American Dairy Brands - Executive Summary |
|
EXECUTIVE SUMMARY American Dairy Brands' Plymouth, Wisconsin plant American Dairy Brands is a division of Dairy Farmers of America. American Dairy Brands provides American cheese products to retail, wholesale, food service, and institutional customers marketed under the Borden brand name and Elsie the Cow logo. American Dairy Brands operates a cheese processing plant located in Plymouth, Wisconsin, which uses an ammonia refrigeration system to provide space, comfort, and process cooling. The facility is subject to the USEPA's Risk Management Program (RMP) under the Chemical Accident Prevention Provisions of 40 CFR 68 because its refrigeration system contains more than the threshold quantity (10,000 pounds) of anhydrous ammonia (CAS Number 7664-41-7) listed in the RMP regulations. SYSTEM DESCRIPTION Anhydrous ammonia (NH3) is the oldest and most common refrigerant in general industrial use throughout the world. Anhydrous ammonia is a gas under ambient conditions but serves as a refrigerant in liquid form through pressurization. Although exposure to ammonia is irritating and potentially toxic in large doses, personnel exposure to more than a small leak is rare because ammonia operates within a closed system of vessels, piping, and equipment. In addition, ammonia has a potent and well-known odor that can be easily detected by smell at well below toxic levels. Ammonia is used at the American Dairy Brands facility in a closed system that contains approximately 17,000 pounds of ammonia in various physical states (gas, liquid, and saturated vapor). Components of the system include compressors, condensers, a high-pressure receiver, recirculators, pumps, chillers, and various cooling units. The largest vessel at the facility is the high-pressure receiver that operates at approximately 125 psig and has the capacity to store the entire inventory of ammonia in the system. However, during typical operation, the vessel contains only 5,000 to 6,000 pounds of ammon ia. The high-pressure receiver, condensers, and some piping sections are located outdoors. The anhydrous ammonia refrigeration system is equipped with various safety components including safety relief valves (SRVs), safety interlocks, and ammonia sensors. SRVs protect the high-pressure receiver, recirculators, chillers, condensers, and compressors from overpressurization. Each SRV is matched with a rupture disc to provide verification if an SRV lifts. Safety interlocks include high and low ammonia pressure and high oil pressure cut-out switches for the compressors, and high level float switches for the recirculators. Ammonia sensors are located in the engine room and activate alarms and ventilation fans if ammonia is detected. The system also includes a solenoid-operated liquid "king" valve on the high-pressure receiver which can be closed from three remote locations. Changes planned for the near future include: (1) installation of ammonia sensors on all 5 levels of the facilit y; and (2) installation of an ammonia sensor on the SRV discharge line to allow for prompt notification and verification of valve opening. WORST-CASE RELEASE SCENARIO A worst-case scenario was evaluated as part of a hazard analysis of the ammonia refrigeration system. This scenario assumes that the high-pressure receiver experiences catastrophic rupture and the maximum contents of this vessel are completely lost over a 10-minute period. When the ammonia system was designed, the high-pressure receiver was sized with a capacity to store the entire system inventory in order to provide flexibility during system maintenance, although the receiver is rarely, if ever, used to hold the entire inventory. Because of the large size of the high-pressure receiver, the entire system inventory (17,000 pounds) was considered as the quantity that could be released in a worst-case scenario. The endpoint for this release is defined as the distance where the ammonia concentration is 200 parts per m illion in air, or 0.02 percent. This endpoint is considered the maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible effects or symptoms that could impair their ability to take protective action. The worst-case release was analyzed based upon the guidance contained in the USEPA's Risk Management Program Guidance for Ammonia Refrigeration (the "Ammonia Guidance"), dated November 1998. USEPA used the SACRUNCH atmospheric dispersion model to construct "lookup" tables and figures in the Ammonia Guidance that relate the quantity and rate of ammonia released to the endpoint distance. Using the specified worst-case meteorological conditions contained in the Ammonia Guidance, the distance to the endpoint for a worst-case release would extend beyond the facility boundary. Although the worst-case consequence analysis is required by the RMP, it should be considered a highly unlikely event. Desig n, construction, and operation of the high-pressure receiver is such that catastrophic failure is extremely remote. The vessel was designed and constructed in strict accordance with the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Section VIII), and was certified and stamped by the National Board of Pressure Vessel Inspectors (National Board). Third party and state mandated inspections of the vessel's condition occur annually by a boiler and machinery insurance inspector who has been certified by the National Board. In addition, the vessel is visually observed daily. There are only two plausible causes for a catastrophic loss of containment of the receiver: (1) the internal pressure increases uncontrollably and ruptures the vessel from the inside; or (2) the vessel wall ruptures due to inadvertent contact (e.g., vehicular) from the outside. The vessel is operated well below the design pressure (i.e., maximum allowable working pressure) of 250 p sig, and because of the safety factors built into the ASME Code, a fourfold pressure excursion (to approximately 1,000 psig) would have to occur before catastrophic vessel failure. Such pressures could not be generated internally. The only logical external cause of high pressure would be flame impingement or surface radiation from a high challenge fire adjacent to the vessel. If this were to occur, the vessel is equipped with an SRV set to relieve internal pressure at 250 psig. A high pressure excursion would not occur as long as the SRV continued to function. Actuation of the SRV would result in an ammonia release similar to that described for the Alternate-Case Release Scenario. All SRVs are scheduled to be replaced every five years, in accordance with the International Institute of Ammonia Refrigeration (IIAR) guidance contained in IIAR Bulletin Number 109, Minimum Safety Criteria for a Safety Ammonia Refrigeration System, to ensure that they will function properly when requir ed. Further, rupture of the vessel from the outside as a result of inadvertent vehicular contact is unlikely since the unit is protected by fencing and collision posts. The worst-case release scenario is unlikely for the following additional reasons: 7 The worst-case weather conditions which were used for this scenario are uncommon; 7 Industry standards were followed for the manufacture and quality control of this vessel; 7 Ammonia is not corrosive in this service; 7 The facility has a preventive maintenance program in place to maintain the ongoing integrity of the vessel; and 7 The facility has a training program designed to ensure that the system is operated by qualified personnel. ALTERNATE-CASE RELEASE SCENARIO The USEPA specifies that an alternate release scenario be evaluated that is more likely to occur than the worst-case scenario and is significant enough to impact off-site areas (i.e., the endpoint must be located beyond the facility boundary). The alternative, or "more likely," scenario that was evaluated assumes release of ammonia through a 1/4-inch effective diameter hole in a high side (i.e., 125 psig) pipe or vessel, releasing 110 pounds of ammonia per minute for up to 60 minutes. This release is representative of a small pipe or vessel leak (e.g., due to corrosion), and is also representative of a flange leak, pump seal failure, or SRV discharge. Because the high-pressure receiver and some piping are located outdoors, in this scenario the facility building was not assumed to provide passive mitigation, which would reduce the release rate and the distance to the endpoint. Using the specified meteorology contained in the Ammonia Guidance, the distance to the endpoint for the "more likely" release scenario would extend beyond the facility boundary. The alternative release scenario is unlikely for the following reasons: 7 Many of the high-pressure liquid lines are located in enclosed areas that could help to contain such a release, and th e outside piping is elevated to promote dispersion; 7 Industrial standards were followed for the manufacture and quality control of these lines; 7 Ammonia is not corrosive in this service; 7 Most of the lines are elevated to minimize the risk of potential damage from forklifts, and forklift drivers are trained in the precautions necessary for working in the vicinity of an ammonia system; 7 The facility has a preventive maintenance program in place to maintain the ongoing integrity of the system; 7 The facility has a training program designed to ensure that the system is operated by qualified personnel; and 7 Shut-off valves for the high-pressure receiver have been installed and labeled at three remote locations to allow personnel to stop the flow of ammonia from the receiver quickly in an emergency. ACCIDENTAL RELEASE PREVENTION PROGRAM The facility has carefully considered the potential for accidental releases of ammonia, such as the occurrence of the worst-case and alternati ve-release scenarios previously described. To help minimize the probability and severity of an ammonia release, a prevention program has been implemented. The key components of the prevention program are summarized below: 7 The development, documentation, and operator availability of critical process safety information regarding the hazards of ammonia, the design basis of the system, and the equipment. This information is used to fully understand and safely operate the ammonia refrigeration system. 7 The development of an employee participation program. This program assures that employees who utilize the ammonia system and are most knowledgeable about it are able to easily, effectively, and regularly recommend changes or improvements to enhance safety. 7 The performance of a formal process hazard analysis (PHA), using the "What-if..." technique. A team with expertise in engineering, operations, maintenance, and safety evaluated the refrigeration system in depth and developed re commendations to improve the safety and operability of the system. The PHA addressed: (1) process hazards; (2) previous incidents; (3) engineering and administrative controls applicable to the hazards; (4) the consequences of control failure; (5) facility siting; (6) human factors; and (7) a qualitative evaluation of possible safety and health effects of control system failures. The PHA will be updated and revalidated every five years. 7 Written operating procedures (OPs) were prepared to provide the basis for proper and safe operation of the ammonia refrigeration system. 7 Formal authorization systems (i.e., management of change procedure, pre-startup safety review) are in place to ensure that system changes or expansions are as safe as the original design and that an independent recheck, prior to start-up, confirms that the changes are consistent with the engineering design and safety requirements. 7 Events that might (or did) cause an accidental or unexpected release of ammo nia are subjected to a formal investigation. The objective of the investigation is to correct deficiencies in such a way as to prevent recurrence. 7 Contractors that are hired to work on, or adjacent to, the refrigeration system are "pre-qualified" based upon their knowledge of ammonia refrigeration, understanding of applicable codes and standards, and their demonstrated ability to work safely. 7 Prior to the performance of any hot work (i.e., spark or flame producing operations such as welding, cutting, brazing, grinding), management must approve the work by executing a written hot work authorization permit to verify that precautions to prevent fire have been implemented. 7 Periodic formal walk-throughs occur to find unusual or increasing vibration, incipient leaks, or other indications of potential upsets or failures that could lead to a release. 7 Replacement of all SRVs is scheduled every five years. 7 Numerous safety components, including SRVs, safety interlocks, and remot ely-activated shutoff valves, are installed on the refrigeration system. 7 Periodic inspection and calibration is performed on liquid level sensors, temperature and pressure instruments, switches, and shutdown devices that have safety implications. 7 Periodic inspections are performed for major powered equipment, including compressors, pumps and large fans, bearings, couplings, shaft seals, mountings, etc., for vibration or incipient mechanical failure. 7 Proper design, including adherence to recognized safety codes. 7 Adherence to fire codes and preparation for fires, storms, or events which could impact the ammonia system. 7 Planning with the local emergency responders to ensure a rapid response to potential incidents involving the system or external events, such as storms or tornadoes. ACCIDENT HISTORY Historically, releases of ammonia from industrial refrigeration systems most often occur from leaking valves, malfunctioning pressure relief devices, or inadvertent releases d uring repair activities. While these incidents can cause localized areas of detectable odor, they seldom lead to a release of a reportable quantity or cause an off-site impact. There were no releases of ammonia at the facility in the last five years (since June 21, 1994) that resulted in death or property damage on site, or death, injury, evacuation, sheltering in place, property damage, or environmental damage off site. There was one accidental release of ammonia at the facility in the last five years that resulted in employee exposure and required one individual to receive medical treatment. The release may have occurred when a safety relief valve opened and a small amount of ammonia gas (less than one pound) entered the facility through an air intake vent, although the initiating event could not be determined conclusively. EMERGENCY RESPONSE PROGRAM American Dairy Brands has implemented a detailed written Emergency Action Plan (EAP). The EAP is intended to address all emerge ncies at the facility, in addition to incidents related to a release of ammonia. The EAP includes awareness and response training for employees, coordination with the local emergency responders, and evacuation of the facility. The plan details reporting procedures for all emergencies; identifies specific key individuals, their 24-hour telephone numbers, and their responsibilities; and presents procedures for providing emergency medical treatment. American Dairy Brands plans to develop a hazardous materials response (HAZMAT) team composed of American Dairy Brands personnel. The presence of this team on site will reduce the time needed to respond to a release, and increase the likelihood that the amount and duration of any potential release could be significantly reduced. American Dairy Brands will also develop an Emergency Response Plan in conjunction with development of the HAZMAT team. |