Pevely Dairy - St. Louis, MO - Executive Summary

| Accident History | Chemicals | Emergency Response | Registration | Source | Executive Summary |

1.0    SOURCE AND PROCESS DESCRIPTION 
1.1    SOURCE 
The Pevely Dairy in St. Louis, Missouri is subject to the USEPA's Risk Management Program (RMP) for Accidental Chemical Release regulation (40 CFR 68) because it has a refrigeration system that contains more than the threshold quantity (10,000 pounds) of anhydrous ammonia (CAS Number 7664-41-7).  Anhydrous ammonia (NH3), is a gas at ambient conditions.  The anhydrous ammonia (ammonia) refrigeration system is used to manufacture and store ice cream, milk, yogurt, juice, and other consumer food products.  It is a closed system that contains approximately 21,000 pounds (i.e., 3,900 gallons) of ammonia in various physical states (gas, liquid, and saturated vapor).  The largest vessel is the high pressure receiver tanks that operate at approximately 150 psig and can contain as much as 7,200 pounds of liquid ammonia (at their maximum safe fill volume of 90%).  However, during typical operation, the tanks hold only about 4,800 pounds.  Most of the 
ammonia equipment is located indoors.  The condensing towers, ice builder, and some piping runs are located outdoors. 
 
Ammonia is the oldest and most common refrigerant in general industrial use throughout the world.  It is a high capacity refrigerant that operates at reasonable pressure.  Although exposure to ammonia is irritating and potentially toxic in large doses, personnel exposure to more than a small leak is rare because ammonia operates within a closed system of vessels, piping, and equipment.  In addition, ammonia is easily detected by smell at levels well below its toxic endpoint. 
 
1.2    PROCESS DESCRIPTION 
The ammonia refrigeration system is a two-stage system consisting of a high pressure side and a low pressure side.  The ice cream  processing units operate on the low side (i.e., low pressure) to quickly freeze product.  Ammonia suction from the storage freezers and processing units at or below 0 psig passes through the low side accumulator before entering the booster comp 
ressors.  Any liquid ammonia in the low side suction is trapped in the low side accumulator and returned as liquid to the low side of the system.  The booster discharge passes through an intercooler before entering the high side compressors. 
 
The high side compressor suction draws from the intercooler (booster discharge) and the high side suction accumulators at about 25 psig.  These accumulators receive suction from the mix tanks, glycol chillers, and milk and juice storage coolers.  The liquid subcooler feeds liquid to the low side units. Excess ammonia liquid that collects in the high side accumulator is removed and return to the system. 
 
The major discharge from the high side compressors (hot gas), at 150 to 175 psig, is vented to a series of condensing towers.  A portion of the hot gas is also used for defrosting and for operation of the pumper drums, which transfer liquid out of the accumulators. 
 
The condensed liquid is returned to the high pressure receivers where it is fed to  
the low and high side equipment. 
 
The ammonia refrigeration system is protected by the existence of specific safety systems/hardware, including safety relief valves, engine room ventilation, and system safety interlocks.  Safety relief valves protect the compressor discharge, condensers, pumper drums, suction accumulators, intercooler, and storage receivers from the hazards associated with overpressure.  Safety interlocks include high pressure and high temperature alarms and cutouts for the compressors, as well as high level floats and sensors for vessels.  The high pressure cutouts for the compressors are set at 200 psig. 
2.0    POTENTIAL RELEASE SCENARIOS 
The refrigeration system is a totally closed system.  Historically, releases of ammonia from industrial refrigeration systems most often occur from leaking valves, malfunctioning pressure relief devices, or inadvertent releases during repair activities.  While these incidents can impact employees, they seldom lead to a release of a rep 
ortable quantity or represent an off-site impact. 
 
Consistent with the RMP rule requirements, two specifically defined release scenarios (a worst-case release and an alternative release) were analyzed to determine the maximum distance to an endpoint where the ammonia concentration is 200 parts per million in air, or 0.02 percent.  This endpoint represents the maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible effects or symptoms that could impair their ability to take protective action. 
 
The release scenarios analyzed are based upon the guidance contained in the USEPA's Risk Management Program Guidance for Ammonia Refrigeration (the "Model Plan"), dated November 1998.  This guidance document used the SACRUNCH atmospheric dispersion model to construct "lookup" tables that relate the quantity and rate of ammonia released to the endpoint distance. 
 
2.1    WORST-CASE RELEASE 
The worst-case relea 
se is considered to be defined by the catastrophic rupture and complete loss of the maximum contents of the two high pressure receivers (approximately 7,200 pounds of ammonia) over a 10-minute period.  Using the specified worst-case meteorology contained in the Model Plan, the distance to the endpoint for a worst-case release was estimated to be 5,300 feet or 1.0 mile. 
 
Although the worst-case consequence analysis is required by the RMP, it should be considered a highly unlikely event.  Design, construction, and operation of the high pressure receivers is such that catastrophic failure is extremely remote.  The receivers were designed and constructed in strict accordance with the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Section VIII), and certified and stamped by the National Board of Pressure Vessel Inspectors (National Board).  Third party and state mandated inspections of the vessels' condition occurs annually by a boiler and machinery insuran 
ce inspector who has been certified by the National Board.  In addition, the vessels are inspected daily by a plant facility mechanic, trained in the operation of the system. 
 
There are only two plausible causes for a catastrophic loss of containment of a high pressure receiver:  (1) the internal pressure were to increase uncontrollably and rupture the vessel from the inside; or (2) rupture of the vessel wall due to inadvertent contact (e.g., vehicular) from the outside. 
 
The vessels are operated well below the design pressure (i.e., maximum allowable working pressure) of 250 psig and because of the safety factors built into the ASME Code, a fourfold pressure excursion, to approximately 1,000 psig, would have to occur before catastrophic vessel failure.  Such pressures could not be generated internally.  The only logical external cause of high pressure would be flame impingement or surface radiation from a high challenge fire adjacent to the vessel.  If this were to occur, the vessels  
are equipped with a safety relief valve (SRV) set to relieve internal pressure at 250 psig.  A high pressure excursion would not occur as long as the SRV continued to function.  Actuation of the SRV would result in an ammonia release similar to that described in Section 2.2 for the alternative release scenario.  The SRVs are scheduled to be replaced every five years, in accordance with the International Institute of Ammonia Refrigeration (IIAR) guidance contained in IIAR Bulletin Number 109, Minimum Safety Criteria for a Safety Ammonia Refrigeration System, to ensure that they will function properly when required. 
 
Further, rupture of the vessel from the outside as a result of inadvertent vehicular contact is unlikely since the unit is provided with substantial barrier protection to preclude this occurrence. 
 
The worst-case release scenario is unlikely for the following additional reasons: 
 
* The worst-case weather conditions which were used for this scenario are uncommon; 
 
* Only rare 
ly are the contents of the system intentionally pumped back to the receivers.  Typically, the receivers contain only 4,800 pounds.  
 
* Industry standards were followed for the manufacture and quality control of these receivers; 
 
* Ammonia is not corrosive in this service and the vessels are relatively new; 
 
* Safety relief valves limit operating pressures in these receivers; 
 
* The facility has a preventive maintenance program in place to maintain the ongoing integrity of the vessels; 
 
* The facility has a training program designed to ensure that the system is operated by qualified personnel; 
 
* The facility has emergency response procedures which enable trained personnel to respond quickly to isolate any potential releases; 
 
* Main ammonia shut-offs have been labeled to allow personnel to stop the flow of ammonia quickly in an emergency. 
 
* Inadvertent vehicular contact with the vessel is unlikely since the unit is located in the corner of the engine room. 
 
2.2    ALTERNATIVE-CASE RELEAS 
E 
The alternative, or "more likely", scenario is considered to be defined by a release of ammonia through a 1/4-inch effective diameter hole in a high side (i.e., 150 psig) pipe or vessel, releasing 100 pounds of ammonia per minute for up to 60 minutes.  This release is representative of a small pipe or vessel leak.  It would also be representative of a flange leak or pump seal failure.  Because the condensing towers and some piping are located outdoors, passive (building) mitigation1 was not used to reduce the release rate or the distance to the endpoint.  Active mitigation2 was considered, because it is believed that emergency responders could identify and stop the leak in less than 60 minutes.  However, reducing the release duration does not change the TEP distance obtained from the Model plan.   
 
Using the specified meteorology contained in the Model Plan, the distance to the endpoint for the "more likely" release scenario was estimated to be 450 feet or 0.1 miles. 
 
The alternative 
release scenario is unlikely for the following reasons: 
 
Many of the high pressure liquid lines are located in enclosed areas that could help to contain such a release, and the outside piping is elevated to promote dispersion; 
 
* Industrial standards were followed for the manufacture and quality control of these lines; 
 
* Ammonia is not corrosive in this service; 
 
* Most of the lines are elevated to minimize potential damage from fork lifts; 
 
* The facility has a preventive maintenance program in place to maintain the ongoing integrity of the system; 
 
* The facility has a training program designed to ensure that the system is operated by qualified personnel; and 
 
* The facility has emergency response procedures which enable trained personnel to respond quickly to isolate any potential releases by closing valves in the liquid lines. 
 
3.0    PREVENTION PROGRAM 
The facility has carefully considered the potential for accidental releases of ammonia, such as the occurrence of the worst-case an 
d alternative-release scenarios described in Section 2.0.  To help minimize the probability and severity of an ammonia release, a prevention program that satisfies the Occupational Safety and Health Administration (OSHA), Process Safety Management (PSM) of Highly Hazardous Chemicals  standard (29 CFR 1910.119) has been implemented.  The key components of the prevention program are summarized below: 
 
* The development, documentation, and operator availability of critical process safety information regarding the hazards of ammonia, the design basis of the system, and the equipment.  This information is used to fully understand and safely operate the ammonia refrigeration system. 
 
* The development of an extensive employee participation program, which includes employees from all levels of the organization and from all areas within the plant (i.e., production and maintenance).  This program also assures that employees that utilize the ammonia system and are most knowledgeable about it are  
best able to easily, effectively, and regularly recommend changes or improvements which enhance safety. 
 
* The performance of a formal process hazard analysis (PHA) in 1997, using the "What-if..." technique.  A team with expertise in engineering, operations, maintenance, and safety evaluated the existing refrigeration system in depth and developed recommendations to improve the safety and operability of the system.  The PHA addressed:  (1) process hazards; (2) previous incidents; (3) engineering and administrative controls applicable to the hazards; (4) the consequence of control failure; (5) facility siting; (6) human factors; and (7) a qualitative evaluation of possible safety and health effects of control system failures.  The PHA will be updated and revalidated every five years. 
 
* Written operating procedures (OPs) were prepared in 1996 and 1997 to provide the basis for proper and safe operation of the ammonia refrigeration system.  The OPs include procedures for normal operation, 
startup, shutdown, emergency operation, and emergency shutdown.  They also describe safe operating limits for temperature and pressure, the consequences of operating outside these safe operating limits, and a description of safety systems and how they operate. 
 
* Refrigeration system operators receive refresher training.  The training content is based upon the process safety information and operating procedures.  The training program ensures that the operators understand the nature and causes of problems arising from system operations and serves to increase awareness with respect to the hazards particular to ammonia and the refrigeration process. 
 
* Formal authorization systems (i.e., management of change procedure, pre-startup safety review) are in place to ensure that system changes or expansions are as safe as the original design and that an independent recheck, prior to start-up, confirms that the changes are consistent with the engineering design and safety requirements.   
 
* Eve 
nts that might (or did) cause an accidental or unexpected release of ammonia are subjected to a formal investigation.  The objective of the investigation is to correct deficiencies in such a way as to prevent recurrence. 
 
* Contractors that are hired to work on, or adjacent to, the refrigeration system are "pre-qualified" based upon their knowledge of ammonia refrigeration, understanding of applicable codes and standards, and their demonstrated ability to work safely.   
 
* Prior to the performance of any hot work (i.e., spark or flame producing operations such as welding, cutting, brazing, grinding), management must approve the work by executing a written hot work authorization permit to verify that precautions to prevent fire have been implemented. 
 
* Periodic formal walk-throughs occur to find unusual or increasing vibration, incipient leaks, or other indications of potential upsets or failures that could lead to a release. 
 
* Replacement of all pressure relief valves is scheduled ev 
ery five years. 
 
* Numerous safety systems, including pressure relief valves, ammonia vessel level controls, and safety interlocks are used in the refrigeration system. 
 
* Periodic inspection is performed on liquid level sensors, temperature and pressure instruments, switches and shutdown devices that have safety implications. 
 
* Periodic inspections are performed for major powered equipment, including compressors, pumps and large fans, bearings, couplings, shaft seals, mountings, etc., for vibration or incipient mechanical failure. 
 
* Proper design, including adherence to recognized safety codes. 
 
* Adherence to fire codes and preparation for fires, storms, or events which could impact the ammonia system. 
 
* Planning with the local fire department to ensure a rapid response to potential incidents involving the system or external events, such as storms or tornadoes. 
 
* Prevention program compliance audits are performed every three years to verify that the elements are being properly im 
plemented.  Any deficiency found in an audit is corrected. 
4.0    ACCIDENT HISTORY 
There have been no accidental releases of ammonia at the facility in the last five years (since June 1994) that have resulted in on-site death or significant property damage, or that have resulted in off-site death, injury, evacuation, sheltering in-place, property damage, or environmental damage.  
 
Two OSHA reportable injuries occurred as a result of two separate minor ammonia leaks (valve packing gland leaks), as detailed in the attached data elements. 
5.0    EMERGENCY RESPONSE PROGRAM 
The facility has implemented a detailed written Emergency Action Plan (EAP).  The EAP is intended to address all emergencies at the facility, in addition to incidents related to a release of ammonia. 
 
The ERP includes awareness and response training for employees, coordination with the local fire department, and evacuation of the facility.  The plan details what personal protective equipment and spill response equipment is ava 
ilable; identifies specific individuals, their 24-hour telephone numbers, and their responsibilities; identifies procedures for emergency medical care; and refers to other pertinent elements of the management system (i.e., standard operating procedures). 
 
1    Passive mitigation means equipment, devices, and technologies that function without human, mechanical, or other energy input.  Examples include enclosures (e.g., buildings) for compressed gases and secondary containment dikes for liquids. 
2    Active mitigation means equipment, devices, or technologies that require human, mechanical, or other energy input to function.  Active mitigation for compressed gases, like ammonia, may include automatic shut-off valves, rapid transfer systems, and scrubbers.
Click to return to beginning