Overnight Air-Out on the Fuel Oil Tank
A 12 m diameter, 8 m high fixed-roof fuel oil tank at a depot on Tsing Yi is to be cleaned of about 150 mm of sludge. It shares a common 100 mm transfer line with an adjacent tank still in service with 4 m of fuel oil; the only isolation between them is a closed gate valve at the tank nozzle, with a second valve further along the line. A steam heating line enters the tank, isolated by a valve. The plan is to open the 600 mm top manhole for 24 hours to "air out", then send two workers in with buckets and shovels and a 24 V halogen lamp, wearing half-face respirators with A2 filters. The sun is out and the shell temperature is 45 °C. The sludge is black and oily, and the atmosphere at the last opening "smelled of diesel".
1. Identify the isolation failures and describe what positive isolation would require.
Read the worked answer
Failures
- A closed gate valve is not isolation. Gate valves leak past the seat, and the adjacent tank holds 4 m of fuel - a static head that will find any passing valve. A second valve in series does not fix this; it halves the leak rate, it does not stop it.
- No lockout. Nothing prevents someone opening the valve.
- The steam line is isolated by a valve only. Steam is both an energy source and a burn hazard, and a passing valve can heat the tank while people are inside.
- No drain, vent or bleed point proven between the isolation and the tank, so there is no way to demonstrate zero energy.
- No electrical isolation recorded for any mixer, pump or level instrument in or on the tank.
Positive isolation requires
- A spade or blind inserted at a flange, or physical removal of a spool section, on the transfer line, the steam line and any other connected line.
- Lockout and tagout of every valve, switch and isolator, with keys held by the entry supervisor.
- Drain and bleed the isolated section, then prove pressure, flow and energy are zero before the permit is issued.
- A sketch on the permit showing every isolation point, signed off by the person who physically verified each one.
Reasoning: isolation is the control that makes every other control possible; without it, ventilation and testing are being performed against a source that can re-contaminate the space at any moment.
2. Critique the purging and ventilation plan and specify a workable one.
Read the worked answer
Critique
- An open manhole is not ventilation. A single 600 mm opening at the roof of a 900 m³ tank gives essentially no air exchange at the floor, where the sludge is. "Air out" is a belief, not a method.
- The sludge is the source. Oily sludge releases hydrocarbon vapour continuously; disturbance with shovels will push the LEL up during the work, long after any pre-entry test looked acceptable.
- The lamp is an ignition source. A 24 V halogen lamp is not explosion-protected and runs at a high surface temperature. Fuel vapour plus a hot filament or a broken bulb is an ignition scenario.
- Filters are the wrong protection during sludge work, since the vapour concentration is unknown and rising.
Workable plan
- Positive isolation as above, plus bonding and earthing of the tank and all equipment.
- Remove the bulk of the sludge remotely - vacuum truck, air-driven or explosion-proof pump - before any entry. Fewer entry hours means less exposure.
- Forced ventilation with ducting delivered to the tank floor, running continuously before and throughout entry; several air changes before entry and re-testing afterwards.
- Testing at top, middle and floor for LEL, O2, H2S, CO and benzene; continuous personal monitoring with alarms; re-test whenever the work changes.
- Explosion-protected lighting and tools, no hot work, no mobile phones or non-Ex equipment inside.
- Breathing apparatus for the sludge phase, plus harness, retrieval line, standby and a rescue plan.
- Heat stress management at 45 °C shell temperature: cooling, rotation, fluids, shorter shifts.
3. What would make this job acceptable to you, and what would make you refuse it outright?
Read the worked answer
Acceptable, with conditions
- Both the transfer line and the steam line positively isolated with spades, locked, bled and proven.
- Bulk sludge removed remotely; ventilation ducted to the floor and running throughout.
- Atmosphere tested at all levels and continuously monitored, with documented results on the permit.
- Explosion-protected equipment, bonding and earthing, no ignition sources.
- Entrants in appropriate breathing apparatus for the residual sludge phase, with harness, retrieval line, tripod, trained standby and a rehearsed rescue plan.
- Heat stress controls and a realistic work duration.
- Permit issued by the appointed person after all of the above are verified on site.
Refuse outright if
- The adjacent tank remains connected by valves only, with no spade or disconnection.
- Entry is proposed with filter respirators while vapour levels are unknown or the LEL is above the action level.
- The halogen lamp, or any non-explosion-protected equipment, is taken inside.
- Ventilation is "the open manhole" and testing is a single reading at the top.
- No standby or rescue capability is provided.
Judgement to state: the decision is not a compromise between speed and safety. Each of the refusal items is a single-point failure that can kill, and the schedule pressure from the depot is not a factor that a permit issuer may lawfully take into account.