Chemical Technology July 2015

Animated publication

6

4

10

22

REGULAR FEATURES 3 Comment by John Butler-Adam, Editor-in-Chief, the ‘South African Journal of Science’ 36 Et cetera/ Sudoku 107/Solution to Sudoku 106 COVER STORY 4 Real measurement benefits from VEGA’s ceramic pressure transmitters VEGA’s dry, oil-free ceramic cell technology CERTEC ® is a real alternative for a wide range of measurements, offering major benefits to users. NANOTECHNOLOGY 6 In pursuit of the perfect blood Mad Max is captured and forced into slavery as a ‘blood bag’ in “Fury Road”, the latest episode in the ongoing post-apocalypse saga. He is there to provide an endless source of fresh blood transfusions to ensure the health of the War Boys as they main- tain the authority of the villainous Imortan Joe. by Gavin Chait Contents

32

WATER TREATMENT 22 Organic compounds in produced waters from shale gas wells

The quality of shale gas produced waters, as well as frac flowback waters, is a current environmental concern and disposal problem for producers. Re-use of produced water for hydraulic fracturing is being encouraged; however, knowledge of the organic impurities is important in determining the method of treatment. by Samuel J Maguire-Boyle, Department of Chemistry, Rice University, Houston, Texas and Andrew R Barron, Department of Chemistry, Department of Materials Science and Nanoengineering, Rice University, Houston and Energy Safety Research Institute, College of Engineering, Swansea University, Wales, UK

Transparency You Can See Average circulation (Jan – March 2015) 3 700

28 Focus on water treatment

CONTROL & INSTRUMENTATION 32 Making biogas measurements manageable

Chemical Technology is endorsed by The South African Institution of Chemical Engineers

Measuring biogas flow has long been a problem area in process measuring technology. Parameters such as high water and CO 2 content make for a demanding medium and a difficult measuring task. A new generation of ultrasonic flowmeters makes biogas measurements stable and manageable.

9 Focus on nanotechnology

35 Focus on control & instrumentation

PLANT MAINTENANCE, SAFETY, HEALTH & QUALITY 10 Layers of protection and safety integrity

and the Southern African Association of Energy Efficiency

In industry there are hazards which can lead to loss of life and property. To avoid these consequences, it is essential to prevent them from happening in the first place or, as a last resort, mitigate their effects by means of protection. If prevention is included in the term protection, then one may visualise an installation with various layers of protection around it. by Daniel J E Rademeyer, ISHECON, Johannesburg, South Africa

DISCLAIMER The views expressed in this journal are not neces- sarily those of the editor or the publisher. Generic images courtesy of www.shutterstock.com

17 Focus on plant maintenance, safety, health & quality

http://www.chemicaltechnologymagazine.co.za/

Comment

Women, productivity and progress

by John Butler-Adam, Editor-in-Chief, the ‘South African Journal of Science’*

“T he challenge for Africa is to ensure that the gender imbalance in the practising of science, technology and innovation [STI] is addressed. None of us underestimates the importance of sci- ence, technology and innovation for socio- economic development, in both the developed and developing world. The involvement of women in STI activities is thus crucial for contributing to the development of nations.” So said Minister Naledi Pandor, South African Minister of Science and Technology earlier this year. In many parts of the world, historically, girls and women have not had the same ac- cess to education as their male counterparts have enjoyed. There is a lingering tradition, in some schools, of encouraging boys to study physical science and girls to focus on biology and to become teachers, while methods of teaching science have not been mainstreamed appropriately to consider gender equality in, for example, teacher education and curriculum development. Institutional structures, and a persistent lack of support in the workplace, have disadvantaged women in their quest to progress in scientific careers. Yet the fact that women have won at least some of the world’s most prestigious scientific prizes, and continue to play leading roles across the full range of scientific research, serves to remind us that the distribution of intelligence, research skills and imagination is not gender- based, any more than it is ethnicity-based, but fundamental to the human condition. Ms Pandor’s urging has both moral and practical force. Moral, because there is abso- lutely no justifiable reason for the exclusion of over half the population of a country or continent – or the world, in fact. And practi- cal because, like the rest of the world, Africa needs all the research and applied skills that can possibly be mustered across the complete spectrum of disciplines. The entire population

needs equal access to education, training and employment. The Association of African Women in Sci- ence and Engineering estimates that women constitute no more than 20 % of the academ- ics in these fields in Africa, and in the USA, the number also reflects a minority: 46% of academics in science and engineering fields are women (though the number is bolstered by the 16 % in Life Sciences). In this regard, GenderInSITE (Gender in Science, Innovation, Technology and Engineering) southern Africa, seeks to: demonstrate how gender analysis of science and technology can lead to improved development in key development sectors; high- light women’s transformative role in develop- ment and the contributions of women to SITE, and how science and technology can support women and men; and promote leadership of women in SITE. In any sphere of the intellectual, public and private endeavours that manage critical physical and non-physical resources, and that contribute to their creation and effective use, it is people who are critical. Research carried out by Cata- lyst©, a non-profit organisation whose mission is to expand opportunities for women and busi- ness, foregrounds the important finding that the dominance of men does not just limit the ‘pool of skills’ but also limits productivity – and creative, sound decision-making. Their collected research shows, for example, that Fortune 500 companies with the highest representation of women board directors attained significantly higher financial performance, on average, than those with the lowest representation of women board directors. A telling statistic: three of South Africa’s seven world-leading researchers in their fields, as determined in 2014, are women. There can be no more excuses.

Published monthly by: Crown Publications cc Crown House Cnr Theunis and Sovereign Streets Bedford Gardens 2007 PO Box 140 Bedfordview 2008 Tel: (011) 622-4770 Fax: (011) 615-6108 E-mail: chemtech@crown.co.za Website: www.crown.co.za Consulting editor: Carl Schonborn, PrEng Editor: Glynnis Koch BAHons, DipLibSci (Unisa), DipBal (UCT) Advertising: Brenda Karathanasis Design & layout: Anoonashe Shumba BTech Hons Creative Art (CUT-Zim)

Circulation: Karen Smith Publisher: Karen Grant Director:

J Warwick Printed by: Tandym Print - Cape Town

*S Afr J Sci. 2015;111(5/6). http://dx.doi. org/10.17159/sajs.2015/a0110

3

Chemical Technology • July 2015

Real measurement benefits from VEGA’s ceramic pressure transmitters

VEGA’s dry, oil-free ceramic cell technology CERTEC ® is a real alternative for a wide range of measurements, offering major benefits to users.

A s well as improved performance, excellent accuracy, linearity and process hygiene, dry ceramic cells are generally far more robust than traditional oil-filled pressure systems. One of the main issues is that oil-filled transmitter membranes/diaphragms on a pressure sensor are necessarily very delicate by design in order to transmit the pressure, which means they can be easily damaged or compromised. Careful consideration must also be given to the type of fill-oil used for the application. There are many variants, all designed to minimise any contamination should they rupture, but of course, most end users would rather not risk this occurrence at all! Often, to accommodate the various types of oil fills that are needed on a typical plant, multiple oil filled types need to be carried as spares. The VEGABAR series 80 with CERTEC ® dry ceramic sen- sors can be all-rounders across site, as well as being the optimumchoice for each application. They can operatemuch longer in process conditions where traditional filled pressure cells will require regular recalibration, or even replacement on a routine basis. What are ceramic pressure sensors and are they all the same? The ceramic substrate material is made from a highly compressed powder with a binding material. The ceramic itself is extremely durable and hard, based on aluminium oxide, a substance used for many applications in industry. But not all ceramics are structurally the same; the finer and purer ceramic materials produce the highest performance. The best materials are sapphire ceramic based. A dense crystal design provides excellent mechanical strength, corrosion resistance and reliable long term stability. In

these materials, the characteristic surface finish is also very smooth at <0,7 µ m Ra, also making it suitable for use in the most demanding of hygienic applications, including those regulated by FDA and other chemical requirements. Chemical resistance Ceramic as a substance is, of course, resistant to many chemicals with the finer, higher purity ceramics offering the best all round resistance of all, although some care has to be taken with some alkalis and acids. A competent supplier will offer comprehensive resistance lists and advice on this. In general, with the right elastomer seal, eg, Kalrez ® , they can be fully process compatible with some fairly aggres- sive and corrosive media. Some combinations can even have all ceramic/polymer based mountings, threads and flanges providing all non-metallic wetted parts, for excellent resistance to aggressive process environments. These op- tions mean ceramic cells can save costs compared to large flanged, oil filled chemical and capillary seals using special The majority of measurements are ‘gauge’ pressure, which means they have to be referenced and breathe to the at- mosphere. A gauge pressure dry cell will always have the ability to take in moisture from the environment around it. The air will inevitably have moisture in it and, in humid areas (which encourage moisture formation on any temperature differentiated surface - even inside the sensor), microscopic droplets can even form on the sensitive electronics of any measuring cell, thus causing micro short circuits resulting in drift or an offset. This can materialise in days, weeks and often expensive coatings or alloys. Condensation resistance

4

Chemical Technology • July 2015

Petrochemicals COVER STORY

recovery depends largely on how long it takes the sensor to reach equilibriumwith the process temperature to stabilise. However, VEGA’s in- novative new design seeks to improve this with a temperature circuit mounted directly onto the rear of the diaphragm, which also means that temperature measurement can now be trans- mitted as an additional process measurement, reducing connections and costs. Summary The CERTEC ® dry ceramic measuring cells used in the VEGABAR series 80 avoid the risk of pro- cess and product contamination with fill fluid, but they also bring other advantages. The mate- rial is harder than steel with excellent overload,

or months and, even if dried out, the sensor is never the same. It can even occur many years after a new plant is commissioned and suddenly the sensors can start to mis- behave. Time and production is lost removing, exchanging, recalibrating and replacing sensors. Special Gore-Tex ® style membranes and filters are mainly used to keep this at bay, but it is still not always successful in the long run – humid air finds a way inside. To counter this, VEGA has introduced a new, extra pro- tective measure. Using an insulating coating on the inside surfaces of the cell, the sensitive gold measuring elements are protected against moisture and the microscopic droplets causing the short circuits and drift, thus delivering long-term reliability, even in the most humid of environments. Temperature performance Higher specification ceramic cells can handle direct process temperatures up to 150 °C, not only the ceramic itself, but also the electronic components. Temperature measure- ment is extremely important for any pressure sensor and especially for ceramic designs. The compensation for the coefficient of expansion is crucial – as the temperature changes, so the materials expand, with direct effects on the minute deflection of the diaphragm. On most measur- ing cells, temperature is monitored behind on the main sensor body, so there is inevitably a lag behind the process temperature. This lag, and particularly the reaction of the ceramic to sudden temperature changes, means they will have an incorrect reading for a period of time, especially on applications directly against the process (eg, flush dia- phragm). The time period depends on the speed and size of temperature change and the mounting configuration, as the

Latest electronic differential pres- sure systems with ceramic cells. They are hard wearing, remove the need for capillaries and deliver well under very high temperatures.

vacuum and pulsation resistance and it has the ability to resist the harshest abrasion. They lend themselves well to flush mounting to the process, but not all designs are the same and careful choice of elastomer and design to suit your process is important. Although temperature shock can be an issue for ceramic cells, the latest designs in the VEGABAR 80 technology have innovative temperature compensation systems, whichmain- tain stable measurement accuracy and reliability whatever temperature swings the process delivers. The new electronic DP systems remove the need for costly capillaries and have improved response and accuracy, even with temperature gradients. If you are looking for stable, accurate, reliable pressure measurement with minimal recalibration and maintenance, then dry ceramic cell technology from VEGA is worth consideration over more ‘traditional’ oil filled designs. z

5

Chemical Technology • July 2015

In pursuit of the perfect blood

by Gavin Chait

Mad Max is captured and forced into slavery as a ‘blood bag’ in “Fury Road”, the latest episode in the ongoing post- apocalypse saga. He is there to provide an endless source of fresh blood transfusions to ensure the health of the War Boys as they maintain the authority of the villainous Imortan Joe.

B ack in the real world, we go through 85million units of red blood cells for transfusion annually; that’s about 38 million litres of blood. And demand is growing at about 6-8 % a year, while supply is growing at 2-3 %. This is despite vast improvement in therapy around key-hole surgery or coronary bypasses where far less blood is now required. Part of this is that healthcare is now more universally available, and part is that longer lifespans mean that the unhealthy old need more transfusions during cancer treat- ment. Patients undergoing bone-marrow transplants require platelet donations from 120 people and red blood cells from 20 people. Expanders (such as Ringer’s Lactate solution – a solution of various salts isotonic with blood) have helped to reduce the demand for blood. Our bodies carry a lot more red blood cells (erythrocytes) than strictly necessary for our sedentary lifestyles, since you’re prepared – at a moment’s notice – to start sprinting and your body will then need the extra oxygen. Given that a person suffering from major blood loss is hardly about to go for a run, that person’s blood can be

expanded to bring homeostatic pressure back up to normal. Then, as long as you remain placidly in your hospital bed, there is sufficient red blood to ensure normal respiration. So far so good, but donated blood itself comes with a host of problems. Following the outbreak of Variant Creutzfeldt-Jakob dis- ease (Mad Cow, for the rest of us) in 1996, which caused 170 human cases of the illness, the UK does not use locally donated blood plasma, but imports it from the US. Converse- ly, New York imports about 25 % of its blood supply from Europe. Donated blood is subjected to a plethora of tests, including for sexually transmissible diseases, Hepatitis B and C, and HIV. Then it needs to be typed as A, B, AB, or O and its Rhesus group. This is because, just to spice things up, we don’t all have the same type of blood. Antigens in the blood act to fend off disease by sticking to anything your body doesn’t recognise and so making it ‘bigger’ and signalling for white blood cells to come and 'eat' the invaders. In the middle of a transfusion, a massive supply of alien blood would trigger a

6

Chemical Technology • July 2015

NANOTECHNOLOGY

huge immune response. And kill you. So you really do want the right blood for you. All-in-all, there are 342 different blood-group antigens, of which 160 are defined as ‘high prevalence’. If you’re lucky, you’re in that group and you’ll be able to get a transfusion in an emergency. If you’re not … let’s just say, you don’t want to be in that group. There are, for example, only 43 people in the world with Rhesus null blood. They have no Rhesus antigens. This makes their blood heart-breakingly precious since they can donate to anyone who falls into the rare Rhesus blood type groups. Donated blood is, literally, a life-saver. And, once donated, it lasts only 42 days. Given this, and the difficulty of safely storing and distributing blood to those in need, it is no surprise that the pharmaceuticals industry has been looking for suitable alternatives. Artificial blood The requirements for any artificial oxygen-carrying blood are many and various. Firstly, it must be compatible with all

blood-types, ensuring it can be used by anyone. It must be able to transport oxygen at least as efficiently as does blood; and that is both in terms of its capacity to absorb oxygen, and to release it once it gets to its destination. It must last about 120 days once it is transfused to ensure that its rate of decay matches your body’s rate of production (otherwise it’s like having a continuous bleed and requires a just as continuous top-up). And, if that isn’t enough, it must have similar properties to blood since your body control systems are designed to deal with specific homeostatic pressures and flow-rates. Blood doesn’t only carry oxygen. It acts to clot at sites of injury to aid healing. It regulates body temperature and pH, as well as delivering antibodies and white blood cells to infection. There are currently two main approaches to developing artificial blood. The first is to use haemoglobin (Hb), the molecule in blood which does the job in the first place. Given that red blood can only be stored for 42 days, a vast amount of blood is discarded. One can have a shortage

7

Chemical Technology • July 2015

NANOTECHNOLOGY

anyway, and the human trials process has been so long and – for the most part – has not demonstrated unequivocal benefits for the substitute blood. Fluosol, a PFC-based product, is still the only blood substitute approved by the US FDA for use, and it was only used during cardiac angioplasty (that is, during a very brief procedure, and only because it allowed surgeons to extend the procedure and give themselves more time). However, problems with the emulsion storage used meant that it stopped being used by 1992. In fact, it’s kind of difficult to find an early entrant to the industry that has managed to stick out the lengthy clinical trial process, mostly because the early efforts have been only marginally as good as donated blood. Despite this, the British National Health Service has announced that it will be using artificial blood (in very specific-use cases) by 2017, with wider use by 2020. Promising new generation of replacements Enter the new generation of blood replacements that look tremendously promising. The NHS approach is to use stem cells harvested from umbilical cords to produce red blood cells. IIT-Madras scientists claim that they can produce tril- lions of cells from millions of stem cells. However, so far, this is only in a petri dish in a lab. The most far advanced approaches can produce about three units of blood for every unit of stem cells. The ad- vantage here is that the resultant erythrocytes can be used for any blood type, and they behave as normal in the body. There is also Oxycyte, a third-generation PFC carrier, invented by Leland Clark shortly before he died. This is undergoing stage II trials. Scientists at the University of Sheffield are developing ‘plastic blood’; a dendrimer composed of repetitively- branched molecules forming a tree-like structure around an iron atom at the core. Dendrimers have been used in drug and gene delivery to protect their payload (or prevent ad- verse side-effects in the wrong place). Creating a designed version of haemoglobin (which has its own Fe core), seems a logical next step. Now, if that isn’t sufficiently sophisticated for you, there’s the respirocyte. This hypothetical artificial blood cell was developed by Robert Freitas and described in his 1998 paper, “A Mechanical Artificial Red Blood Cell: Exploratory Design in Medical Nanotechnology”. They are spherical nanorobots composed of 18 billion atoms designed as a tiny pressure tank able to carry oxygen and carbon dioxide and deliver these around the body. Thus, a person could fill up his blood with respirocytes and sprint for 15 minutes without breathing. There is a darkish side to all this technology. In 2004, it emerged that Spanish Tour de France cyclist Jesus Manzano had used Oxyglobin during the 2003 race. That’s the artificial blood used for animals. Unfortunately, but maybe predictably, he became ill and crashed during the race. The likelihood is that we will soon have a useful artificial blood that will reduce the risk of disease and incompatibility. Whether we’ll be ready for it is another story. z

of the right blood type even as one discards blood of the ‘wrong’ blood type. It is most vexing. Human Hb is extracted from erythrocytes but cannot be simply transfused. Hb is held in place within the erythrocyte by a scaffold-like tissue called the stroma. Hb isolated from compromised erythrocytes still contains stroma, and stroma – outside of its cellular environment – is toxic to kidneys. Yet, isolating Hb from stroma results in Hb which does not release oxygen. It also circulates far too rapidly through the body, causing problems with hydrostatic pressure. Hb can be cross-linked with bis-fumarate, and further polymerised, to result in a tetrameric haemoglobin which has lower oxygen affinity and a longer circulation time. To further increase circulation time, Hb can be linked to thiols or they can be encapsulated in biodegradable polymer vesicles. The result is also typeless and usable by anyone. However, getting enough human stroma-free Hb is a problem, and so bovine Hb is being used as a starter. This leads to new problems of potential introduction of cow diseases as well as incompatibility. A product developed from cows was used in South Africa until 2008, when it was de-authorised for use in humans (although its use in veterinary treatment continues). There are also efforts around recombinant production of human haemoglobin. E. coli and yeast have been tried as vectors to express human fused α-globins, but trials were stopped since the resulting molecules resulted in vasocon- striction and other harmful side-effects. Transgenic mice and pigs have been created that con- tain human α and β globin genes. The only problem is that these animals also have their own native haemoglobin. Haemoglobin has proven problematic. An alternative to haemoglobin An older alternative is that of perfluorocarbons (PFCs). Leland Clark, one of the foremost biochemists and ‘father of biosensors’ (he invented a device for measuring oxygen in blood, as well as the precursor to the modern glucose sensor), experimented in the 1960s with fluorocarbon- based liquid that could be breathed by mice in place of air. The fluorine-based polymer is similar to synthetic materials like Teflon, and can potentially carry 100 times more oxygen around the body than does haemoglobin. The problems (obviously) are numerous, including that PFC is biologically inert and so accumulates in the liver, is also oil-like and cannot carry water-soluble salts and metabolic substrates. PFCs must be emulsified in albumin or phospholipids and triglycerides. The most active investor in artificial blood is the US military and for obvious reasons. Getting blood to injured soldiers would be a lot easier if one didn’t also have to worry about expiry-dates and blood types. Biopure (makers of Hemopure, a Hb approach), North- field (makers of Polyheme, another Hb variant), and Sangart (makers of Hemospan, also Hb), have all received fund- ing. And they’re all bankrupt. Biopure was bought by OPK Biotech, which shut down, and its IP was bought by HbO 2 Therapeutics … which is still going. The problem is that patients requiring major transfusions are not in good shape

8

Chemical Technology • July 2015

FOCUS ON NANOTECHNOLOGY

Nanowire implants offer remote-controlled drug delivery

An image of a field of polypyrrole nanowires captured by a scanning electron microscope is (Purdue University image/courtesy of Richard Borgens)

human cell. The nanowires can be loaded with a drug and, when the correct electromagnetic field is applied, the nanowires release small amounts of the payload. This process can be started and stopped at will, like flipping a switch, by using the corresponding electromag- netic field stimulating device, Borgens said. The researchers captured and transported a patch of the nanowire carpet on water drop- lets that were used used to deliver it to the site of injury. The nanowire patches adhere to the site of injury through surface tension, Gao said. The magnitude and wave form of the elec- tromagnetic field must be tuned to obtain the optimum release of the drug, and the precise mechanisms that release the drug are not yet well understood, she said. The team is investi- gating the release process. The electromagnetic field is likely affecting the interaction between the nanomaterial and the drug molecules, Borgens said. “We think it is a combination of charge effects and the shape change of the polymer that allows it to store and release drugs,” he said. “It is a reversible process. Once the electromagnetic field is removed, the polymer snaps back to the initial architecture and retains the remaining drug molecules.” For each different drug the team would need to find the corresponding optimal elec- tromagnetic field for its release, Gao said. Polypyrrole is an inert and biocompatable material, but the team is working to create a biodegradeable form that would dissolve after the treatment period ended. The teamalso is trying to increase the depth at which the drug delivery device will work. The current systemappears to be limited to a depth in tissue of less than 3 centimeters, Gao said. z

A team of researchers has created a new im- plantable drug-delivery system using nanow- ires that can be wirelessly controlled. The nanowires respond to an electromagnetic field generated by a separate device, which can be used to control the release of a preloaded drug. The system eliminates tubes and wires required by other implantable devices that can lead to infection and other complications, said team leader Richard Borgens, Purdue University’s Mari Hulman George Professor of Applied Neuroscience and director of Pur- due’s Center for Paralysis Research. “This tool allows us to apply drugs as needed directly to the site of injury, which could have broad medical applications,” Borgens said. “The technology is in the early stages of testing, but it is our hope that this could one day be used to deliver drugs directly to spinal cord injuries, ulcerations, deep bone injuries or tumours, and avoid the terrible side effects of systemic treatment with steroids or chemotherapy.” The team tested the drug-delivery system in mice with compression injuries to their spinal cords and administered the corticoste- roid dexamethasone. The study measured a molecular marker of inflammation and scar formation in the central nervous system and found that it was reduced after one week of treatment. A paper detailing the results will be published in an upcoming issue of the Journal of Controlled Release and is currently available online. The nanowires are made of polypyrrole, a conductive polymer material that responds to electromagnetic fields. Wen Gao, a postdoc- toral researcher in the Center for Paralysis Research who worked on the project with Bor- gens, grew the nanowires vertically over a thin gold base, like tiny fibres making up a piece of shag carpet hundreds of times smaller than a

Story by Elizabeth K. Gardner, 765-494-2081, ekgardner@purdue.edu

9 Chemical Technology • July 2015

Layers of protection and safety integrity

by Daniel J E Rademeyer, ISHECON, Johannesburg, South Africa

In industry there are hazards which can lead to loss of life and property. To avoid these consequences, it is essential to prevent them from happening in the first place or, as a last resort, mitigate their effects by means of protection. If prevention is included in the term protection, then one may visualise an installation with various layers of protection around it.

T hus, if a hazardous event should occur, it will have to break through the layers of protection before people andproperty couldbeharmed, as illustrated inFigure1. Layers of protection can be achieved by manual actions, by mechanical devices or by instrumentation. The more reli- able each protection layer is and the more of them there are, the more difficult it will be for a hazardous effect to penetrate through to hurt people or damage assets. There- fore the integrity of a protection layer is important, ie, its availability, which is a function of its reliability and maintain- ability. Lately, through modern technology, a lot of emphasis is put on the implementation of instrumented protection, like trips and interlocks, in processes and operations. Independent layers of protection The concept of an Independent Protection Layer (IPL) which is an independent safety system devised to stop the pro- gression of an event to the hazardous state, is used. This can be illustrated by referring to Figure 2 depicting a simple example where an operator has to fill a tank with a corrosive and toxic liquid. If the main hazard identified is pollution, then in this situation the causes could be overfilling of the tank or tank failure, eg, cracking. In this case there are no

layers of protection and pollution is extremely likely. Referring to Figure 3, the following layers of protection can be added: 1. Design integrity, ie, specification of a non-corrosive mate- rial of construction for the tank. 2. Providing the operator with procedures and training to monitor the tank level visually and close the valvewhen full. 3. Provision of a level indicator so that the operator does not need to climb onto the tank to observe the level. 4. Add a level control loop to automatically control the level in the tank avoiding the need for the operator to be in attendance. 5. Add a high level alarm so that whenever the control loop fails, the operator is alerted to take corrective action, eg, close the valve. 6. Add a high level interlock using a high level switch to automatically close an actuated valve, should any of the above protection layers fail. 7. Finally, provide an overflow pipe on the tank and a bund to contain any spillage should any of the above layers of protection fail. It is important that each layer of protection is capable of acting independently of any other protection layer.

10

Chemical Technology • July 2015

PLANT MAINTENANCE, SAFETY, HEALTH & QUALITY

Layer of protection analysis (LOPA) Layer of protection analysis is a simplified form of risk assessment that evaluates the risk of an individual hazard scenario. It only considers safeguards which are independent layers of protection. The purpose of this is to assist in avoiding the addition of excessive protection incurring high costs, ie, over protection. It uses an order of magnitude technique to evaluate the adequacy of existing or proposed layers of protection against known hazards. In order to carry out a LOPA the following information must be available: • A hazardous event must have been identified, eg, fire, explosion, toxic release, pollution, etc. • The causes of the event. • The consequences of an event, eg, fatalities, injuries, damage, spoilt environment, etc. • Existing safeguards. The above information is often readily available from a Hazard and Operability study (Hazop) and, therefore, a LOPA can be done as part of such a study. Alternatively, a separate LOPA can be done where the above informa- tion is generated.

Setting tolerance criteria Some criteria or target of tolerance or acceptability is required to enable one to decide how much protection is enough. In the following simple example a typical scale of risk has been established. Risks can be classed as follows: • Class I - Intolerable risk, not acceptable • Class II - Undesirable risk, which is tolerable only if risk reduction is impractical or the cost is disproportionate to the improvement gained • Class III - Tolerable risk if the costs of reduction exceeds It is normal to design hazardous processes or operations to meet a Class III risk. A target risk table may be drawn up for a particular industry or organisation. A hypothetical example is shown below in Table 1. Note this matrix is not an industry standard, see HSE (2001). For example, if a particular hazardous event, eg, over- filling of a tank, could lead to an irreversible health effect, long term environment damage or a R50-m financial loss, then this should not happen more than once in a 1 000 years, to meet the Class III risk criteria, that would make the risk tolerable. Alternatively, this can be expressed as the improvement gained • Class IV - Negligible risk.

11

Chemical Technology • July 2015

Figure 2: Example of a tank filling situation with no protection

Figure 1: Layers of protection

Table 1 - Acceptable design target frequencies Severity Catastrophic Critical

Table 2 Safety integrity level

Probability of failure on demand

Marginal

Negligible

> 10 -2 up to 10 –1

SIL 1

Financial effect

R100m

R50m

R1m

R100 000

> 10 -3 up to 10 –2

SIL 2

Environmental damage

Permanent

Long term

Medium

Short

Health effect

Fatal

Irreversible

Major

Minor

> 10 -4 up to 10 –3

SIL 3

Safety Target Frequency

> 1 death

1 death / injuries

Disabling injuries

Minor injuries

> 10 -5 up to 10 –4

SIL 4

1 per year

I

I

I

II

1 per 10 years

I

I

II

III

1 per 100 years

I

II

III

III

1 per 1000 years

II

III

III

IV

1 per 10 000 years

III

III

IV

IV

1 per 100 000 years

IV

IV

IV

IV

a probability of no more than 1 in 1 000 chance per year. This provides one with a design target. Evaluating initial protection required Evaluation of the initial protection necessitates one’s knowing the initiating event frequency (IEF). In the example above this could be the number of times it is expected that the operator will overfill the tank, say once a year. Thus to achieve a target frequency (TF) of once in a 1 000 years, the risk reduction required, or the risk reduction factor RRF, is given by

related system satisfactorily performing its safety function under all conditions within a stated period of time, (IEC 61508 Ed 2 Part 4). This includes both hardware reliability and systematic safety integrity, the latter requiring that all forms of human error in specification, design and software engineering are minimised. Hence the quality of the design process as well as the design features and reliability of the hardware are all equally important. A simplification was introduced through the international standard IEC 61508 by classifying safety integrity perfor- mance into four distinct levels, known as Safety Integrity Levels (SIL). These levels are defined by their ranges of achievable average PFDs as shown in Table 2. Thus, in the example above, a PFD of 1 x 10 -3 is > 10 -3 up to 10 -2 and therefore equivalent to a SIL2. This will indicate to the designer that protection with a reliability or integrity of SIL2 must be incorporated in the design to meet the speci- fied safety standard. In most cases the first choice would be to add a safety instrumented system (SIS), which, in the above example of a tank, would be the high t level trip LSH, which closes the actuated valve on the filling line. Such a trip would be specified to the designer as a SIL2. Implementation of protection Protection may take place in many forms, such as operator actions, alarms, controls, trips and interlocks, relief devices,

Initiating event frequency IFF

1

RRF =

= = = 1 000

Target frequency

TF

0,001

This is by how much the initiating event frequency must be reduced to meet the target. Then the probability of failure on demand (PFD) of the protection needed is determined as

1

1

PFD = = = 0,001 = 1 x 10 -3

RRF

1 000

PFD is sometimes referred to as the safety gap in the design and is also a measure of the reliability or safety integrity required from the protection to achieve the safety target. Safety integrity Safety integrity is defined as the probability of a safety

12

Chemical Technology • July 2015

PLANT MAINTENANCE, SAFETY, HEALTH & QUALITY

Figure 3: Adding independent layers of protection

Protection system integrity Consider a simple shut down system comprising a sensor, logic solver solenoid valve and shut off valve. In the above example this could be the high level trip. Assuming, as an illustration, that each component (sub system) has a failure rate of 0,1 per year, ie, it fails once in ten years, then the total failure rate of the string (3 sub-systems in series) is f = 0,1 + 0,1 + 0,1 + 0,1 = 0,4/year. If the system is rarely or never tested, the probability of failure on demand PFD increases with time and would become very high. However, if tested every six months, one could say that on average it would be in a fail state half the test time. This is so because, say we divide the time between tests T in 10, then if it fails after 0,1T it would be in a fail state (1 - 0,1)T, if it failed after 0,2T it would be in a fail state (1 - 0,2)T and continuing if it failed after 0,9T, it would be in a fail state (1 - 0,9)T. Adding all ten failed times and taking the average of the failed times is equal to 1/2T. Thus in the example, if tested every six months, the av- erage failed time is 6 months/2 = 3 months equal to 0,25 year. But the failure rate of the protection string f is 0,4 / year, so the PFD = ½ * f * T = 0,4*0,25 = 0,1 or 10%. The PFD can be reduced by testing more frequently. If tested every three months, the PFD = ½ * 0,4 *3/12 = 0,05. This meets the requirement of a SIL1. The above result is not totally realistic because of ig- noring common cause failures of the components due to factors such as electrical interference, excessive vibration or excessive temperatures, etc. This typically restricts the PFD reduction to about 10 % of the 1oo1 PFD. PFD can also be reduced by incorporating redundancy, as mentioned earlier, into subsystems, eg, the level sensing. Thus using 1oo2 or 1oo3 systems together with automatic diagnostic fault detection, the PFD can be further reduced to allow a SIL 2 and SIL 3 to be achieved. Such methods can be applied to any of the sub systems and are generally used to improve the performance of the weakest part of the ‘string’. Typically 1oo2 is widely used and sometimes 1oo3 is justified. Although a 1oo3 SIS is highly reliable, it is also vulnerable

and emergency plans. As mentioned earlier, it is common to initially specify an SIS with modern technology. This usually comprises a sensor to measure a variable, a logic solver to manipulate the signal from the sensor, a converter to change the signal into a usable form (often a solenoid valve which changes an electric signal to a pneumatic or hydraulic signal) and a final shut-off element (usually an actuated valve or a power cylinder). SISs can be designed and built with safety integrity to comply with any of the specified SILs. Typically, a SIL1 would be built as a single channel system with a single sensor, a single logic solver stage and a single actuated valve as shown in Figure 4. This configuration is referred to as a 1 out of 1 system, denoted 1oo1. Each of the three parts of the SIS are called sub systems and all three subsystems must satisfy SIL 1 requirements both separately and when combined. A SIL2 would typically be achieved by providing redun- dancy as a dual channel shown for the sensors and actua- tors in Figure 5. Here only one out of the 2 channels needs to function for the SIS to function, ie, one channel can fail. This configuration is referred to as a 1 out of 2 system, denoted 1oo2. A SIL3 may sometimes need to be built with 3 channels as shown for the sensors in Figure 6. Here only one chan- nel out of 3 needs to function for the SIS to function, ie, 2 channels can fail. This configuration is referred to as a 1 out of 3 system, denoted 1oo3. Note that in extreme situations, 3 channels of solenoid valves and shut off valves could also be used, but the reliability of two solenoid valve-shut off valve combinations is usually high enough to obviate the use of three. Also, a SIL 3 usually requires a 1oo2 arrangement for logic solvers as well as actuators. However some high performance logic solvers can achieve SIL3 in a 1oo1 con- figuration due to their ability to detect virtually all dangerous failures and shutdown the process automatically. A SIL4 would be very reliable, but also very expensive, whereas a SIL 1 would be cheaper but less reliable, ie, of lower integrity.

13

Chemical Technology • July 2015

Figure 5: SIL 2 instrumented protection configuration

Figure 4: SIL 1 instrumented protection configuration

for spurious activation. The disadvantage is that the installa- tion would be unnecessarily shut down, incurring production costs. This problem can be overcome by a voting system, eg, a 2oo3. In this configuration, two channels must initiate activation before the SIS will function. Therefore, if one faulty channel initiates activation that would unnecessarily shut down the process, the logic solver would disable the shut down as it will have been set up to only enable shutdown if there are two activation signals. However, 2oo3 voting increases the PFD by a moderate amount. Note also, that achievement of SIL 1,2, 3 or 4 depends equally on the measures taken to ensure systematic safety integrity has been achieved. Hence SIL performance cannot be claimed for an SIS unless the design and maintenance specifications have been done in accordance with the requirements of the internationally recognized standards such as IEC 61508 or IEC 61511. Incorporating other layers of protection LOPA allows one to take credit for other layers of protection which may then allow one to reduce the required SIL rating of the SIS, thereby reducing the cost as well as ensuring that the system is not overprotected. In the example, the operator failure is the initiating event, with an initiating event frequency IEF, the high level trip LSH of the feed is the SIS, so with LOPA one could take credit for the control system assuming it has a PFD = 0,1. Therefore the mitigated risk R, excluding the SIS, but with other IPL included is: R = Initiating event frequency * Product of the PFD’s of all IPLs = IEF * [ PFD( IPL 1 ) * …PFD(IPL n ) ] = 1 * 0,1 = 0,1 / y = 0,1/ 0,001 = 100 which is now much lower. Hence the required PFD of the SIS (high level trip) can be reduced to PFD = 1/100 = 0,01 = 1 * 10 -2 . Referring to Table 2 on page 12, this value falls between 10 -2 up to 10 –1 which means that a lower SIL 1 can be specified for the SIS which is the high level trip. Risk graph method A simple short-cut method according to IEC 61508/61511 Revised risk reduction factor RRF= = Mitigated risk R Target frequency TF

is using the risk graph shown in Figure 7 on page 15. Inputs into the risk graph are as per the Figure 8 below. In the example, if we assume a consequence ‘Perma- nent injury > 1 person, 1 death’≡ C2, exposure time is ‘Frequent to permanent’≡ F2, avoidance of the hazard is ‘Almost impossible’≡ P2 and the probability of an unwanted occurrence is ‘Slight’≡ W2. Then, following through the risk graph, one arrives at a SIL 2. If credit is taken for the control loop acting to reduce the probability (W2 reduces to W1) of the event, then this would be one layer of protection and the required rating of the SIS will then reduce to SIL 2 – 1SIL = SIL1. Note: a control loop would not normally be rated SIL 1 or be called an SIS without expensive features. However, it is reasonable to claim that the control loop reduces the probability of the event by a factor of 10 (ie, PFD = 0,1). SIL matrix method A SIL matrix may be drawn up as shown in Table 3 opposite, to simplify the SIL rating of Safety Instrumented Systems. Therefore, having estimated the likelihood of the initiating event of a hazard and knowing the severity, onemay read off the required initial SIL level directly. Incorporating additional layers of protection, the SIL is decreased by 1. In the example above of filling a tank, the initiating event is 1/year for medium environmental damage, a SIL 2 is indicated. Incorporating a layer of protection, moving one column to the right, shows a SIL1. Note: ‘ALARP’ ≡ ‘As Low As Reasonably Practical’, means the design can be accepted, no further risk reduction is necessary, provided it can be shown that this will not be practical or cost-effective. Conclusions Simple explanations have been given to illustrate layers of protection. It was pointed out that such layers of protec- tion must have sufficient integrity to prevent initiation or propagation of a hazardous event. The suitability of layers of protection must be assessed against targets of tolerability, drawn up by the owner or organisation of the installation. Safety instrumented systems are normally incorporated in hazardous installations as a first choice of a layer of pro- tection. The required integrity of such a layer of protection is expressed as a probability of failure on demand, and

14

Chemical Technology • July 2015

PLANT MAINTENANCE, SAFETY, HEALTH & QUALITY

Figure 6: SIL 3 instrumented protection configuration

Figure 7: SIL Risk graph

Table 3 SIL MATRIX Severity

Catastrophic

Critical

Marginal

Negligible

Financial effect

R100m

R50m

R1m

R100 000

Environmental damage

Permanent

Long term

Medium

Short

Health effect

Fatal

Irreversible

Major

Minor

Event Safety Frequency

> 1 death and injuries

1 death / injuries

Disabling injuries

Minor injuries

10 per year

Too high

Too high

Too high

Too high

1 per year

SIL 4

SIL 3

SIL 2

SIL 1

1 per 10 years

SIL 3

SIL 2

SIL 1

ALARP

1 per 100 years

SIL 2

SIL 1

ALARP

ALARP

1 per 1000 years

SIL 1

ALARP

ALARP

ALARP

1 per 10 000 years

SIL 1

ALARP

ALARP

NONE

1 per 100 000 years

ALARP

ALARP

NONE

NONE

Consequences

Exposure time

C1 Minor injury

F1 Rare to more often

C2 Permanent injury > 1 persons; 1 death

F2 Frequent to permanent

Safety instrumented systems are normally incorporated in hazardous installations as a first choice of a layer of protection.

C3 Death of several persons C4 Very many people killed

Avoidance of hazard

Probability of unwanted occurrence

P1 Possible under certain circumstances

W1 Very slight

P2 Almost impossible

W2 Slight W3 Relatively high

Figure 8: Description of inputs into the SIL risk graph

Acknowledgement Content was reviewed by David Macdonald, SIS Specialist who provided valuable input. References International Electro-technical Commission standard IEC 61508 – Functional safety of electrical/electronic/ programmable electronic safety-related systems. HSE, UK Health and Safety Executive, Reducing Risks, Protecting People (R2P2), 2001 – ISBN 07176 21 51 0. IEC 61511-1, clause 11, " Functional safety - Safety instru- mented systems for the process industry sector - Part 1: Framework, definitions, system, hardware and software requirements", 2003-01. z

is categorised into four levels, known as safety integrity levels, abbreviated as SIL. Safety integrity levels can be determined by either basic calculations or a risk graph or by simply using a matrix. Once the required level of safety is known, the safety instrumented systemdesign can be specified in terms of the proof test period, component reliability and the redundancy of components comprising the safety instrumented system. It was further shown that another use of layer of protec- tion analysis is that the selected safety integrity level for the safety instrumented system can be reduced by taking credit for other layers of protection, which may include design integrity, control, indications and alarms, physical protec- tion devices such as relief valves and emergency response.

15

Chemical Technology • July 2015

Made with