Scholarly article on topic 'Large Steel Tank Fails and Rockets to Height of 30 meters − Rupture Disc Installed Incorrectly'

Large Steel Tank Fails and Rockets to Height of 30 meters − Rupture Disc Installed Incorrectly Academic research paper on "Agriculture, forestry, and fisheries"

CC BY-NC-ND
0
0
Share paper
Academic journal
Safety and Health at Work
OECD Field of science
Keywords
{"catastrophic tank failure" / "isentropic exergy" / "pressure relief device failure"}

Abstract of research paper on Agriculture, forestry, and fisheries, author of scientific article — Frank H. Hedlund, Robert S. Selig, Eva K. Kragh

Abstract At a brewery, the base plate-to-shell weld seam of a 90-m3 vertical cylindrical steel tank failed catastrophically. The 4 ton tank “took off” like a rocket leaving its contents behind, and landed on a van, crushing it. The top of the tank reached a height of 30 m. The internal overpressure responsible for the failure was an estimated 60 kPa. A rupture disc rated at < 50 kPa provided overpressure protection and thus prevented the tank from being covered by the European Pressure Equipment Directive. This safeguard failed and it was later discovered that the rupture disc had been installed upside down. The organizational root cause of this incident may be a fundamental lack of appreciation of the hazards of large volumes of low-pressure compressed air or gas. A contributing factor may be that the standard piping and instrumentation diagram (P&ID) symbol for a rupture disc may confuse and lead to incorrect installation. Compressed air systems are ubiquitous. The medium is not toxic or flammable. Such systems however, when operated at “slight overpressure” can store a great deal of energy and thus constitute a hazard that ought to be addressed by safety managers.

Academic research paper on topic "Large Steel Tank Fails and Rockets to Height of 30 meters − Rupture Disc Installed Incorrectly"

Safety and Health at Work xxx (2016) 1-8

Original Article

Large Steel Tank Fails and Rockets to Height of 30 meters Disc Installed Incorrectly

Rupture

Frank H. Hedlund*, Robert S. Selig, Eva K. Kragh

COWI, Kongens Lyngby, Denmark

ARTICLE INFO

Article history: Received 11 August 2015 Received in revised form 7 November 2015 Accepted 26 November 2015 Available online xxx

Keywords:

catastrophic tank failure isentropic exergy pressure relief device failure

ABSTRACT

At a brewery, the base plate-to-shell weld seam of a 90-m3 vertical cylindrical steel tank failed cata-strophically. The 4 ton tank "took off' like a rocket leaving its contents behind, and landed on a van, crushing it. The top of the tank reached a height of 30 m. The internal overpressure responsible for the failure was an estimated 60 kPa. A rupture disc rated at <50 kPa provided overpressure protection and thus prevented the tank from being covered by the European Pressure Equipment Directive. This safeguard failed and it was later discovered that the rupture disc had been installed upside down. The organizational root cause of this incident may be a fundamental lack of appreciation of the hazards of large volumes of low-pressure compressed air or gas. A contributing factor may be that the standard piping and instrumentation diagram (P&ID) symbol for a rupture disc may confuse and lead to incorrect installation. Compressed air systems are ubiquitous. The medium is not toxic or flammable. Such systems however, when operated at "slight overpressure" can store a great deal of energy and thus constitute a hazard that ought to be addressed by safety managers.

Copyright © 2016, Occupational Safety and Health Research Institute. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

1. Introduction

Vertical cylindrical tanks used for the bulk storage of liquids at ambient (i.e., atmospheric) pressure or minimal overpressure are ubiquitous in industry. Catastrophic tank failure is rare. Even though the likelihood is low, the scenario may contribute significantly to the risk as the consequences can be considerable [1].

The sheer force of a sudden release of large amounts of liquid can propel the walls of a ruptured tank onto other tanks or structures and cause domino knock-on failures [2]. The sudden gush of liquid can make dikes or bunds overflow or otherwise overpower barriers erected to provide 100% volumetric capacity in the event of tank leakage [3,4]. Many tanks hold toxic or hazardous substances that, if released, could cause harm to humans or the environment.

A review of catastrophic failures of bulk liquid storage tanks has been provided in the literature [1], and new incidents are occasionally reported [5,6]. The cases described below were selected because they may not be well known in English-language publications.

During the severe winter of 1959 there was a fuel oil tank failure in Sksrbsk, Denmark, when a 10,000 m3 atmospheric tank with heavy

fuel oil failed catastrophically with a "thunderous bang." The flood of warm fuel oil overtopped the bund and damaged a wall at the nearby power station before the viscous fluid cooled and solidified. Very little information is available but it appears that the failure was caused by low-temperature brittle failure of the steel shell.

In 2011 there was a fish silage tank failure in Aabenraa, Denmark, when a tank collapsed with a loud deep rumble, which resembled the sound produced by large metal sheets being shaken. The sudden release of 6,000 tons of viscous, acidic fish silage produced a 14-m high tidal wave, some of which washed over the bund wall, knocked over trees, and damaged parked cars before arriving at a nearby small community of dwelling houses and allotments and the harbor. Several neighboring tanks in the common bund were damaged and one tank that contained soya bean oil started leaking. There were no human casualties. The topsoil of the affected nearby properties was replaced. The tank failure was otherwise characterized as an incident resulting in a widespread unpleasant stench, but no significant harm to the environment. The emergency re-sponders' uniforms had to undergo specialized cleaning, a treatment that unfortunately could not be extended to the vehicles,

* Corresponding author. Technical University of Denmark (DTU/Compute), DK-2800 Kongens Lyngby, Denmark. E-mail address: fhuhe@dtu.dk (F.H. Hedlund).

2093-7911/$ — see front matter Copyright © 2016, Occupational Safety and Health Research Institute. Published by Elsevier Ltd. This is an open access article under the CC BY-

NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

http://dx.doi.org/10.1016/j.shaw.2015.11.004

Saf Health Work 2016;m:l-8

which continued to have an unmistakable odor of fish [7]. Fish silage is not a regulated substance and not classified as hazardous. The tank was inspected in 2008 by a specialist tank inspection company and given a clean bill of health until 2018. After the tank collapse, the tank owner took the tank inspection company to civil court for professional malpractice. The civil liability case is currently sub judice and details are unavailable.

In 2005 there was a sulfuric acid tank failure in Helsingborg, Sweden, when the bottom-to-shell weld of a steel tank failed catastrophically and released 8,900 m3 of 96% sulfuric acid over an estimated 2.5—4 minutes. The sudden release of the tank contents produced a partial vacuum that caused the roof and shell to implode. Large quantities of acid ended up in the harbor where the acid reacted with seawater to produce hydrogen chloride. It is believed that within a few minutes "tens of tons" of gaseous and aerosol hydrogen chloride formed a toxic cloud that extended to a height of 70 m. Consequence modeling indicates that concentrations that could produce severe irritation, extended 3—4 km from the site. After ~ 1 hour, when the cloud had drifted ~ 10 km, concentrations had likely diluted to a safe level. There were no casualties. The cause was the rupture of a 6 bar 600-mm diameter reinforced concrete pipeline 1 hour earlier, which provided seawater to a nearby industrial complex for cooling purposes. The seawater line passed close to the tank and the pipeline rupture liquefied the soil and produced a cavity, which undermined the tank and led to foundation instability [8].

This article is concerned with tanks that operate under very slight overpressure rather than tanks operated at ambient atmospheric pressure. This includes tanks that are gas blanketed, iner-ted, or otherwise have a controlled headspace. For the purposes of this article, we define very slight overpressure as 50 kPa (i.e., 0.5 bar or ~7.4 psig), which is the limit set in the European Pressure Equipment Directive (PED) [9]. The Directive applies to the design, manufacture, and conformity assessment of pressure equipment and assemblies with a maximum allowable pressure >50 kPa. It is common practice in industry to install a rupture disc or another overpressure safety device rated at <50 kPa. A vessel thus protected, is not then classified as a pressure equipment component and avoids the need to fulfill the rather onerous requirements of the Directive for written documentation and other formalities.

Tanks originally designed for ambient pressure may be modified to operate at slight overpressure. This change in operation may occur for several reasons such as vapor recovery, reduction of volatile organic compound emissions, and odor control. This article argues that systems operated at "very slight overpressure" can store a great deal of energy and thus constitute a hazard that may not be fully appreciated. The tank may fail catastrophically, shoot into the air, and spill its contents. This article draws specific attention to the fact that a rupture disc overpressure safety device can be compromised if installed incorrectly.

2. Materials and methods

2.1. Process description

2.1.1. Surplus yeast

During the fermentation of beer, the yeast cell mass increases three- to six-fold. Much of this yeast is collected as surplus yeast and shipped to external processors for conversion into products such as protein pills for animal feed [10].

The bottoms from beer fermentation tanks is one source of surplus yeast. Surplus yeast is also collected from other waste streams and separated by filters or centrifuges. The term "yeast slurry" technically refers only to dehydrated yeast that has been

reslurried; however, this article uses the term for any type of surplus yeast.

2.1.2. Indoor collection vessel

At a Danish brewery, surplus yeast slurry is first collected in an indoor yeast collection vessel and then transferred to an outdoor storage tank (Fig. 1).

The indoor yeast collection vessel has a volume of 10 m3 and is connected to the brewery's sterile compressed air system and maintained at 100 kPa overpressure. When an operator initiates the transfer of yeast slurry, a bottom outlet valve opens and the compressed air presses the viscous yeast slurry into a 90-m3 outdoor storage tank. The control logic closes the bottom valve when a signal from a liquid level switch low (tuning fork/vibrating fork type) indicates that the vessel is empty.

2.1.3. The incident outdoor storage tank

The outdoor storage tank was constructed in 1973. It was a vertical, cylindrical tank with a height of 8 m; diameter, 3.8 m; gross volume, 96.5 m3; working volume, 90 m3; stainless steel type 304 plate thickness, 3 mm; and mineral wool insulation, 200 mm in thickness. The floor plate was sloped towards the outlet nozzle.

The floor plate rested on a sloping steel structure that was supported by a concrete base. A circumferential steel profile at the base of the supporting steel structure served as the point of attachment for the shell skirt plate of the tank.

Only rudimentary construction details are available because of the age of the tank. Information on construction code, maximum allowable working pressure, specification sheets for the construction materials, and engineering drawings are absent. The tank appeared to have been designed for liquid storage at ambient pressure. For many years, the tank was used for the temporary storage of an intermediate brewery liquid and was indeed operated at ambient pressure. Approximately 5 years earlier, the tank was moved and the service changed to surplus yeast.

Surplus yeast is a biologically active material and an excellent medium for the growth of unwanted microbes. Occasional nuisance foaming is a concern. The storage tank was therefore modified to operate at a pressure of 10 kPa to suppress foaming. A spring-operated pressure valve was set at 20 kPa (g) to allow tank breathing during loading when the incoming liquid reduces the headspace vapor volume in the tank. A rupture disc overpressure relief device (a.k.a. bursting disc), was installed in the tank's 2-inch vent line. The vendor specification sheet reports a burst pressure range of 43—49 kPa at 22°C.

The change in tank service was likely viewed as a rather trivial engineering task. It is probably fair to assume that the handling of a waste stream like surplus yeast from brewing, commands minimal attention by management.

2.2. The incident

2.2.1. Witness statement

On the day of the incident, the outdoor yeast storage tank had recently been emptied. It was receiving its first batch of fermentation tank bottoms from the yeast collection vessel, probably no more than 3 m3.

Shortly before the tank failure, two refrigeration technicians employed by an external contractor arrived to service a large ammonia-cooling unit on the roof of the adjacent building. They parked their van next to the outdoor yeast storage tank, entered the building, and climbed the stairs to the roof. Immediately after passing through a doorway in a 3-m high noise protection wall on the roof, they heard a sudden dull "poof". They turned around and saw the storage tank rising vertically in the air. The base of the tank

F.H. Hedlund et al / Large Steel Tank Rockets to 30 m

iQi—^SaQJ

Fig. 1. Schematic representation of the surplus yeast system.

clearly rose above the roof of the adjacent tall green building, and then fell back to the ground and landed on their van. They rushed back downstairs and saw that the van had been crushed (Figs. 2, 3). The storage tank had risen nearly vertically like a rocket, while leaving the tank contents behind. Yeast slurry spilled all over the alley.

The refrigeration technician interviewed insisted that the sound was a dull "poof' rather than a loud bang. A site visit revealed that the fans of the cooling unit generated some noise and the noise barrier wall likely attenuated some sound. There is little evidence that a loud noise occurred, and certainly no shock wave occurred, on tank failure. There was no evidence of blast damage such as nearby shattered windows. Nobody else on site seemed to have heard anything unusual.

2.2.2. Investigation

A specialist metallurgy company examined the failed tank, the supports, and the welds. The tank shell skirt had been joined to the circumferential steel profile at the base of the supporting steel structure by 58 short welds, each ~0.15 m apart. The short welds

Fig. 2. The van is visible under the tank. The tank contents washed up on the elevated platform. (Photo courtesy of the company.)

4 Saf Health Work 2016;m:1-8

Fig. 3. The tank landed on the van and crushed it. The tank's original position (the sloping support structure for the tank floor plate) is in the foreground. The tank floor plate is center left. (Photo courtesy of I.W. Michaelsen.)

were absent from two adjacent arc sections each of which was ~0.5 m long. This was identified as the probable point of failure initiation. The two arc segments were positioned opposite the tall green building which would imply that the tank would tilt towards that building immediately before rocketing. This is consistent with the impact damage to the building's exterior panels when the tank descended (Fig. 4).

L-shaped angles made of sheet metal were joined to the base rim of the shell skirt. The angles extended under the circumferential steel profile and served as crude anchors. Many of these anchors were weakened by corrosion.

Tank shell thickness measured 3.36 mm. Measurement of the welds at the base produced heights in the range of 1.25—2.81 mm and widths in the range of 0.09—0.8 mm (i.e., weak welds).

2.2.3. Overpressure protection devices

Testing revealed that the spring-operated pressure valve on the tank opened at 20 kPa, as it was designed to do. However, the capacity was limited because of the small-bore (8.5-mm diameter) connecting pipework.

The rupture disc was intact. It was a reverse buckling type device that had been installed upside down (i.e., with the dome facing away from the tank). The vendor stated that the rupture disc likely

Fig. 4. The tank rose nearly vertically in the air, and the base of the tank rose higher than the 19-m tall green building. While descending, the tank impacted and deformed the building's exterior wall panels. (Photo courtesy of F.H. Hedlund.)

could withstand an overpressure of at least three times the pressure marked on the rating plate (i.e., > 150 kPa) before bursting, if it were installed upside down.

3. Results

3.1. Failure mechanism

The likely failure mechanism is that excess internal overpressure acting on the roof created an uplift force on the shell, which strained the welds and the corroded L-shaped anchors at the base.1 The welds at the base skirt then failed, which resulted in shell uplift. The 3-mm floor plate (which had little stiffness) then bulged. This action led to catastrophic failure of its circumferential weld seam. Immediately after that, the tank's pipe connections were torn off. The tank then lifted off and spilled its contents.

3.2. The strength of the welds on the tank

The tank was not designed for internal overpressure. Its ability to withstand an overpressure is not stated in the sparse documentation available. Not accounting for the effect of anchors, rough mechanical engineering calculations (based on standard material properties) indicate that the probable internal overpressure that leads to weld failure would be 45 kPa for the welds at the base and 35 kPa for the floor plate.

The mechanical engineering analysis can only be considered approximate. The effect of the anchors is unknown. Standard table values for material tensile properties were used in the computation procedure. No samples of the metal were taken for laboratory tests to determine the actual material properties.

3.3. The cause of overpressure

The most likely source of overpressure is gas breakthrough from the yeast collection vessel, which operated at 100 kPa. The bottom liquid level switch (tuning fork type) may have failed to detect the low level if it was covered in viscous and sticky surplus yeast. An alternative hypothesis is that an operator may have set the transfer sequence in the manual override mode to ensure a complete clear out of the tank, and may have subsequently forgotten to return and terminate the transfer in time.

3.4. Exergy considerations

When a pressurized gas expands against a constant external pressure it does work on the surroundings (i.e., some of the energy of the expanding gas is lost by pushing against the atmosphere). This is accounted for through the concept of exergy, which is the maximum useful work that can be obtained from an expanding gas that reaches equilibrium with its constant pressure environment. A pressure vessel burst is rapid; therefore, there is little heat exchange with the surroundings. Kurttila [12] argues the process should be considered adiabatic and hence the maximum useful work possible is represented by isentropic exergy. For an ideal gas, isentropic exergy, E, is as follows {Eq. (2.1.7) in Kurttila [12]}:

1 Uplift and anchoring requirements are covered (e.g., API 650, Appendix F in [11]).

F.H. Hedlund et al / Large Steel Tank Rockets to 30 m

1 - ¡PL P1

- V1 (P1 - pa)

in which g is the ratio of specific heats (which for air is 1.4), p is pressure, V is volume, subscript 1 represents the start conditions and subscript a, the ambient condition; all units are expressed in the international system of units (SI units).

The increase in the tank's potential energy can be computed if the maximum height it reached is known. The first law of thermodynamics (i.e., the law of conservation of energy) can then be applied to compute the theoretical minimum internal overpressure required to attain this height.

In practice, not all isentropic exergy will be converted to potential energy. Energy is lost in the shearing of pipework, steel plate deformation, kinetic energy of the expelled liquid, friction from the viscous yeast slurry, possible shock wave generation, and other factors. These loss amounts are unknown.

It is arbitrarily assumed that 90% of the isentropic exergy was converted to potential energy. The mass of the tank was an estimated 4,000 kg. The base of the tank was assumed to have risen to a height of 21 m. The green building in Fig. 4 is 19 m tall. The internal overpressure computes to ~60 kPa.

4. Discussion

4.1. Accidents are incubated

At face value, the root cause of this incident was the upside down installation of the rupture disc, which probably took place years earlier when a pipe fitter installed the device. From that very moment, the tank was vulnerable to single cause failure such as gas breakthrough from the collection vessel.

In his influential 1978 book, Barry Turner [13], was the first to articulate the idea that accidents are incubated. Like a resident pathogen in the human body, a vulnerability in the design may be present for years before it causes damage. James Reason [14] later embraced and elaborated this idea in his concept of latent and active failures that create holes in the system's barriers and safe-guards—the well-known Swiss cheese model. He also developed a theoretical framework, that emphasizes that, ultimately, organizational processes should be considered responsible for accidents for accident prevention work to be effective [14,15].

In Reason's [15] framework, decisions in the higher echelons of an organization seed, the so-called "organizational pathogens," into the system at large. They take many forms such as limited managerial oversight, inadequate budgets, lack of control over contractors, excessive cost-cutting, blurred responsibilities, and production pressures. The adverse effects of these pathogens are transported along two principal pathways to the workplace. They act on barriers and safeguards to create latent failures, which are longstanding dormant weaknesses or undiscovered shortcomings. They also act on local working conditions to promote active failures, which are mistakes, violations, or component failures. When latent failures combine stochastically with active failures or with triggers, the circumstances are suddenly favorable for all factors to combine into an accident trajectory.

Applying the framework to this particular incident, the active failure was the malfunction of a level switch low (LSL) or the operator carrying out the transfer in the manual override mode. The latent failure was the upside down installation of the rupture disc; this error rendered the overpressure protection device inoperative.

There were no fatalities or injuries, but the incident could have had a worse outcome. Had the refrigeration technicians arrived a few minutes later, the tank may have landed on their van while they were still inside it. Had the tank damaged the ammonia-cooling pipelines there could have been a release of ammonia.

4.2. Are the hazards of compressed air fully recognized?

The lack of data makes a discussion of the underlying shortcomings of the organizational processes speculative. After the incident, the brewery expressed complete astonishment, and believed that an impossible event had taken place. This indicates that the organizational root cause of this incident may be a fundamental, and perhaps widespread, lack of appreciation of the hazards of relatively low-pressure compressed air.

The storage tank, which was originally designed for ambient pressure only, was changed to 10 kPa overpressure service to suppress nuisance foaming. The overpressure appears modest and the change of service seems to have been subjected to minimal scrutiny. This is plausible and unsurprising for a brewery, which routinely handles very large volumes of carbonated drinks maintained at pressures that are at least 10 times higher than the pressure of the storage tank. The spring-operated pressure relief valve seems to have been set arbitrarily at 20 kPa(g). Because of compression of the vapor head space during yeast slurry transfer, the normal operating pressure in the tank would be in the range of 10—20 kPa(g).

The rupture disc seems to have been installed only to ensure that the vessel did not need to fulfill the European Pressure Equipment Directive's requirements since the internal pressure would never exceed the Directive's arbitrary limit of 50 kPa(g). However, as shown in Table 1, there is a substantial difference in the hazard potential—expressed in this paper as exergy content—of a tank operating at 10—20 kPa(g) and at nearly 50 kPa(g). Even if the rupture disc had been operational, the consequences of an instantaneous tank failure at a pressure lower than 50 kPa would have still been dramatic. This scenario cannot be dismissed because the welds were predicted to fail at pressures in the range of 35—45 kPa.

4.3. Rupture disc types

A rupture disc is a membrane that fails at a predetermined differential pressure. The device typically comprises an assembly of components such as a dome-shaped disc and two special insert type holders that fit inside the bolt circle of standard piping flanges. The disc is installed between the two holders. A rating plate with identification and flow direction (e.g., arrow) markings is attached to the disc and projects out between the holders so that it is readable.

Two designs are in use. A forward-domed rupture disc is domed in the direction of the fluid pressure and designed to burst in

Table 1

Overpressure in the headspace of a nearly empty 90-m3 storage tank weighing 4,000 kg can throw the tank to considerable height (based on exergy considerations)

Overpressure (kPa) Headspace exergy is able to lift the storage tank (i.e., center of gravity) by (m)

10 0.5

20 2.4

30 5.4

40 9.5

Saf Health Work 2016;m:l-8

response to tensile forces. The reverse buckling disc is domed against the direction of the fluid pressure. Excess pressure causes the device to buckle because of compression forces before it actually bursts causing a "snap" action.

The advantage of forward-domed rupture discs is the simple and cost-effective design. The tensile strength of the construction material used for the manufacture of the discs is fairly high; therefore, forward-domed rupture discs for low pressures must be made of thin foils that make them vulnerable to mechanical damage during handling or installation.

In reverse buckling discs, the material property that determines the buckling pressure is the Young's modulus. This property is more constant and reproducible, and less affected by temperature than the ultimate tensile strength. In addition, buckling occurs at a substantially lower stress level, compared with rupture under tensile stress. Reverse buckling discs are therefore made of a thicker metal than forward-domed rupture discs and reverse buckling discs are easier to manufacture to close tolerances over a wide temperature range, compared with rupture discs that burst under tension [16].

Reverse buckling discs may therefore be an attractive choice for low-pressure applications. Correct installation is essential because buckling occurs at a substantially lower stress level than with discs that rupture under tensile stress. If a reverse buckling disc is installed upside down, the burst pressure is significantly higher. This property can be useful for overpressure protection of vessels in vacuum service because reverse buckling discs can easily withstand a vacuum in the reverse direction.

4.4. Possible ambiguity in rupture disc piping and instrumentation diagram symbols

To guide correct installation, the arrow printed on the rating plate indicates the direction of the pressure relief (Fig. 5). However, the dome itself can point either way, depending on the type of design, and gives no reliable indication of the correct direction of installation.

Fig. 6 shows the symbols used to represent a rupture disc on piping and instrumentation diagrams (P&IDs) recommended by the ISO 10628 standard [17] and the American National Standards Institute/International Society of Automation (ANSI/ISA) Standard 5.1 [18]. Assuming a conventional left-to-right reading direction, the ISO symbol clearly depicts a forward-acting disc type. The ISA rectangle symbol could easily be interpreted to do so as well. The installation of a rupture disc requires no specialized training. The

Fig. 5. The reverse buckling type rupture disc (the dome points towards the fluid under pressure) is similar to the one installed on the incident storage tank. Proper flow direction of pressure release is marked on the nameplate. (Photo courtesy of Fike Corporation.)

symbols might possibly mislead a less experienced pipe fitter to believe that the dome should be installed facing away from the tank. This would result in the upside down installation of a reverse buckling type disc.

The rupture disc that was installed upside down on the tank was a reverse buckling disc. We have consulted two valve selection handbooks used by design engineers [16,19]. Both handbooks have a chapter on rupture disc selection, sizing, and installation. Neither handbook mentions the potential problem of upside down installation of reverse buckling rupture discs.

4.5. Rupture disc reliability and safety integrity level considerations

A rupture disc is often considered more reliable than a spring-operated pressure safety valve because of its simpler construction, no moving parts and fewer critical components. Some vendors offer rupture discs rated for safety integrity level (SIL) 3, which indicates that the probability of failure on demand is less than one in 1,000.

The peer-reviewed literature appears relatively sparse on the subject of the reliability of rupture discs. Some issues are raised in papers from the 1980s [20,21]. Industry sources however, inform us that: (1) there have been significant advances, particularly in high-precision laser ablation techniques to score the metal membrane without cutting it in order to achieve the desired burst pressure; and (2) issues raised 30 years ago do not apply today. A recent paper [22] examines the degradation and opening behavior of a special subgroup of reverse buckling discs, the knife blade type, but does not comment on SIL.

We have been unable to identify a review of mechanisms that may compromise rupture disc reliability. Discussions with industry experts indicate that even a modest deformation in the dome of a reverse buckling rupture discs is a concern because it may affect the pressure at which buckling takes place. Reverse buckling rupture discs are therefore used in gas service only. Exposure to incompressible media (e.g., an overfill event) may deform the dome and increase the pressure at which buckling, snap action, and rupture, take place.

Incorrect torque applied to the bolts that hold the rupture disc assembly together may also influence the reliability of both types of rupture disc. A torque that is too low or that is unevenly distributed can result in slippage of the rupture disc. The misalignment could expose the rupture disc to uneven loading and lead to slight plastic deformation of the disc plate. This in turn, could lead to an increase in the burst pressure of the membrane, especially for forward-domed rupture discs. A torque that is too high may damage the clamping zone of the rupture disc and lead to puncture or premature failure of the membrane. More research into these mechanisms is desirable.

To summarize, we believe that a high SIL rating would require strict verification activities, not only during manufacture, but also during installation and operation, to ensure that the device is not installed upside down or otherwise compromised.

4.6. Hazard and operability considerations

A detailed discussion of accident causation and risk management theories is outside the scope of this article. It suffices to say that latent and active failures can be discovered before an accident occurs by using techniques of systematic risk analysis such as a hazard and operability (HAZOP) study. A HAZOP study would very likely have identified the potential for the failure of a level switch (LSL) and subsequent gas breakthrough. A HAZOP study however is always based on diagrams that are assumed to provide an accurate

F.H. Hedlund et al / Large Steel Tank Rockets to 30 m

Fig. 6. The recommended symbols used to represent rupture discs for overpressure protection bear resemblance to the conventional forward-acting type and may confuse workers about the correct installation of the reverse buckling type. A) ISO 10628 standard [17]; B) ANSI/ISA Standard 5.1 [18].

representation of the plant "as-built" and may not pick up mistakes in installation.

The question about the reliability of the rupture disc may have been raised at the HAZOP session with the action of somebody going to check whether it had been installed correctly, particularly if knowledge from past failures had been available to the team members.

5. Conclusion

Compressed air systems are ubiquitous in industry and elsewhere. The material is neither toxic nor flammable. Over time, such systems may be regarded as nonhazardous utility systems that present minimal risk in practical day-to-day operations. As this incident shows, safety managers need to give compressed air adequate attention.

The working pressure of many plant air systems is in the range of 600—800 kPa. This incident describes the failure of a 4-ton steel tank that "took off" and attained a height of ~30 m. The overpressure causing catastrophic tank failure was ~ 60 kPa. The tank's breathing/venting system had insufficient capacity for compressed air/gas breakthrough and the ultimate overpressure protection system (i.e., the rupture disc) was inoperative and had been so for years.

This incident offers the following accident prevention lessons. (1) Caution should be taken if a tank that was originally designed for ambient pressure undergoes modification to operate at slight overpressure. (2) At the organizational level, there appears to be a lack of appreciation of the hazards of large volumes of low-pressure compressed air and the amount of energy that can be released in the event of failure. (3) Installing a rupture disc upside down, an innocent human mistake made by a pipe fitter, rendered the device inoperable. (4) The P&ID symbols in use for rupture discs may be a possible source of confusion for workers when installing reverse buckling type discs. (5) The rating plate of a rupture discs clearly indicates the flow direction and allows simple visual verification of correct installation without the interruption of production. Such inspections should be included in safety audits. (6) The rupture disc seems to have been installed solely to avoid having to comply with the European Pressure Equipment Directive. The rupture disc was intended to ensure that pressure in the tank could not exceed 50kPa and would not be regarded as pressurized equipment. Had the tank failed at a slightly lower pressure than 50 kPa, the consequences would still have been dramatic. The burst pressure of the rupture disc could easily have been specified at a lower value for the tank in question, and significantly reduced the hazard (provided of course, that it had been correctly installed).

We are of the opinion that these lessons are relevant for the beverage sector and for industry as a whole. At other facilities, comparable storage arrangements are in common use for more hazardous substances than yeast slurry. Flammable substances often have an inert gas (e.g., nitrogen) blanketing system to prevent a flammable atmosphere from forming in the headspace. A damaged tank in this circumstance could release flammable substances, some of which might also be toxic, such as organic solvents. Fatalities or acute and chronic health effects could result from exposure to the chemicals and of course result in fatalities or injuries to nearby personnel if a flammable substance ignites. Damage to the environment is likely if the released chemicals enter drains and sewage systems. We hope that this communication will contribute to an improved appreciation of the hazards of systems operated at "slight overpressure" in general and of plant compressed air systems in particular.

Conflicts of interest

None of the contributing authors have conflicts of interest to declare.

Acknowledgments

The factual information in this article is based on a site visit shortly after the tank failure, an interview with one of the refrigeration technicians, follow-up interviews with the brewery's production supervisor, and a report from the specialist metallurgy company, which the brewery kindly made available. The brewery has been forthcoming in requests for information on the condition of anonymity. Incidents with significant learning potential such as this one are seldom communicated to a wider audience and are sometimes not communicated at all. We would like to extend our gratitude to the brewery for granting access to information, which made this article possible. This article has been produced as a voluntary effort and has not received any funding. Opinions expressed are those of the authors, and not those of their employers or organizations.

References

[1] Thyer AM, Jagger SF, Atherton W, Ash JW. A review of catastrophic failures of bulk liquid storage tanks. Loss Prev Bull 2009;205:3—11.

[2] United States Environmental Protection Agency (EPA). Chemical alert: rupture hazard from liquid storage tanks. Washington (DC): EPA; 2001. Report No.: EPA 550-F-01-001.

[3] Thyer AM, Hirst IL, Jagger SF. Bund overtopping—the consequence of catastrophic tank failure. J Loss Prev Proc Ind 2002;15:357—63.

8 Saf Health Work 2016;m:l-8

[4] Atherton W, Ash JW, Alkhaddar RM. An empirical study into overtopping and dynamic pressures on a bund wall post catastrophic failure of a storage vessel. IChemE Symposium Series No. 153. 2007.

[5] Allied Terminals, Inc. Catastrophic tank collapse (two serious injuries, community evacuation). Chesapeake, Virginia November 12, 2008. Washington (DC): U.S. Chemical Safety and Hazard Investigation Board; May 2009. Report No. 2009-03-I-Va.

[6] Geary W, Hobbs J. Catastrophic failure of a carbon steel storage tank due to internal corrosion. Case Stud Eng Fail Anal 2013;1:257—64.

[7] Weinreich E. Vellykket men stinkende indsats. Brandvssen 2011;9:75—7 [in Danish].

[8] Olycka med utslapp av svavelsyra vid Kemira Kemi AB i Helsingborg, M lan, den 4 Februari 2005, Karlstad, Sweden: Statens haverikommission (SHK)/ Swedish Accident Investigation Board; May 2008. Rapport RO 2008:02 [in Swedish].

[9] The Pressure Equipment Directive (PED). Directive 97/23/EC of the European Parliament and of the Council of 29 May 1997.

[10] Huige NJ. Brewery by-products and effluents. In: Priest FG, Stewart GG, editors. Handbook of brewing. 2nd ed. Abingdon (UK): Taylor & Francis; 2006.

[11] American Petroleum Institute (API). Welded steel tanks for oil storage. API Standard 650. 10th ed. Addendum 3. Lansing (MI): API; 2003.

[12] Kurttila H. Isentropic exergy and pressure of the shock wave caused by the explosion of a pressure vessel (PhD thesis). Lappeenranta (Finland): Lap-peenranta University of Technology; 2003.

[13] Turner B. Man-made disasters. London (UK): Wykeham Science Press; 1978.

[14] Maurino DE, Reason J, Johnston N, Lee RB. Beyond aviation human factors: safety in high technology systems. Burlington (VT): Ashgate; 1995.

[15] Reason JT. Managing the risks of organizational accidents. Burlington (VT): Ashgate; 1997.

[16] Smith P, Zappe RW. Rupture discs. In: Valve selection handbook. Engineering fundamentals for selecting the right valve design for every industrial flow application. 5th ed. Houston (TX): Gulf; 2004. p. 227-67.

[17] International Organization for Standardization (ISO). Diagrams for the chemical and petrochemical industry—part 2: graphical symbols. European Committee for Standardization (CEN); 2012. Report ISO 10628-2:2012.

[18] American National Standards Institute/International Society of Automation (ANSI/ISA). Instrumentation symbols and identification. Research Triangle Park (NC): ISA; 2009. Report ANS1/1SA-5.1-2009.

[19] Kayser DS, Liptak BG, Miller D. Rupture discs. In: Liptak BG, editor. Instrument Engineers' Handbook. Process Measurement and Analysis, Chapter 7.17. 4th ed., Vol. 1. Boca Raton, London, New York, Washington DC: CRC Press; 2003. p. 1018-29.

[20] Watton BK, Brodie GW. Reverse domed buckling discs, a pressure relief device, their performance and problems. Institution of Chemical Engineers Symposium Series 1984. Rugby, UK: Institution of Chemical Engineers. 1984;185:51-65.

[21] Swift 1, Experimental study of the consequences of improperly specified or installed rupture discs. Summer National Meeting Minneapolis, Minnesota, Aug 16-19, 1987. New York (NY): American Institute of Chemical Engineers. 1987. Paper no. 51E.

[22] Schrank M. 1nvestigation on the degradation and opening behavior of knife blade burst disks. Loss Prev Proc Ind 2014;32:161-4.