Isolation, blinding and line breaking: the hazards

Sooner or later, every vessel, line and valve in a facility has to be opened: to replace a gasket, change a filter, inspect the inside, clean out sludge, cut in a tie-in or repair a leak. Opening process equipment is one of the most dangerous routine tasks in the industry, because the equipment has to be separated from pressure, flammable and toxic fluids and stored energy before anyone breaks a flange. HSE-210 teaches lockout of machinery, HSE-221 teaches permit-to-work systems in general and HSE-333 will teach permits, isolation planning and simultaneous operations in oil and gas. This lesson explains the hazards that make isolation and line breaking in facilities so demanding: why valves leak, how pressure gets trapped, what comes out at the first break and what can go wrong with purging. Understanding the hazards is what makes the procedures in HSE-333 make sense.

Why process isolation is different

Locking out a machine usually means opening a breaker and locking it. Isolating process equipment is harder for several reasons. The energy is in the fluid, which may be under pressure, flammable, toxic, hot, cold or all of these. Valves, unlike breakers, often leak when closed. Fluid can be trapped in pockets, low points and dead legs that no drain reaches. Equipment may be connected to several sources, including relief headers, drains, vents, instrument lines and utility connections that are easy to miss on a drawing. And the act of opening the system can release residual fluid even after it has been depressured and drained.

Levels of isolation

Process isolations range from a single closed valve to physical disconnection. The higher the hazard, the more secure the isolation should be. Industry practice, such as Energy Safety Canada's isolation guidance and company standards based on similar principles, generally describes these levels:

Valves pass

A closed valve is not a wall. Valve seats wear, erode, collect debris and lose their seal, and a valve that is shut tight by hand can still let fluid through. This leakage, called passing or leak-by, is common on valves that have operated for years in dirty or sandy service. A passing valve slowly repressures an isolated section, keeps a supposedly empty line full of gas, or feeds fluid into equipment that has been opened. That is why isolation is verified by bleeding and monitoring, not assumed from valve position, and why high-hazard work needs a positive isolation rather than valves alone.

The program below estimates how quickly a small leak past a closed valve repressures an isolated section of pipe. It treats the leak as a tiny orifice with choked gas flow and assumes the section starts at atmospheric pressure. It is a teaching approximation, but it shows why a section can be back at significant pressure within the time it takes to set up for a job.

# Repressuring of an isolated pipe section by a passing valve (teaching approximation).
import math
upstream_psia = 870 + 14.7               # source pressure behind the passing valve
leak_d_in = 0.02                         # equivalent leak diameter, invented
section_ft3 = 32.0                       # volume of isolated section, invented
T, R, M = 288.0, 8.314, 0.019            # K, J/(mol K), kg/mol (lean gas)
k, Cd = 1.3, 0.6

A = math.pi * (leak_d_in * 0.0254) ** 2 / 4
P0 = upstream_psia * 6895
V = section_ft3 * 0.0283
choke = math.sqrt(k * M / (R * T) * (2 / (k + 1)) ** ((k + 1) / (k - 1)))
mdot = Cd * A * P0 * choke               # kg/s while flow is choked
p, t = 101_000.0, 0
for minutes in (10, 30, 60, 120):
    while t < minutes * 60:
        p += mdot * R * T / (M * V)      # 1-second steps, ideal gas
        t += 1
        if p > 0.53 * P0:                # flow no longer choked; stop simple model
            break
    print(f"After {minutes:>3} min: about {p/6895 - 14.7:6.0f} psig in the section")

After  10 min: about     17 psig in the section
After  30 min: about     51 psig in the section
After  60 min: about    101 psig in the section
After 120 min: about    203 psig in the section

A leak far too small to hear can bring an isolated section back to 100 psi or more within an hour or two. If a crew opens a flange on that section believing it to be depressured, the gas and any liquid inside will blow out at the break. Monitoring pressure on the isolated section after depressuring, and leaving bleeds open where the isolation design requires, catches this.

Trapped pressure and liquids

Even with good valves, pressure and fluid hide in places that drains and vents do not reach. Between two closed valves; in the body cavity of a ball or gate valve; behind a check valve; in a low point full of liquid or a high point full of gas; behind a hydrate or solids plug; in instrument lines and gauge connections; in a heat exchanger whose other side is still in service. A gauge reading zero is not proof either, because gauges fail, gauge taps plug and a gauge may be on the wrong side of a plug or valve.

Bleeds and vents can also plug. A bleed valve in wet gas service can freeze or fill with hydrate; one in dirty service can plug with sand, scale or wax. An open bleed that shows no flow may mean the section is depressured or may mean the bleed is blocked. Procedures therefore call for confirming that bleeds are clear, for example by briefly checking flow from a known source, and for using more than one indication that a section is depressured.

The first break

The moment of greatest danger is the first break of containment: loosening the first flange bolts, cracking open a fitting or removing a plug on equipment that has been isolated, depressured and drained. If anything has been missed, this is when it comes out. Experienced crews follow practices that limit exposure at the first break:

• Confirm the isolation, depressuring, draining and purging on the permit and, where possible, walk the isolation points with the operator who set them.
• Wear the protection the hazard assessment requires for the contents, which in sour service may mean supplied-air breathing apparatus for the first break even if the line has been purged.
• Monitor for H2S and LEL at the break.
• Break flanges by loosening the bolts on the side away from the body first, so that any release is directed away from the worker, and leave some bolts engaged until the joint has separated and nothing comes out.
• Have a container or drain ready for liquids, and keep the break away from ignition sources.
• Stop at once if pressure, liquid or gas appears, retighten if it is safe to do so and return the job to the operator.

Purging, gas-freeing and nitrogen

Before equipment that held hydrocarbons is opened or entered, it is usually purged to remove flammable and toxic gas. Purging may use nitrogen, steam, water or, after hydrocarbons have been removed, air. Each method has hazards.

Nitrogen is widely used because it is inert: it does not burn and it displaces hydrocarbons and oxygen. That is exactly what makes it deadly. A person who breathes air with too little oxygen can lose consciousness within one or two breaths at very low oxygen levels, with no warning, because the body senses rising carbon dioxide rather than falling oxygen. Workers have died entering nitrogen-purged vessels, putting their heads into manways, working near open flanges with nitrogen flowing, and trying to rescue colleagues who collapsed. Nitrogen from purges also flows out of open vents and manways and can collect in pits, trenches and buildings.

The program below estimates how quickly oxygen falls in a small, poorly ventilated analyzer shelter when a nitrogen purge vents into it. It uses a simple well-mixed model with invented numbers.

# Oxygen in a small shelter with nitrogen venting into it (well-mixed model, invented numbers).
import math
volume_ft3 = 700.0         # shelter volume
n2_cfm = 28.0              # nitrogen entering
for minutes in (2, 5, 10, 15, 20, 30):
    o2 = 20.9 * math.exp(-n2_cfm * minutes / volume_ft3)
    note = "alarm level for most monitors" if o2 < 19.5 else ""
    note = "impaired thinking and coordination possible" if o2 < 16 else note
    note = "rapid collapse possible" if o2 < 10 else note
    print(f"{minutes:>3} min: O2 about {o2:4.1f} %  {note}")

  2 min: O2 about 19.3 %  alarm level for most monitors
  5 min: O2 about 17.1 %  alarm level for most monitors
 10 min: O2 about 14.0 %  impaired thinking and coordination possible
 15 min: O2 about 11.5 %  impaired thinking and coordination possible
 20 min: O2 about  9.4 %  rapid collapse possible
 30 min: O2 about  6.3 %  rapid collapse possible

Within a few minutes the shelter would trip an oxygen alarm, and within about 20 minutes it could be lethal. Nitrogen purges must vent to a safe place, and areas where nitrogen may collect need oxygen monitoring, warning signs and entry controls under HSE-211.

Other purging hazards include steam burns and the vacuum that forms when steam condenses in a closed vessel, which can collapse it; air purging of equipment that still contains hydrocarbons or pyrophoric deposits, which can create a flammable mixture or ignite deposits; and water flushing that leaves liquid trapped in low points. Purge completion is confirmed by gas testing at several points, not by elapsed time alone.

Blinds and reinstatement

Blinds and spectacle blinds are pressure-containing parts. They must be rated for the pressure and service, made of suitable material, installed with the correct gaskets, and recorded on a blind list so that every blind installed is removed before start-up. Spectacle blinds have a solid end and an open end; the handle or tag shows which is in the line. A blind left in a line can block a relief path or cause a deadhead when the system restarts, and a blind removed early can admit fluid into equipment where people are working. Blind lists are reconciled at the end of the job, and the system is leak-tested before it returns to service.

Reinstatement after work is another point of risk. Valves must be returned to their correct positions, drains and vents closed, instruments reconnected and the system purged of air before hydrocarbons are reintroduced, to avoid creating an explosive mixture inside. Leak testing with nitrogen or the process fluid at controlled pressure finds joints that were not made up properly.