"Temporary Operations" in Ammonia RefrigerationSafety Info Posts - Chemical Process Safety (PSM/RMP)Written by Bryan Haywood   Friday, 08 November 2013 17:40How many process safety management systems for ammonia refrigeration have you seen that included "temporary operations"? There seems to be a industry wide mind set that there are no "temporary operations" in ammonia refrigeration. Heck even the largest ammonia refrigeration trade group states there are is no such thing as "temporary operations" in the ammonia refrigeration process. I wish to challenge this mind set...

First, what are "temporary operations"? Unfortunately neither OSHA nor EPA have "officially" defined this type of operation. However, one could assume from the title "temporary operation", this would entail operating the process differently than "normal operations" on a "temporary" basis. This does NOT mean operating the process outside its established safe operating envelopes - that is what we call "emergency operations"!In many chemical processes "temporary operations" would entail utilizing a "maintenance bypass" that redirects the process flow around safety critical control(s) "temporarily" while the maintenance is being performed on this control(s). Often times the controls have to be taken off-line, purged/flushed, and locked out for the servicing and maintenance and this could take some time. In newer processes the bypass matches the control scheme in the normal process flow; but in older processes, this is not the case and therefore the process is operated on a temporary basis without the routine safety systems in place. This of course increases the risks the process presents. OSHA (and EPA) understood this situation and required "operating procedures" for these "temporary operations" so that these risks could be adequately managed while operating in these "temporary modes".But how does this impact ammonia refrigeration processes, since maintenance by-passes are not a common feature in ammonia refrigeration? We have to think about situations that the refrigeration process may operate in a mode that is different than its intended design?Scenario:The engine room has two distinct safety systems that are interlocked to each other: Ammonia Detection and Emergency Ventilation.I think most would agree these are two safety systems that are CORE to process safety for most ammonia refrigeration processes; after all, the core reason for their presence is to ensure ammonia does not reach its Lower Explosive Limit (LEL). But since these two systems are physically detached from the actual equipment that contains the ammonia many forget about these when considering "temporary operations".Think back to when someone asked... "do you have any temporary operations such that the process is operated differently for a short period of time?" Most of us would think, "no, we do not run under any deviations from our intended design". But is this actually the case? Consider the following questions:1) Has your process every operated while the ammonia detection system was under maintenance or not fully functional as designed (e.g. only one of two sensors functioning)?2) Has your process every operated while the emergency ventilation system was under maintenance or not fully functional?If you answered yes to either of these questions, then the process was in "temporary operations" while these critical safeguards were NOT fully available. Thus, we would need to compensate for these lapses in safety systems in some other method... Temporary Operating Procedure(s) that would administratively compensate for the designed systems that are temporarily not

available. Some examples could be:Routine Mainteance1) How about routine maintenance on the ventilation fans (or louvers) that require the fans to be shutdown and locked out for some period of time. Unless the ventilation systems has a "spare" fan(s) that is reserved for these maintenance tasks, then I would submit to you that the process is running under a "temporary" operational mode and thus we would need to compensate for the "what-if we had a leak while the fan(s) was out of service". Of course, the other option would be to shutdown the refrigeration system while the emergency ventilation system is being serviced - not going to happen.2) How about routine calibration of the detection system that requires the system to be taken off-line during calibration to ensure a false trip does not shutdown the process? For most this task would be done quarterly or maybe every six (6) months. Do we have a procedure that would help off set the risks in running without our detection system on line?Non-Routine Events3) a release occurs in the engine room and saturates all the sensors (e.g. kills the sensors). The emergency is over, leak repaired, and we are ready to start-up; however, it is 11 pm and there are no sensors in stock to put the ammonia detection back into service as designed. Will the business choose not to start back up until the following day when the sensors can be replaced or will the business start up that night, thus requiring the ammonia process to start-up without a critical safety system in place? I would bet the process will be started that night and it can be, BUT we would be operating in a "temporary mode" until we returned the ammonia detection system to full operational ability.4) a belt breaks on one of our exhaust fans. When we go to replace the belt we find that we have none in stock. Do we shutdown the process since our emergency ventilation system is now out of service? I seriously doubt it; however, we have to manage the risk until we can get our safety system back in operation. We would document these measures in a "temporary operating procedure" that is approved/certified by management.Now some are laughing uncontrollably about now and asking what would these "procedures" contain?Let's ask ourselves, if the ammonia detection system is down, how could we compensate for this lack of the safety system? To do this we have to ask:1) What is the purpose of the detection system?2) What does the detection system do when it detects the presence of ammonia?Once we have answered these two basic questions then we can come up with some administrative controls to compensate the loss of the safety system. For example, if we loose our detection system, we could require someone to remain in the engine room to monitor for the presence of ammonia and manually activate the emergency ventilation system. Since this is never done, we would document how this would occur and how the emergency ventilation could be activated without the aid of the detection system. Most would just instruct the human monitor to activate the emergency shutdown button at the exit. Now I am NOT proposing we pay someone to sit on their ass and sniff the air! What I am proposing is that while the process is running without the detection system that the technician/operator not be allowed to leave the room for longer than "X" time period. This means management may need to provide two (2) technicians/operators during a time when there is normally only one technician/operator on shift. All of this would be documented in your "temporary operating procedure".

Some may be asking about Management of Change and how does it work into my scenarios? I have to admit that the two non-routine scenarios are "unexpected events" and would not be "normal operational modes", such as with the use of a designed maintenance by-pass. And that an MOC would certainly be needed in both of these non-routine scenarios and that a temporary SOP would be developed via the temporary MOC requirements. But lets look at those "routine" temporary operations like the maintenance of the detectors and fans that requires these safety systems to be taken off-line temporarily several times a year. We know these deviations are going to occur and therefore we should have "temporary operating procedures" to compensate the loss of these engineered safety systems. Granted, both of my maintenance activities will be short in nature (at lest most of the time) and the deviation from normal operations will be brief; but if your luck is like mine, guess when the S_it will hit the fan!Lastly I want to take us all the way back to our Process Hazards Analysis (PHA). We study our process deviations and the safeguards in place that will prevent, protect and mitigated these deviations. We "take credit" for those safeguards so as to lower the "risks" associated with a specific deviation. When we continue to operate the process without these "safeguards" in place, even temporarily, we need to compensate for this change in operation. The intention behind the "temporary operations" is to ensure that we make every attempt to operate the process at the level of safety our PHA dictated we were at with the safety systems on line. Granted there is NO equal to a designed/engineered safety system; however, doing nothing to compensate for its loss is missing the mark in process safety.