Ltd., Duliajan, IndiaINSTITUTE LOCKOUT/TAGOUTThe lockout/tagout method that railroads use when workers are performing maintenance on a car or engine outside of a shop is a special sign locked to the rail. The lock mechanism normally has some derail capability to keep the worker safe from a bumping incident. This type of lockout would be appropriate for all process-plant railcar operations. Venting the railcar is part of the lockout procedure.Jim Becker, instrument reliability engineer
Bayer Material Science, Baytown, Texas DEMAND DERAILERSYou can chock the wheels of any car hooked up to hoses. But the best solution would be to install on the track on both ends of the loading island derailers that are only moved by your operators (not rail services). The derailers are only opened when all six cars are disconnected.Chris Rentsch, senior improvement engineer
Dow AgroSciences, Midland, Mich.ENSURE THE VALVE IS FAIL-SAFEIn this case the emergency shut-off valve that "failed" must not have been a "fail-safe" valve. This term "fail-safe" is overused. A better fail-safe system may be to have a constant "go" signal sent to the controller that keeps the emergency shut-off system "off" if all instrumentation and conditions are "normal." As long as this "go" signal is received by the system, normal operation of valves, etc., is permitted. In the event of any failure within the system, the "go" signal to the controller is interrupted, allowing the emergency shut-off system to activate. This can also prevent the system from operating if an operator bypassed any safety interlocks. Of course in the case of propylene you will still have an issue with vapor from the railcars. If the vent pipes are broken by moving the railcar down the track there is a risk to the entire plant. A fail-safe emergency shutdown of the loading bay definitely minimizes the risk. Although this "backward thinking" may cause some unnecessary downtime to the operation when less critical auxiliary instrumentation fails, one must consider what a catastrophe would cost in terms of employee safety, profit loss and the company's image in the community. James White, production manager
Nan Ya Plastics Corp. Lake City, S.C.TAKE A TWO-PRONG APPROACHI suggest a line of attack from two directions: 1. Consider an administration option. Institute a formal blue flag program for all rail movements on your site. A blue flag signifies that a rail car is off limits and is not to be moved 2. Technical option: Most rail loading or unloading bays that handle flammable materials require the rail cars to be grounded prior to any work being done on them. These ground systems typically have some sort of indicator light to show the personnel in the area that the rail car is in fact grounded. It might be possible to tie such a system into your blue flag lights on a bay so that when a rail car is grounded the blue flags lights are illuminated and would let personnel know the cars are being worked on and cannot be moved. You could try to take this a step further to have the loading alarm be set up with the grounding cable so that whenever the loading arm is in position it also serves as the grounding system and notification system. Len Riker, PSM coordinator
Penford Products Co., Cedar Rapids, IowaTEST FAIL-SAFEI suggest the following: 1) all critical automatic valves that are interlocked to a shutdown system must be function-tested either during routine maintenance or by a test of the emergency shutoff system(s); 2) at minimum, a blue flag should be present on that spur with a closed lockedderailer located one railcar distance from the nearest loading spot railcar. The key should be under the control of operations personnel. The best protection is a closed locked derailer that is interlocked to the loading valves. Chlorine Institute pamphlet 57 covers safeguards that are recommended for chlorine rail car loading or unloading. Consider these safeguards for propylene loading. Larry Sendlak, senior technical service specialist
OxyChem Basic Chemicals, Niagara Falls, N.Y.START WITH DOUBLE-CHECKSUnfortunately, this type of problem occurs over and over again. Operators extend their hours to make more money and fatigue takes its toll. The best solution remains automatic fail-safe equipment. Of course, equipment only works if it's maintained. I recommend hoses with spring check valves at either end. Even these can become gummed up and leak. Perhaps a lockout/tagout procedure is the simplest approach. If the over-filled tank car was to remain hooked up to the vent then maybe the railcars could be locked in place until the last hose was closed and removed. Hoses and their fittings are prone to leak (see "Watch Out with Piping, Valves and Hoses," www.ChemicalProcessing.com/articles/2010/012.html). The aviation industry resolved this issue decades ago with periodic testing and inspection. You may want to establish a hose maintenance program. Another idea is to automate the valves. This would eliminate the risk of an operator getting burned by physically closing a frozen valve. The shift change procedures should be reviewed immediately. Like in any other operation, each shift should brief the next of the status of the process. Also, supervisors should be approving any operation involving moving cars, let alone six cars at once. Strict discipline will make operators think twice before this happens again. When we train operators to take on a hazardous operation we hold dress-rehearsals. The more dangerous the operation, the more often retraining is required. During commissioning of an acid unloading facility we drilled green operators for a week until they could do the work in their sleep, which could be the case. These operators should be retrained at least annually after this incident. I've saved the root cause for last: over-filling. Level control seems to be precarious with tankcars. Weigh cells offer an expensive solution. Dipsticks are cheaper and could be equipped with limit switches; however, dipsticks expose the operator to risk. Over-fill protection would scotch the root cause. But, let's not substitute one danger for another. Dirk Willard, consulting process engineer
Organic Technologies, Coshocton, Ohio
Avid Solutions, Inc., Winston Salem, N.C.FLAG ITI'm not sure how far reaching this requirement is, but in Ontario it is required to erect a blue "tank car connected" flag on the track leading to a connected rail car. It is also common practice to install a lockable derailer about 25 feet up the track from the first loading spot.James Miller, process engineer
Chemtura, Elmira, OntarioINSTALL AN OVER-SIZED ACTUATORMake sure that the emergency cut-off valve is fail-close and regularly maintained. Install a limit switch for the valve closed position, to check the regular operation of the valve. A spill-detection system is needed — ground temperature probes or filling hose failure detection, e.g., filling hose low pressure. If you cannot guarantee regular maintenance of the valve, install a high-performance valve with an oversized actuator. Michele Murino, maintenance manager
Air Liquide Italia Produzione, Milan, ItalyCONTROL CHOCK REMOVALPut the operator in charge of setting up the cars to be filled. Have a chock with a safety flag after the last car at the filling station; only the operator is allowed to remove the chock. The train crew drops off railcars but is not to be permitted to push the cars. If a loading spot is empty the chock will be on the car in the next loading spot. This would allow the crew to fill the empty spots — but only the empty spots. Before any cars are pushed if the cars are filled, the operator should disconnect the cars and remove the chocks. Only an operator is permitted to move the chocks.Frank Sommerfield, senior technical manager
Chester Engineers, Coraopolis, Pa. USE A DERAIL DEVICEWhenever a car is hooked up a derail device should be placed on the track!John Leonard, service manager
Keystone Propane Service, Throop, Pa.IMPROVE COMMUNICATIONMechanical derails with flags and flashing lights at either end of the track would indicate to both plant operators and rail crews whether or not any car track movements would be safe. There is a need for better internal communication between the plant personnel in charge of car movements and the loading operators. Visual indication that loading was in progress should have been provided, e.g., red, loading — no access; green — OK. Lockout devices requiring action from all internal plant sections involved should be provided before proceeding. Communication between the plant and the rail line coming in for the move should be established as standard. Robert Drucker, consultant
East Northport, N.Y.PUT IN LOAD CELLS Install load indication and controls (weigh cells) to prevent over-filling. This should be matched with the load as per the car maximum capacity. Information on the cars must be provided to the driver of locomotive at his console so that he can monitor filling. C. M. PAKHALE, superintendent
Oil India Ltd., Duliajan, IndiaINSTITUTE LOCKOUT/TAGOUTThe lockout/tagout method that railroads use when workers are performing maintenance on a car or engine outside of a shop is a special sign locked to the rail. The lock mechanism normally has some derail capability to keep the worker safe from a bumping incident. This type of lockout would be appropriate for all process-plant railcar operations. Venting the railcar is part of the lockout procedure.Jim Becker, instrument reliability engineer
Bayer Material Science, Baytown, Texas DEMAND DERAILERSYou can chock the wheels of any car hooked up to hoses. But the best solution would be to install on the track on both ends of the loading island derailers that are only moved by your operators (not rail services). The derailers are only opened when all six cars are disconnected.Chris Rentsch, senior improvement engineer
Dow AgroSciences, Midland, Mich.ENSURE THE VALVE IS FAIL-SAFEIn this case the emergency shut-off valve that "failed" must not have been a "fail-safe" valve. This term "fail-safe" is overused. A better fail-safe system may be to have a constant "go" signal sent to the controller that keeps the emergency shut-off system "off" if all instrumentation and conditions are "normal." As long as this "go" signal is received by the system, normal operation of valves, etc., is permitted. In the event of any failure within the system, the "go" signal to the controller is interrupted, allowing the emergency shut-off system to activate. This can also prevent the system from operating if an operator bypassed any safety interlocks. Of course in the case of propylene you will still have an issue with vapor from the railcars. If the vent pipes are broken by moving the railcar down the track there is a risk to the entire plant. A fail-safe emergency shutdown of the loading bay definitely minimizes the risk. Although this "backward thinking" may cause some unnecessary downtime to the operation when less critical auxiliary instrumentation fails, one must consider what a catastrophe would cost in terms of employee safety, profit loss and the company's image in the community. James White, production manager
Nan Ya Plastics Corp. Lake City, S.C.TAKE A TWO-PRONG APPROACHI suggest a line of attack from two directions: 1. Consider an administration option. Institute a formal blue flag program for all rail movements on your site. A blue flag signifies that a rail car is off limits and is not to be moved 2. Technical option: Most rail loading or unloading bays that handle flammable materials require the rail cars to be grounded prior to any work being done on them. These ground systems typically have some sort of indicator light to show the personnel in the area that the rail car is in fact grounded. It might be possible to tie such a system into your blue flag lights on a bay so that when a rail car is grounded the blue flags lights are illuminated and would let personnel know the cars are being worked on and cannot be moved. You could try to take this a step further to have the loading alarm be set up with the grounding cable so that whenever the loading arm is in position it also serves as the grounding system and notification system. Len Riker, PSM coordinator
Penford Products Co., Cedar Rapids, IowaTEST FAIL-SAFEI suggest the following: 1) all critical automatic valves that are interlocked to a shutdown system must be function-tested either during routine maintenance or by a test of the emergency shutoff system(s); 2) at minimum, a blue flag should be present on that spur with a closed lockedderailer located one railcar distance from the nearest loading spot railcar. The key should be under the control of operations personnel. The best protection is a closed locked derailer that is interlocked to the loading valves. Chlorine Institute pamphlet 57 covers safeguards that are recommended for chlorine rail car loading or unloading. Consider these safeguards for propylene loading. Larry Sendlak, senior technical service specialist
OxyChem Basic Chemicals, Niagara Falls, N.Y.START WITH DOUBLE-CHECKSUnfortunately, this type of problem occurs over and over again. Operators extend their hours to make more money and fatigue takes its toll. The best solution remains automatic fail-safe equipment. Of course, equipment only works if it's maintained. I recommend hoses with spring check valves at either end. Even these can become gummed up and leak. Perhaps a lockout/tagout procedure is the simplest approach. If the over-filled tank car was to remain hooked up to the vent then maybe the railcars could be locked in place until the last hose was closed and removed. Hoses and their fittings are prone to leak (see "Watch Out with Piping, Valves and Hoses," www.ChemicalProcessing.com/articles/2010/012.html). The aviation industry resolved this issue decades ago with periodic testing and inspection. You may want to establish a hose maintenance program. Another idea is to automate the valves. This would eliminate the risk of an operator getting burned by physically closing a frozen valve. The shift change procedures should be reviewed immediately. Like in any other operation, each shift should brief the next of the status of the process. Also, supervisors should be approving any operation involving moving cars, let alone six cars at once. Strict discipline will make operators think twice before this happens again. When we train operators to take on a hazardous operation we hold dress-rehearsals. The more dangerous the operation, the more often retraining is required. During commissioning of an acid unloading facility we drilled green operators for a week until they could do the work in their sleep, which could be the case. These operators should be retrained at least annually after this incident. I've saved the root cause for last: over-filling. Level control seems to be precarious with tankcars. Weigh cells offer an expensive solution. Dipsticks are cheaper and could be equipped with limit switches; however, dipsticks expose the operator to risk. Over-fill protection would scotch the root cause. But, let's not substitute one danger for another. Dirk Willard, consulting process engineer
Organic Technologies, Coshocton, Ohio
Crystallizer Control
Figure 1. Poor temperature control can lead to small crystals instead of the desired larger ones.JULY'S PUZZLER We recover ammonium sulfate from a power plant scrubber and sell it as fertilizer. Temperature control of the liquor going to the crystallizer is critical; liquor is circulated through a shell-and-tube heater (see Figure 1). Poor control causes nucleation, creating small crystals at the expense of large ones. The difference between the inlet and outlet stream temperatures must be ±1°F. Our customer originally insisted on using a controller temperature board in its central control room, which is more than 300 yards away, but now is demanding that we use K thermocouples. Will either idea work? What's the best way to get the accuracy needed? Send us your comments, suggestions or solutions for this question by June 11, 2010. We'll include as many of them as possible in the July 2010 issue and all on CP.com. Send visuals — a sketch is fine. E-mail us at [email protected] or mail to Process Puzzler, Chemical Processing, 555 W. Pierce Road, Suite 301, Itasca, IL 60143. Fax: (630) 467-1120. Please include your name, title, location and company affiliation in the response. And, of course, if you have a process problem you'd like to pose to our readers, send it along and we'll be pleased to consider it for publication.