Skip to content

Catching Samples

The material in this post is extracted from Chapter 3 of the book Plant Design and Operations.

Drawing liquid hydrocarbon samples from process equipment will expose small quantities of the material to air, thus potentially creating a flammable vapor mixture. Similarly, draining water from the bottom of a hydrocarbon tank to an open drain is likely to allow some hydrocarbon to be exposed to air before the drain valve can be closed. In cases such as these, the following precautions should be considered:

  • Operators should stand where they can immediately shut off the flow of liquid if a fire or large spill should occur.
  • If self-closing valves have been provided these should never be blocked or tied open.
  • An open valve should never be left unat­tended.
  • All open-end connections should be plugged when not in use.
  • The amount of sample flush should be minimized and all flush should be routed to an appropriate safe collection system or location.

If the distance between the body of the material to be sampled and the sample point itself is long, thus requiring a long flush time, a circulation loop should be set up as shown in Figure 3.1. Normally valves A and B and the sample valve are closed. When a sample is to be taken, A and B are opened for a sufficient period of time to allow fresh material to flow through the sample circuit. The sample valve is then opened and the sample caught (in a bottle for liquids and a sample bomb for gases). Then all three valves are returned to the closed position. It is important not to leave A and B open because otherwise the control valve will not be able to fully stop the flow of fluid during normal operations. Also, if they are closed and the sample valve is opened by mistake, not much liquid will escape.

Figure 3.1
Sample Valve Flush



Lockout / Tagout


Lockout / Tagout

The material in this post is extracted from Chapter 3 of the book Plant Design and Operations.

Lockout / tagout systems are routinely used to protect workers when they are working with or close to hazardous systems. They are typically used in conjunction with the other isolation methods. Once a switch or valve is in the correct position it is locked so that it cannot be moved, and a “Do Not Operate” tag is attached to it. (Valves are often chained in place, with the lock being used to secure the chain such that the valve handle cannot be moved.)

In spite of the security that a lockout system provides, it is less safe than the use of positive isolation methods. First a valve may leak while it is in the closed position. Second, in spite of all precautions, someone may remove the lock before the work has been finished. There is also a chance of confusion; the wrong valve may be chained closed, while the valve that should have been secured is left in its normal operating state.

Lockout/tagout is not normally used for routine operating activities such as collecting samples, replacing pressures gauges, or making equipment checks and adjustments. However, it is used on some systems in normal operation, e.g., pressure safety valves locked open or containment drain valves locked closed. Similarly, lockout / tagout is not use for plug connections on electrical equipment because the hazard can be controlled simply by unplugging the equipment (however, the plug that has been detached must be properly controlled so that no one inadvertently puts it back in the socket.)

Lockout/tagout does not normally apply to hand-held power tools or stationary equipment whose electrical power may be controlled by the unplugging of equipment from the energy source when the plug and cord are under the control of the employee performing the servicing or maintenance.

Once the system has been prepared for work, and the locks have been applied, the system must be verified. If it is a motor that is being worked on, for example, the area should be cleared in case the isolation procedures fails, and then an attempt should be made to run the motor. If it is a valve that is being locked closed, the safety lead should try to open it after the locks and chains have been applied. Some companies use the phrase lock, tag and verify to describe this process.

Car Seals

A car seal — also referred to as a security seal — helps prevent someone from inadvertently moving a tagged valve or switch (they are so called because they were first used to seal railcars after they were loaded.) However, because the car seal has very little physical strength (they are sometimes made of plastic), it is very easy to break one if someone decides that it is in the way. Car seals do not provide sufficient security when hazardous chemicals are being used. They are more commonly used in operations such as blending, where an error can cause product quality problems, but not a safety concern. They are also used to ensure that block valves around safety relief valves are in their specified open or closed positions as shown in the sketch, provided by the Total Lockout company.


The traditional form of car seal has been a wire loop with a tag attached to it – rather like a stronger version of a luggage tag. Each seal should have its own unique serial number. Car seals are often provided in different colors where each color is assigned to a particular application, as shown in the diagram.

Car Seals

The sketch below shows the operation of a wire car seal.

Car Seal

The car seal is attached as follows.

  • Pass the cable around the valve wheel and body.
  • Thread the cable back in to the seal body.
  • Pull the cable tight.
  • Cut away unwanted cable.

Group Lockout

When more than one person is working on a job a group lockout / tagout procedure is needed — one in which each person involved can apply their own lock, and only they can remove it (sometimes known as a Masterlock system). Details vary from company to company, but the following process is representative.

  • The lead person on the job locks closed each valve, switch and other device that is used to isolate the high energy source. Only the lead has a key to these locks.
  • He or she labels the locks with the appropriate work permit information, and then attaches a lock box to each location.
  • He places the keys in the box, closes it and then locks it with a master lock (which is often a distinct color such as red.)
  • Every worker who is to work on that job attaches his or her lock to the lock box. They record what they have done on the work permit.
  • If a worker leaves the job, he or she removes their lock and signs off on the work permit.
  • If there is a shift change, workers on the first crew must sign off the job and remove their locks, and workers on the second crew must sign on to the job and add their locks.
  • At the end of the job, each worker removes his or her locks and signs off. Each person must satisfy themselves that the job has, from their point of view, been returned to a safe condition before they remove their personal lock.
  • The lead then removes the master lock and takes the keys from the open box.
  • He then closes the work permit, and unlocks the valves or switches, which now safe to operate.



Lockboxes may be used when multiple individuals’ locks would be required, or in order to avoid the use of multiple locks per authorized individual. (i.e., each authorized individual locking several pieces of equipment). The use of a lockbox will be managed as follows: the methods and devices listed below will be used either separately or in combination, depending on the equipment, to lockout/tagout the following energy source(s):

  • An authorized employee will perform the isolation of the work area and involved equipment and complete the Lockout Permit.
  • All keys involved in the lockout of equipment will then be placed in the lockbox.
  • The authorized individual will install an individually keyed lock on the lockbox. His or her lock should be the first lock on the lockbox once the isolation keys are in the lockbox, and the last lock off of the lockbox when work has been completed. This will insure that the authorized person will be able to insure proper startup/re-energization of equipment.
  • A tag with the name of the person, and the date of the lockout will be affixed to the lockbox.
  • Each person applying a lock to the lockbox must sign and date the lockbox tag.
  • Personnel entering the site to perform work on the isolated equipment must apply their lock to the box and sign and date the lockbox tag.
  • As individuals complete their assigned tasks they may remove their locks from the lockbox.
  • When work is complete and equipment is ready to be returned to service, the authorized individual removes his or her lock from the box so that the restoration to service process may be performed.


Keyed padlocks should be used for locking out equipment and electrical devices. Each padlock should be keyed differently. Supervisors should retain spare keys for each padlock assigned to their work area.

Padlocks should be color-coded to identify the group which owns them. The following color code can be used for padlocks:

  • Yellow: Operations
  • Red: Electricians
  • Blue: Maintenance
  • Green: Instrument Technicians
  • White: Facilities Engineering

Depending on the facility (size and number of personnel), padlocks may be individually assigned or placed on a lock board for common use. A log should be maintained; it identifies who is using each padlock and where the padlock is being used.

Padlocks used for Lockout and Tagout should not be used for other purposes.

Response to a Threatening Call


The material in this post is extracted from Chapter 16 of the book Plant Design and Operations.

Process facilities are potential targets for malicious acts, ranging from simple vandalism all the way to major terrorist acts. Therefore all employees should know how to respond to suspicious activities and threats. (At the same time they should recognize that they are not law enforcement officers — it is important to inform professional security officials as soon as possible that there is a concern.) It is possible that an employee may receive a threatening call. The following Outside Call Checklist provides guidance as to the questions to ask and the actions to take.

Table 16.2
Outside Call Checklist — Part 2

The caller was most probably:

  • Male
  • Female
  • Child
  • Teenager
  • Middle-Aged
  • Older Person
  • Young Adult

The caller seemed to be:

  • Sober
  • Drunk
  • Mentally Disturbed
  • Nervous
  • Calm
  • Excited
  • Angry
  • Emotional
  • Rational
  • Irrational
  • Coherent
  • Incoherent
  • Sincere
  • Righteous
  • Determined
  • Laughing
  • Joking

The caller talked:

  • Loudly
  • Softly
  • With a high pitch
  • With a deep voice
  • With a rasp
  • With a nasal sound
  • Fast
  • Slowly
  • Slurred
  • With a lisp
  • With a stutter
  • Pleasant
  • With good pronunciation
  • With a disguised voice

The caller’s language was:

  • Highly Educated
  • Good
  • Poor
  • Profane
  • Full of slang words or expressions (include them in comments).

The caller had an accent that seemed to be:

  • Local
  • Not local (___________)
  • Foreign (_________)

The caller seemed to be familiar with the Company:

  • Building
  • Equipment
  • Plans
  • Operations
  • Personnel

Background noise:

  • Party Noises
  • Bar Sounds
  • Another person or persons
  • Music
  • House Sounds
  • Animal Sounds
  • Street Sounds
  • Airport Sounds
  • Trains
  • Factory Machines
  • Office Machines
  • Voices
  • Quiet
  • Other: ________________

The origin of the call seemed to be:

  • Local
  • Long Distance
  • Car Phone
  • From a mobile phone
  • From within the building

Caller’s remarks — word for word where possible.

Common Hazards


The material in this post is extracted from Chapter 17 of the  book Plant Design and Operations.


One of the philosophies that lies behind Process Safety Management (PSM) is that each chemical process is unique. Therefore it is not possible to have a prescriptive standard that tells operating companies what to do. Instead, companies have to identify the unique hazards associated with their facility, and then implement corrective actions based on a risk-ranking methodology. For this reason, facilities covered by PSM standards have to conduct a series of Process Hazards Analyses (PHAs), often using the Hazard and Operability (HAZOP) methodology. (The various Process Hazards Analysis techniques are discussed in Process Risk and Reliability Management.) Yet many process hazards are not unique: technologies, equipment types and management styles tend to quite similar from plant to plant and from company to company, particularly within specific industries. Hence, many of the hazards that exist on these facilities are quite similar to one another. Some of the more commonly-observed hazards are discussed in this section; they are grouped into the following categories:

  • Process hazards (some of which are discussed below);
  • Hazards of utilities;
  • Hazards of water;
  • Hazards of steam;
  • Hazards of ice;
  • Hazards of compressed gas;
  • Hazards of air;
  • Hazards of external events;
  • Hazards of equipment and instruments; and
  • Hazards of piping, valves and hoses.

Process Hazards

Some of the more commonly-identified issues to do process operations are shown below. They are organized by the HAZOP (Hazard and Operability) guidewords.

High Flow

Generally, the phenomenon of ‘High Flow’ — in and of itself — is not inherently hazardous. Indeed high flow rates are often desired because they imply that the facility is maximizing production and revenues. Although high flow can occasionally create hazards, such as erosion of pipe walls or of a valve seat, its main effect in terms of process safety is to create secondary deviations such as ‘High Level’ in a tank. ‘High Flow’ can also create a ‘No Flow’ situation; for example, if a pump overspeeds, the sudden surge in motor amperage may result in the motor burning out, thus leading to the flow stopping.

Low/No Flow

As with ‘High Flow’, the phenomenon of ‘Low Flow’ is not usually inherently hazardous. However it can create secondary effects. For example a low flow of cooling water in a heat exchanger can lead to ‘High Temperature’ of the process stream. ‘No Flow’ is usually more serious than ‘Low Flow’ because its occurrence implies a sudden cessation of a processing activity. Probably the biggest hazard associated with ‘No Flow’ is the possibility of it being followed by ‘Reverse Flow’ because the upstream and downstream pressures have equalized, or even reversed. Both ‘Low Flow’ and ‘No Flow’ are usually caused by the inadvertent closing of a valve or the failure of rotating equipment such as pumps and compressors. Because such events occur quite frequently, most facilities have plenty of instrumentation and safeguards to respond to this scenario.

Reverse Flow

‘Reverse Flow’ can create high-consequence hazards because it can lead to the mixing of incompatible chemicals or to the introduction of corrosive chemicals into equipment not designed for them. The causes of ‘Reverse Flow’ are usually a pressure reversal; a high pressure section of the process loses pressure; process fluids then flow into that section back from low pressure sections of the process. (The occurrence of reverse flow almost invariably implies that a check valve and/or safety instrumented system has failed to prevent the event.) ‘Reverse Flow’ can lead to ‘Contamination’. For example, Figure 17.1 shows a process consisting of three sections: A, B and C. The chemicals in Sections A and B are non-corrosive, so these two sections can be safely made of carbon steel. When the two chemicals are mixed in Section C they react to form a corrosive product, hence this section has to be made of stainless steel. If a reverse flow should occur from Section C to either A or B, then those sections would corrode, leading to loss of containment.

Figure 17.1
Reverse Flow Scenario


Another feature of ‘Reverse Flow’ to watch for is that it may take some time for the operators to identify its occurrence, particularly if the flow measurement instrumentation is not set up to recognize the phenomenon. Moreover, experienced operators frequently have trouble visualizing ‘Reverse Flow’. They recognize the possibility of high and low flow because they have probably witnessed these events but reverse flow may be totally outside their experience. Hence, when the topic of Reverse Flow is being discussed during a HAZOP, the team leader should allow plenty of time for the team members to think through possible causes and consequences.

Confined Space Entry

Confined Space Entry

The material in this post is extracted from Chapter 3 – Energy Control Procedures – of the book Plant Design and Operations.

A Confined Space is a space which is large enough for a worker to enter but has limited openings for entry and exit and is not intended for continuous employee occupancy. Entry is considered to have occurred as soon as any part of the entrant’s body breaks the plane of an opening into the space. Therefore it is not permissible, for example, to take a quick breath and to put one’s head into a vessel for a quick look without having an entry permit. Wherever possible work should be organized such that it can be carried out without anyone needing to enter the confined space. If someone does need to enter the confined space the most rigorous controls and procedures must be followed.

Confined spaces include, but are not limited to, storage tanks, towers, drums, boilers, furnaces, sewers, ventilation and exhaust ducts, underground utility vaults, manholes, pipelines, excavations and pits. A confined space is not the same as anenclosed space. Therefore most pipeline trenches are also considered to be confined spaces, even though they are open to the atmosphere. A person working in a trench could be trapped by falling materials or overcome by fumes from a leak. He or she cannot easily escape since they will have to climb out of the trench, probably using a temporary ladder. Entry onto the roof of an external floating roof tank when the roof is more than one meter below the top of the shell also constitutes entry into a confined space.

A confined space should be big enough for a person to enter bodily. A small box such as a metering station may contain hazards such as venomous animals. However, since a person cannot enter with his or her whole body they would not normally be considered as confined space (although some legal interpretations may differ).

Sometimes it is not always clear when a space should be treated as “confined”. On one marine vessel, for example, a worker entered a room containing equipment and was fatally overcome by fumes. It is likely that he thought of the room as being part of the normal work space and so no special precautions were needed.

Confined spaces are classified as either hazardous or non-hazardous. A hazardous space is one that is known to contain a hazardous gas. The gas could be inert (such as nitrogen), toxic (such as hydrogen sulfide) or flammable (such as methane). A non-hazardous space is one that has been purged with air such that a person entering the space does not need breathing apparatus. However, before a person enters a non-hazardous space the atmosphere in that space must be tested for oxygen, and must be re-tested on a frequent or continuous basis. Similarly tests should be conducted for the presence of hazardous gases. The test instrument should be at the same location as the person performing the work.

The following general guidance should be considered when planning confined space work in a vessel.

  • Prior to approving personnel entry, the vessel must be positively isolated by blinding or disconnecting all connections to the vessel, except the purge gas connection, to prevent accidental contamination of its inert atmosphere during entry by personnel. Where blinding or disconnecting piping is not feasible, e.g.,welded piping systems, a double block and bleed system may be have to be considered.
  • Maintain a list of authorized entrants, designate an entry supervisor, and provide a means to prevent unauthorized entry.
  • Energized equipment must be brought to a safe energy state, locked/tagged out, and radioactive sources must be shielded and locked/tagged out, or removed.
  • Prior to entering an inerted confined space, conduct tests to determine oxygen content, and % Lower Explosive Limit (LEL) of the atmosphere at conditions which are as close as reasonably possible to the actual entry conditions and with all service equipment operating.
  • The oxygen content of the atmosphere within the vessel must be monitored continuously with equipment capable of recording low oxygen levels.
  • The temperatures within the vessel must be monitored continuously.  If any temperature rises 10°C (above normal day/night variations), personnel must leave the vessel until it is assured that their safety is not jeopardized due to an exothermic reaction or other such potentially harmful situations.
  • Standby personnel and rescue equipment must be available at the confined space entry point. The rescue equipment must be assembled and ready for use.  Rescue personnel must be trained in the proper use of this equipment.

Types of Space

Confined Space EntryConfined space entry can be divided into two broad areas: non-hazardous spaces which have been ventilated and hazardous spaces that are known to contain hazardous materials.

Non-Hazardous Space

Before a person can enter a non-hazardous confined space the following conditions must be met:

  • It must be shown that the work cannot be accomplished from the outside.
  • The oxygen content must be in the range 19.5 to 23.5%.
  • The flammability level must be below 10% LEL.
  • There are no toxic gases in the confined space.
  • The space does not contain grain, sand or other solid material that could flow and engulf a worker.
  • The temperature in the confined space should be normal. If the space was purged with steam prior to entry it should be cooled down.
  • Noise should be controlled. Confined spaces can be very noisy because of the echoes that are generated.
  • The equipment being worked on is properly isolated.

Hazardous Space

A hazardous confined space is defined as containing, or having the potential to contain, “a recognized serious safety or health hazard”, in other words the space is known to contain hazardous materials and therefore the workers entering that space must wear protective clothing and breathing apparatus. Such as space will meet one of more of the following conditions.

  • An oxygen concentration less than 19.5% or greater than 23.5% and/or maintained inert by gas purging.
  • Lower explosive limit (LEL) greater than 10%. If the confined-space atmosphere exceeds 10% LEL then additional ventilation is needed, or the space must be inerted prior to entry. The need for continuous mechanical (forced) ventilation should be determined on a case-by-case basis and noted on the permit.
  • An atmospheric concentration above the permissible exposure level (PEL) of a toxic substance or an atmospheric concentration of any substance that is immediately dangerous to life or health, (IDLH).
  • An airborne combustible dust at a concentration that exceeds its lower flammable limit (LFL).
  • A confined space that contains a material that could physically engulf the entrant.
  • A confined space that has an internal configuration such that an entrant could be trapped or asphyxiated by inwardly converging walls or floor which slopes downward and tapers to a smaller cross section.

Extraordinary precautions are necessary for entry into a hazardous confined space due to the inherent danger. Special precautions include, training of all participants, assigning an outside attendant, maintaining a list of authorized entrants, assigning an entry supervisor, the provision of breathing air and the use of retrieval systems.

One special type of hazardous space is one where the atmosphere in a vessel must be kept inert because the vessel contains special chemicals or catalysts that would be damaged or could catch fire if exposed to oxygen. Special written job procedures, detailed planning, and training prior to entry must be developed and followed to perform this work safely and efficiently.



The material in this post is extracted from Chapter 8 of the book Plant Design and Operations.

Human error rates can be modeled using a technique known as THERP (Technique for Human Error Rate Prediction). The method uses Boolean logic to model and predict human error rates. Hence it can be integrated Probabilistic Risk Assessment techniques — particularly Fault and Event Trees — topics that are discussed in depth in Process Risk and Reliability Management. A THERP analysis is most effective when the tasks are routine and proceduralized, and when the persons involved are not under stress. THERP can also be used for Event Tree modeling. For example, an initiating event could be an emergency situation such as a leak of a hazardous chemical. Items in the Event Tree that could incorporate human error include: recognition that a leak has occurred, identifying the nature of the leak, and using the correct emergency response equipment. When building a THERP model errors are categorized and then assigned a probability. For example, an operator may be required to close a valve. Potential errors include:

  1. Failing to close the valve;
  2. Closing the wrong valve; and
  3. Partially closing the valve.

If the likelihood for these errors is low then they can simply be added together to obtain the overall error rate, corresponding to the OR Gate in a Fault Tree. For example, if the respective likelihoods for the above errors are 0.01, 0.03 and 0.03 then the overall error rate is 0.07 (excluding second order terms). Broadly speaking, errors can be classified as either those of commission (doing something wrong) or omission (not doing something that should have been done). Errors of commission can then be divided into the following categories:

  • Errors of Selection – error in the use of controls or equipment;
  • Errors of Sequence – required action is carried out in the wrong order;
  • Errors of Timing – task is executed before or after when required; and
  • Errors of Quantity – inadequate amount or in excess.

The error rates can be modified with a “recovery factor” which allows for corrective action to be taken before the consequences of the error affects the overall system performance (corresponding to the Fault Tree AND Gate). For example, if there is a 30% chance that the operator will take immediate corrective action on closing the wrong valve then the error rate for the second item in the above list falls to (0.03 * 0.7), or 21%. A data base of Human Error Probabilities (HEPs) is needed in order to develop the model. Three sources exist for the collection of data suitable for the generation of HEPs. They are:

  1. Data derived from relevant operating experience;
  2. Data derived from experimental research; and
  3. Data derived from simulator studies.

As with any Fault Tree approach the results of the analysis are used to identify those activities which contribute the most to system failure (“The Important Few”) and to take corrective actions to reduce the overall failure rate. Although THERP provides a useful way of integrating human error in Probabilistic Risk models, it does have two drawbacks. First, it is time-consuming and expensive to build a credible data base of human error rates. And, related to this problem, the human beings are not equipment items that fail in some statistically measurable manner. The action of a human depends on many impossible-to-classify issues such as whether a person has just had a domestic dispute.

Hydrogen Sulfide

 Hydrogen Sulfide

The material in this post is extracted from Chapter 5 – Chemicals – of the book Plant Design and Operations.

Hydrogen Sulfide (H2S) is a highly toxic chemical compound that is found in a wide variety of oil processing operations. High concentrations of H2S may be present in crude oil, molten sulfur, tank and pit-bottom sludge and produced water, all of which may release H2S when agitated, heated, or depressurized. Typical operational activities where personnel may be exposed to H2S include drawing samples, handling and testing samples, gauging tanks, and when opening lines and equipment. Typical maintenance activities where personnel may be exposed to H2S include tank cleaning and repair, vessel or sump clean-outs and repair, and well maintenance. These and other similar activities may place workers at a higher risk of exposure to H2S.


Exposures to H2S at concentrations as low as 600 parts per million (ppm) can cause death in a matter of minutes due to paralysis of the respiratory system. The gas is colorless and flammable. It is also 19% more dense than air. Therefore any H2S that leaks is likely to accumulate at a low point. H2S is soluble in many liquids, including hydrocarbons. However, H2S mixed with natural gas may form a lighter-than-air mixture. The fact that H2S is ‘heavier than air’ is a statement that should be used with care, particularly when concentrations of the gas are low (say less than 100 ppm).

Table 5.6 summarizes the effects of H2S at various concentration levels. (Guidance regarding the management of H2S offshore is provided in API RP 14C.)

Table 5.6
Health Effects of Hydrogen Sulfide (Typical)

Concentration (ppm) Potential Effect
<10 Not a health concern.
10 to 20 Eye and respiratory irritation.
20 to 100 Inflammation, corneal blistering and opacity of the eye, loss of the sense of smell, headache, cough and nausea.
100 to 300 Respiratory difficulty.
300 to 600 Central and peripheral nervous system effects, i.e., tremors, weakness, numbness of extremities, unconsciousness and convulsions.
600 to 1000 Rapid unconsciousness, death if first aid not promptly administered.

(1ppm = 1.4 mg/m3).

H2S oxidizes rapidly in the body; therefore, there are normally no permanent aftereffects from acute exposure if the victim is rescued promptly and resuscitated before experiencing prolonged oxygen deprivation.

H2S is not a carcinogen.

The gas is approximately 19% more dense than air. Hence it tends to accumulate in low or enclosed places such as pits, trenches, enclosed well bays and cellars, sumps, the tops of floating roof tanks, buildings, shale shakers and portable containers.

Hydrogen sulfide is easily detected by sense of smell up to values of around 100 ppm. (Most texts state that hydrogen sulfide smells like rotten eggs, but, with modern refrigeration, it is probably more apropos to state that rotten eggs smell like hydrogen sulfide.) Above the value of 100 ppm ‘olfactory fatigue’ can set in, and a person becomes unable to smell the gas. Therefore, the inability to detect H2S through the sense of smell does not prove that the gas is not present. Moreover, the ability to detect the gas by smell varies widely among individuals. Hence portable H2S detectors are commonly used. Each person at the site carries one of these devices, which is typically set to alarm at a value of 10 ppm. In addition to the personal alarms, fixed sensors located around the facility will warn of a release. These sensors should send their signal to the control room.


H2S has a wide flammable range (4.3 – 45.5% by volume in air). When burned, H2S forms sulfur dioxide (SO2). In an oxygen-deficient atmosphere, iron and steel will react with H2S to form iron sulfide deposits on the surface of the metal.

Location of Monitors

API RP 14C provides the following guidance for the location of H2S monitors for offshore installations.

  • Atmospheric H2S concentration is > 50 ppm;
  • H2S concentration in piping is > 100 ppm;
  • Enclosed areas as defined by API RP500 where H2S could reach >50 ppm;
  • Poorly ventilated areas;
  • Sensors should be no greater than 1 meter above the floor/deck with a grid pattern of at least one detector per 400sf (37 m2) of floor space;
  • Sleeping quarters;
  • Within 3 meters of applicable equipment:
    • Vessels
    • Compressors (>50HP/38 KW should have two monitors)
    • Pumps
    • Headers
    • Wellheads

If H2S is detected both visual and audible alarms should be triggered.


Hydrogen sulfide can cause corrosion of stainless steels such as 316 and 410 stainless in the form of sulfide stress cracking. (Other factors, such as pH, chloride concentration and temperature also affect the potential for steel cracking.) Copper alloys corrode rapidly in H2S service. An industry value that has been developed is NACE MR-01, 2003 from the National Association of Corrosion Engineers. In the gas phase, a stream is sour if the H2S partial pressure exceeds 0.05 psia. If a single phase liquid is in equilibrium with a gas phase, where the gas phase H2S partial pressure exceeds 0.05 psia, then that liquid is also considered to be sour. If the liquid is not in equilibrium with the gas phase, then the liquid is considered sour, if this bubble point gas phase H2S partial pressure exceeds 0.05 psia. The presence of water is not required for a gas and/or liquid to be considered to be sour, nor is there a minimum pressure to avoid designating a gas or liquid as sour.

In an oxygen-deficient atmosphere, iron and steel will react with H2S to form iron sulfide deposits on the surface of the metal. Some iron sulfides (known as pyrophoric iron sulfide) are unstable and, when exposed to air, will undergo a rapid chemical reaction creating an ignition source that should be considered during equipment shutdowns.

Hydrogen sulfide is easily detected by sense of smell up to values of around 100 ppm. (Most texts state that hydrogen sulfide smells like rotten eggs, but, with modern refrigeration, it is probably more apropos to state that rotten eggs smell like hydrogen sulfide.) Above the value of 100 ppm ‘olfactory fatigue’ can set in, and a person becomes unable to smell the gas. Therefore, the inability to detect H2S through the sense of smell does not prove that the gas is not present. Moreover, the ability to detect the gas by smell varies widely among individuals.

Portable H2S detectors are commonly used wherever H2S may be present. They typically have an alarm value set in the 5-10 ppm range. In addition to the personal alarms, fixed sensors located around the facility will warn of a release.